David Howells
3a3b7ce933
CRED: Allow kernel services to override LSM settings for task actions
...
Allow kernel services to override LSM settings appropriate to the actions
performed by a task by duplicating a set of credentials, modifying it and then
using task_struct::cred to point to it when performing operations on behalf of
a task.
This is used, for example, by CacheFiles which has to transparently access the
cache on behalf of a process that thinks it is doing, say, NFS accesses with a
potentially inappropriate (with respect to accessing the cache) set of
credentials.
This patch provides two LSM hooks for modifying a task security record:
(*) security_kernel_act_as() which allows modification of the security datum
with which a task acts on other objects (most notably files).
(*) security_kernel_create_files_as() which allows modification of the
security datum that is used to initialise the security data on a file that
a task creates.
The patch also provides four new credentials handling functions, which wrap the
LSM functions:
(1) prepare_kernel_cred()
Prepare a set of credentials for a kernel service to use, based either on
a daemon's credentials or on init_cred. All the keyrings are cleared.
(2) set_security_override()
Set the LSM security ID in a set of credentials to a specific security
context, assuming permission from the LSM policy.
(3) set_security_override_from_ctx()
As (2), but takes the security context as a string.
(4) set_create_files_as()
Set the file creation LSM security ID in a set of credentials to be the
same as that on a particular inode.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com > [Smack changes]
Signed-off-by: David Howells <dhowells@redhat.com >
Signed-off-by: James Morris <jmorris@namei.org >
2008-11-14 10:39:28 +11:00
..
2008-10-20 08:52:40 -07:00
2008-10-17 17:15:43 -03:00
2008-10-22 01:19:37 +02:00
2008-10-04 17:12:27 -04:00
2008-10-19 22:54:12 +02:00
2008-10-22 15:38:42 -07:00
2008-10-12 11:04:34 +02:00
2008-10-20 09:03:12 -07:00
2008-10-14 11:58:31 -07:00
2008-10-08 11:35:19 +02:00
2008-10-08 11:35:00 +02:00
2008-09-29 17:56:56 -04:00
2008-10-21 13:25:28 +11:00
2008-10-13 21:51:51 +01:00
2008-10-30 11:38:47 -07:00
2008-10-15 15:54:56 -04:00
2008-09-12 16:30:20 -07:00
2008-10-20 16:07:19 +01:00
2008-09-17 16:54:26 +01:00
2008-10-10 23:50:21 -04:00
2008-10-20 11:01:52 -07:00
2008-10-16 11:21:51 -07:00
2008-10-10 22:39:31 +02:00
2008-11-14 10:39:24 +11:00
2008-10-16 11:21:39 -07:00
2008-10-16 11:21:39 -07:00
2008-10-20 08:50:25 -07:00
2008-10-20 08:52:42 -07:00
2008-11-14 10:39:24 +11:00
2008-10-17 09:29:55 -07:00
2008-10-23 08:20:34 -07:00
2008-10-21 07:48:52 -04:00
2008-10-17 08:46:57 +02:00
2008-10-20 08:52:32 -07:00
2008-11-14 10:39:23 +11:00
2008-10-21 07:47:22 -04:00
2008-10-20 08:52:34 -07:00
2008-10-30 11:38:45 -07:00
2008-10-16 11:21:32 -07:00
2008-09-24 16:38:17 -07:00
2008-10-16 11:21:33 -07:00
2008-10-14 10:35:08 +02:00
2008-10-14 12:12:02 -07:00
2008-10-09 13:52:43 -04:00
2008-10-23 18:51:22 +04:00
2008-11-14 10:39:28 +11:00
2008-10-23 05:13:16 -04:00
2008-10-23 10:23:07 -07:00
2008-10-22 20:21:31 +02:00
2008-10-13 09:51:43 -07:00
2008-10-21 17:45:06 +01:00
2008-10-18 14:29:15 +01:00
2008-09-19 10:20:41 +02:00
2008-10-16 16:53:04 +02:00
2008-10-13 16:05:06 +01:00
2008-10-15 12:46:51 +01:00
2008-10-16 09:24:47 -07:00
2008-10-16 16:53:13 +02:00
2008-10-09 08:56:13 +02:00
2008-10-12 12:05:55 +02:00
2008-10-16 11:21:30 -07:00
2008-10-20 08:52:37 -07:00
2008-10-16 11:21:30 -07:00
2008-10-20 08:52:36 -07:00
2008-10-09 08:56:19 +02:00
2008-10-08 19:44:18 -04:00
2008-10-21 07:47:06 -04:00
2008-10-15 22:21:11 +02:00
2008-10-30 11:38:45 -07:00
2008-11-14 10:39:25 +11:00
2008-10-31 00:59:46 -04:00
2008-10-21 07:47:06 -04:00
2008-10-23 16:00:24 +02:00
2008-10-16 16:08:57 +02:00
2008-10-23 17:57:37 +04:00
2008-09-22 07:29:31 +01:00
2008-10-16 11:21:40 -07:00
2008-10-27 15:06:01 +01:00
2008-10-14 23:51:02 +02:00
2008-10-22 09:48:06 +02:00
2008-10-23 13:52:40 +04:00
2008-10-22 20:21:30 +02:00
2008-10-17 17:25:11 -03:00
2008-10-22 20:21:33 +02:00
2008-10-16 11:21:38 -07:00
2008-10-24 12:54:18 -04:00
2008-10-15 16:03:01 -07:00
2008-10-21 07:47:30 -04:00
2008-09-24 16:18:02 -04:00
2008-10-13 19:01:08 -07:00
2008-10-13 19:01:08 -07:00
2008-10-13 19:01:08 -07:00
2008-09-22 21:28:11 -07:00
2008-10-01 01:30:19 -07:00
2008-10-09 11:59:55 -07:00
2008-09-22 21:28:11 -07:00
2008-10-13 19:01:08 -07:00
2008-10-01 07:30:02 -07:00
2008-10-07 15:34:37 -07:00
2008-11-14 10:39:26 +11:00
2008-10-29 22:02:09 +01:00
2008-10-18 14:29:15 +01:00
2008-10-20 13:23:01 -07:00
2008-11-03 18:21:45 +01:00
2008-10-16 11:21:33 -07:00
2008-10-16 15:17:40 -07:00
2008-10-15 14:24:08 +02:00
2008-10-18 14:05:18 +02:00
2008-10-21 15:54:40 +02:00
2008-09-22 01:15:02 -07:00
2008-10-12 09:37:01 -02:00
2008-10-16 20:00:24 -04:00
2008-10-23 08:55:01 -07:00
2008-10-16 11:21:32 -07:00
2008-10-16 11:21:31 -07:00
2008-10-20 08:52:40 -07:00
2008-10-20 13:23:01 -07:00
2008-10-30 11:38:47 -07:00
2008-11-14 10:39:24 +11:00
2008-11-14 10:39:14 +11:00
2008-10-09 08:56:04 +02:00
2008-10-16 11:21:29 -07:00
2008-10-14 10:34:22 +02:00
2008-10-28 14:21:34 +02:00
2008-10-28 14:22:15 +02:00
2008-09-23 22:01:33 +01:00
2008-10-20 22:34:12 +01:00
2008-11-04 01:08:27 -05:00
2008-10-14 10:35:08 +02:00
2008-10-13 09:47:43 +11:00
2008-10-09 08:56:06 +02:00
2008-10-10 23:16:16 -04:00
2008-10-14 10:39:28 +02:00
2008-10-20 08:52:39 -07:00
2008-09-13 14:41:52 -07:00
2008-10-20 08:50:25 -07:00
2008-10-20 08:52:31 -07:00
2008-10-20 08:52:39 -07:00
2008-10-20 08:52:30 -07:00
2008-10-14 10:37:17 +02:00
2008-10-20 08:52:39 -07:00
2008-10-29 00:51:25 +01:00
2008-10-22 10:00:23 +11:00
2008-10-22 10:00:23 +11:00
2008-10-16 11:21:30 -07:00
2008-10-23 05:13:20 -04:00
2008-10-30 23:54:35 -07:00
2008-10-08 11:35:01 +02:00
2008-10-01 07:03:24 -07:00
2008-10-06 20:08:26 -04:00
2008-10-17 13:06:45 -04:00
2008-10-07 17:22:20 -04:00
2008-10-14 19:23:17 -04:00
2008-09-15 16:48:19 -04:00
2008-10-13 10:55:47 +11:00
2008-10-21 15:17:48 +11:00
2008-10-23 08:55:02 -07:00
2008-10-20 08:52:30 -07:00
2008-10-20 08:52:32 -07:00
2008-10-20 08:50:26 -07:00
2008-10-16 11:21:49 -07:00
2008-10-13 10:10:37 -07:00
2008-10-22 16:42:43 -07:00
2008-10-23 10:20:36 -07:00
2008-10-22 16:42:35 -07:00
2008-10-23 14:54:18 -07:00
2008-10-09 12:50:59 -04:00
2008-10-05 13:33:42 -07:00
2008-09-14 17:24:26 +02:00
2008-10-26 23:07:25 -07:00
2008-10-08 16:38:41 -07:00
2008-10-16 11:21:48 -07:00
2008-09-12 16:29:34 -07:00
2008-10-16 09:24:51 -07:00
2008-10-16 11:21:30 -07:00
2008-10-23 00:11:07 -04:00
2008-09-24 15:45:48 +02:00
2008-10-23 18:54:05 +04:00
2008-10-23 08:55:01 -07:00
2008-10-20 08:52:39 -07:00
2008-10-16 11:21:46 -07:00
2008-10-16 11:21:46 -07:00
2008-10-02 15:53:13 -07:00
2008-10-03 10:36:08 +02:00
2008-09-30 12:08:41 +02:00
2008-10-21 07:49:04 -04:00
2008-10-16 11:21:30 -07:00
2008-10-30 11:38:45 -07:00
2008-10-14 10:39:05 +02:00
2008-10-20 08:52:40 -07:00
2008-10-16 11:21:30 -07:00
2008-09-22 19:51:15 -07:00
2008-11-14 10:39:26 +11:00
2008-11-14 10:39:18 +11:00
2008-11-14 10:39:28 +11:00
2008-10-20 08:52:39 -07:00
2008-10-13 09:51:39 -07:00
2008-10-13 09:51:40 -07:00
2008-10-01 16:13:54 +09:00
2008-10-07 14:22:33 -07:00
2008-10-23 15:20:06 +04:00
2008-09-23 08:09:13 -07:00
2008-10-22 07:00:38 -04:00
2008-10-17 08:46:56 +02:00
2008-10-05 11:16:16 -07:00
2008-10-03 18:22:18 -07:00
2008-10-03 11:46:14 -05:00
2008-11-02 10:15:07 -08:00
2008-10-20 08:52:40 -07:00
2008-10-20 08:52:31 -07:00
2008-10-16 11:21:28 -07:00
2008-10-16 11:21:47 -07:00
2008-10-20 08:52:42 -07:00
2008-10-16 11:21:32 -07:00
2008-10-07 14:43:06 -07:00
2008-10-16 11:21:45 -07:00
2008-10-13 09:51:40 -07:00
2008-10-17 18:13:38 +02:00
2008-10-22 09:48:06 +02:00
2008-09-24 17:33:13 +02:00
2008-10-14 10:39:31 +02:00
2008-10-13 09:51:43 -07:00
2008-10-13 09:51:44 -07:00
2008-10-21 07:47:06 -04:00
2008-10-17 14:41:02 -07:00
2008-09-17 16:54:35 +01:00
2008-10-21 14:31:15 -02:00
2008-10-23 15:48:28 +04:00
2008-10-23 17:35:04 +04:00
2008-10-13 09:51:42 -07:00
2008-10-16 11:21:31 -07:00
2008-09-17 16:54:23 +01:00
2008-10-02 22:48:34 +01:00
2008-10-22 10:00:25 +11:00
2008-10-16 10:09:17 -04:00
2008-10-05 13:33:42 -07:00