>From b705c8f3c0776cbc4d7a9f5209edcde8b9160d24 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Date: Mon, 30 Sep 2013 20:08:10 +0900
Subject: [PATCH 2/4] LSM: Revive security_task_alloc() hook.
Revive a LSM hook which is called when a task_struct is allocated.
This hook is used by TOMOYO for inheriting per a task_struct variables.
Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
---
include/linux/security.h | 10 ++++++++++
kernel/fork.c | 7 ++++++-
security/capability.c | 6 ++++++
security/security.c | 5 +++++
4 files changed, 27 insertions(+), 1 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 6c71236..8f9e4f2 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -673,6 +673,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* manual page for definitions of the @clone_flags.
* @clone_flags contains the flags indicating what should be shared.
* Return 0 if permission is granted.
+ * @task_alloc:
+ * @task task being allocated.
+ * Handle allocation of task-related resources.
* @task_free:
* @task task being freed
* Handle release of task-related resources. (Note that this can be called
@@ -1562,6 +1565,7 @@ struct security_operations {
int (*file_open) (struct file *file, const struct cred *cred);
int (*task_create) (unsigned long clone_flags);
+ int (*task_alloc) (struct task_struct *task);
void (*task_free) (struct task_struct *task);
int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp);
void (*cred_free) (struct cred *cred);
@@ -1835,6 +1839,7 @@ int security_file_send_sigiotask(struct task_struct *tsk,
int security_file_receive(struct file *file);
int security_file_open(struct file *file, const struct cred *cred);
int security_task_create(unsigned long clone_flags);
+int security_task_alloc(struct task_struct *task);
void security_task_free(struct task_struct *task);
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
void security_cred_free(struct cred *cred);
@@ -2337,6 +2342,11 @@ static inline int security_task_create(unsigned long clone_flags)
return 0;
}
+static inline int security_task_alloc(struct task_struct *task)
+{
+ return 0;
+}
+
static inline void security_task_free(struct task_struct *task)
{ }
diff --git a/kernel/fork.c b/kernel/fork.c
index 086fe73..ce24b3e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1318,9 +1318,12 @@ static struct task_struct *copy_process(unsigned long clone_flags,
retval = perf_event_init_task(p);
if (retval)
goto bad_fork_cleanup_policy;
- retval = audit_alloc(p);
+ retval = security_task_alloc(p);
if (retval)
goto bad_fork_cleanup_policy;
+ retval = audit_alloc(p);
+ if (retval)
+ goto bad_fork_cleanup_security;
/* copy all the process information */
retval = copy_semundo(clone_flags, p);
if (retval)
@@ -1517,6 +1520,8 @@ bad_fork_cleanup_semundo:
exit_sem(p);
bad_fork_cleanup_audit:
audit_free(p);
+bad_fork_cleanup_security:
+ security_task_free(p);
bad_fork_cleanup_policy:
perf_event_free_task(p);
#ifdef CONFIG_NUMA
diff --git a/security/capability.c b/security/capability.c
index 7dc95f7..4e55ce2 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -373,6 +373,11 @@ static int cap_task_create(unsigned long clone_flags)
return 0;
}
+static int cap_task_alloc(struct task_struct *task)
+{
+ return 0;
+}
+
static void cap_task_free(struct task_struct *task)
{
}
@@ -1012,6 +1017,7 @@ void __init security_fixup_ops(struct security_operations *ops)
set_to_cap_if_null(ops, file_receive);
set_to_cap_if_null(ops, file_open);
set_to_cap_if_null(ops, task_create);
+ set_to_cap_if_null(ops, task_alloc);
set_to_cap_if_null(ops, task_free);
set_to_cap_if_null(ops, cred_alloc_blank);
set_to_cap_if_null(ops, cred_free);
diff --git a/security/security.c b/security/security.c
index fc05875..97e177f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -794,6 +794,11 @@ int security_task_create(unsigned long clone_flags)
return security_ops->task_create(clone_flags);
}
+int security_task_alloc(struct task_struct *task)
+{
+ return security_ops->task_alloc(task);
+}
+
void security_task_free(struct task_struct *task)
{
#ifdef CONFIG_SECURITY_YAMA_STACKED
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
