On 10/12/2022 2:14 PM, Mickaël Salaün wrote:
>
> On 27/09/2022 21:53, Casey Schaufler wrote:
>> Add an integer member "id" to the struct lsm_id. This value is
>> a unique identifier associated with each security module. The
>> values are defined in a new UAPI header file. Each existing LSM
>> has been updated to include it's LSMID in the lsm_id.
>>
>> Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
>> ---
>> include/linux/lsm_hooks.h | 1 +
>> include/uapi/linux/lsm.h | 32 ++++++++++++++++++++++++++++++++
>> security/apparmor/lsm.c | 2 ++
>> security/bpf/hooks.c | 2 ++
>> security/commoncap.c | 2 ++
>> security/landlock/setup.c | 2 ++
>> security/loadpin/loadpin.c | 2 ++
>> security/lockdown/lockdown.c | 4 +++-
>> security/safesetid/lsm.c | 2 ++
>> security/selinux/hooks.c | 2 ++
>> security/smack/smack_lsm.c | 2 ++
>> security/tomoyo/tomoyo.c | 2 ++
>> security/yama/yama_lsm.c | 2 ++
>> 13 files changed, 56 insertions(+), 1 deletion(-)
>> create mode 100644 include/uapi/linux/lsm.h
>>
>> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
>> index 23054881eb08..407f57aaa6ef 100644
>> --- a/include/linux/lsm_hooks.h
>> +++ b/include/linux/lsm_hooks.h
>> @@ -1603,6 +1603,7 @@ struct security_hook_heads {
>> */
>> struct lsm_id {
>> const char *lsm; /* Name of the LSM */
>> + int id; /* LSM ID */
>> };
>> /*
>> diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h
>> new file mode 100644
>> index 000000000000..5647c3e220c0
>> --- /dev/null
>> +++ b/include/uapi/linux/lsm.h
>> @@ -0,0 +1,32 @@
>> +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
>> +/*
>> + * Linus Security Modules (LSM) - User space API
>> + *
>> + * Copyright (C) 2022 Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
>> + * Copyright (C) Intel Corporation
>> + */
>> +
>> +#ifndef _UAPI_LINUX_LSM_H
>> +#define _UAPI_LINUX_LSM_H
>> +
>> +/*
>> + * ID values to identify security modules.
>> + * A system may use more than one security module.
>> + *
>> + * LSM_ID_XXX values 32 and below are reserved for future use
>
> What do you have in mind? Why not "reserve" higher bits instead and
> start with SELinux at 1?
I don't know what (if anything) Paul had in mind when he suggested the reserved values.
It's not like there's a shortage of numbers, and as it's part of the ABI and can't
change I'll err on the side of caution.
>
>
>> + */
>> +#define LSM_ID_INVALID -1
>> +#define LSM_ID_SELINUX 33
>> +#define LSM_ID_SMACK 34
>> +#define LSM_ID_TOMOYO 35
>> +#define LSM_ID_IMA 36
>> +#define LSM_ID_APPARMOR 37
>> +#define LSM_ID_YAMA 38
>> +#define LSM_ID_LOADPIN 39
>> +#define LSM_ID_SAFESETID 40
>> +#define LSM_ID_LOCKDOWN 41
>> +#define LSM_ID_BPF 42
>> +#define LSM_ID_LANDLOCK 43
>> +#define LSM_ID_CAPABILITY 44
>
> Out of curiosity, why this order?
Order of inclusion upstream. Except for capability. In the next version
I plan to fix the order by putting LSM_ID_CAPABILITY first at 32 and
changing the comment. If we wanted something less mundane we could hex
encode the first 4 letters of the name, but except for hacker style debugging
that doesn't gain anything.
>
>
>> +
>> +#endif /* _UAPI_LINUX_LSM_H */
>> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
>> index b71f7d4159d7..fb6c7edd5393 100644
>> --- a/security/apparmor/lsm.c
>> +++ b/security/apparmor/lsm.c
>> @@ -24,6 +24,7 @@
>> #include <linux/zlib.h>
>> #include <net/sock.h>
>> #include <uapi/linux/mount.h>
>> +#include <uapi/linux/lsm.h>
>> #include "include/apparmor.h"
>> #include "include/apparmorfs.h"
>> @@ -1204,6 +1205,7 @@ struct lsm_blob_sizes apparmor_blob_sizes
>> __lsm_ro_after_init = {
>> static struct lsm_id apparmor_lsmid __lsm_ro_after_init = {
>> .lsm = "apparmor",
>> + .id = LSM_ID_APPARMOR,
>> };
>> static struct security_hook_list apparmor_hooks[]
>> __lsm_ro_after_init = {
>> diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
>> index e50de3abfde2..c462fc41dd57 100644
>> --- a/security/bpf/hooks.c
>> +++ b/security/bpf/hooks.c
>> @@ -5,6 +5,7 @@
>> */
>> #include <linux/lsm_hooks.h>
>> #include <linux/bpf_lsm.h>
>> +#include <uapi/linux/lsm.h>
>> static struct security_hook_list bpf_lsm_hooks[]
>> __lsm_ro_after_init = {
>> #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
>> @@ -21,6 +22,7 @@ static struct security_hook_list bpf_lsm_hooks[]
>> __lsm_ro_after_init = {
>> */
>> struct lsm_id bpf_lsmid __lsm_ro_after_init = {
>> .lsm = "bpf",
>> + .id = LSM_ID_BPF,
>> };
>> static int __init bpf_lsm_init(void)
>> diff --git a/security/commoncap.c b/security/commoncap.c
>> index dab1b5f5e6aa..4e9b140159d8 100644
>> --- a/security/commoncap.c
>> +++ b/security/commoncap.c
>> @@ -25,6 +25,7 @@
>> #include <linux/binfmts.h>
>> #include <linux/personality.h>
>> #include <linux/mnt_idmapping.h>
>> +#include <uapi/linux/lsm.h>
>> /*
>> * If a non-root user executes a setuid-root binary in
>> @@ -1448,6 +1449,7 @@ int cap_mmap_file(struct file *file, unsigned
>> long reqprot,
>> static struct lsm_id capability_lsmid __lsm_ro_after_init = {
>> .lsm = "capability",
>> + .id = LSM_ID_CAPABILITY,
>> };
>> static struct security_hook_list capability_hooks[]
>> __lsm_ro_after_init = {
>> diff --git a/security/landlock/setup.c b/security/landlock/setup.c
>> index fc7b69c5839e..1242c61c9de4 100644
>> --- a/security/landlock/setup.c
>> +++ b/security/landlock/setup.c
>> @@ -8,6 +8,7 @@
>> #include <linux/init.h>
>> #include <linux/lsm_hooks.h>
>> +#include <uapi/linux/lsm.h>
>> #include "common.h"
>> #include "cred.h"
>> @@ -25,6 +26,7 @@ struct lsm_blob_sizes landlock_blob_sizes
>> __lsm_ro_after_init = {
>> struct lsm_id landlock_lsmid __lsm_ro_after_init = {
>> .lsm = LANDLOCK_NAME,
>> + .id = LSM_ID_LANDLOCK,
>
> Please only use one space after ".id"
Yeah, I got that from the comments on 01/39. I will make that change
throughout the set.
