Files
ubports_kernel_google_msm/include/linux
David Howells 3a3b7ce933 CRED: Allow kernel services to override LSM settings for task actions
Allow kernel services to override LSM settings appropriate to the actions
performed by a task by duplicating a set of credentials, modifying it and then
using task_struct::cred to point to it when performing operations on behalf of
a task.

This is used, for example, by CacheFiles which has to transparently access the
cache on behalf of a process that thinks it is doing, say, NFS accesses with a
potentially inappropriate (with respect to accessing the cache) set of
credentials.

This patch provides two LSM hooks for modifying a task security record:

 (*) security_kernel_act_as() which allows modification of the security datum
     with which a task acts on other objects (most notably files).

 (*) security_kernel_create_files_as() which allows modification of the
     security datum that is used to initialise the security data on a file that
     a task creates.

The patch also provides four new credentials handling functions, which wrap the
LSM functions:

 (1) prepare_kernel_cred()

     Prepare a set of credentials for a kernel service to use, based either on
     a daemon's credentials or on init_cred.  All the keyrings are cleared.

 (2) set_security_override()

     Set the LSM security ID in a set of credentials to a specific security
     context, assuming permission from the LSM policy.

 (3) set_security_override_from_ctx()

     As (2), but takes the security context as a string.

 (4) set_create_files_as()

     Set the file creation LSM security ID in a set of credentials to be the
     same as that on a particular inode.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [Smack changes]
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-14 10:39:28 +11:00
..
2008-10-22 01:19:37 +02:00
2008-10-20 09:03:12 -07:00
2008-10-13 21:51:51 +01:00
2008-10-30 11:38:47 -07:00
2008-10-15 15:54:56 -04:00
2008-09-12 16:30:20 -07:00
2008-10-20 11:01:52 -07:00
2008-10-16 11:21:51 -07:00
2008-10-20 08:52:42 -07:00
2008-10-20 08:52:32 -07:00
2008-11-14 10:39:23 +11:00
2008-10-30 11:38:45 -07:00
2008-10-16 11:21:32 -07:00
2008-10-14 10:35:08 +02:00
2008-10-18 14:29:15 +01:00
2008-10-16 16:53:13 +02:00
2008-10-12 12:05:55 +02:00
2008-10-08 19:44:18 -04:00
2008-11-14 10:39:25 +11:00
2008-10-23 16:00:24 +02:00
2008-10-16 16:08:57 +02:00
2008-09-22 07:29:31 +01:00
2008-10-16 11:21:40 -07:00
2008-10-14 23:51:02 +02:00
2008-10-22 20:21:33 +02:00
2008-10-16 11:21:38 -07:00
2008-10-09 11:59:55 -07:00
2008-09-22 21:28:11 -07:00
2008-10-07 15:34:37 -07:00
2008-10-29 22:02:09 +01:00
2008-10-18 14:29:15 +01:00
2008-11-03 18:21:45 +01:00
2008-10-15 14:24:08 +02:00
2008-10-18 14:05:18 +02:00
2008-10-30 11:38:47 -07:00
2008-10-28 14:22:15 +02:00
2008-10-20 22:34:12 +01:00
2008-10-14 10:35:08 +02:00
2008-10-13 09:47:43 +11:00
2008-10-09 08:56:06 +02:00
2008-10-20 08:52:31 -07:00
2008-10-20 08:52:30 -07:00
2008-10-22 10:00:23 +11:00
2008-10-01 07:03:24 -07:00
2008-10-17 13:06:45 -04:00
2008-10-20 08:52:32 -07:00
2008-10-20 08:50:26 -07:00
2008-10-16 11:21:49 -07:00
2008-10-22 16:42:43 -07:00
2008-10-08 16:38:41 -07:00
2008-10-23 00:11:07 -04:00
2008-10-23 18:54:05 +04:00
2008-10-20 08:52:39 -07:00
2008-10-16 11:21:46 -07:00
2008-10-16 11:21:46 -07:00
2008-10-02 15:53:13 -07:00
2008-10-20 08:52:40 -07:00
2008-09-22 19:51:15 -07:00
2008-10-07 14:22:33 -07:00
2008-11-02 10:15:07 -08:00
2008-10-20 08:52:31 -07:00
2008-10-16 11:21:47 -07:00
2008-10-07 14:43:06 -07:00
2008-10-16 11:21:45 -07:00
2008-10-13 09:51:40 -07:00
2008-10-17 14:41:02 -07:00
2008-10-16 11:21:31 -07:00
2008-09-17 16:54:23 +01:00