security: Add hook to invalidate inode security labels

Add a hook to invalidate an inode's security label when the cached
information becomes invalid.

Add the new hook in selinux: set a flag when a security label becomes
invalid.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 4c48227450e685295777009f2c6f42c4f962ee4a..71969de4058c9922e7a174173fca4dec5394be4f 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1261,6 +1261,10 @@
  *     audit_rule_init.
  *     @rule contains the allocated rule
  *
+ * @inode_invalidate_secctx:
+ *     Notify the security module that it must revalidate the security context
+ *     of an inode.
+ *
  * @inode_notifysecctx:
  *     Notify the security module of what the security context of an inode
  *     should be.  Initializes the incore security context managed by the
@@ -1516,6 +1520,7 @@ union security_list_options {
        int (*secctx_to_secid)(const char *secdata, u32 seclen, u32 *secid);
        void (*release_secctx)(char *secdata, u32 seclen);
 
+       void (*inode_invalidate_secctx)(struct inode *inode);
        int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen);
        int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen);
        int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
@@ -1757,6 +1762,7 @@ struct security_hook_heads {
        struct list_head secid_to_secctx;
        struct list_head secctx_to_secid;
        struct list_head release_secctx;
+       struct list_head inode_invalidate_secctx;
        struct list_head inode_notifysecctx;
        struct list_head inode_setsecctx;
        struct list_head inode_getsecctx;

diff --git a/include/linux/security.h b/include/linux/security.h
index e79149a06454142b1f0db6c6eb26280749697d57..4824a4ccaf1c37942d7fafc64b2a430062c962a1 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -353,6 +353,7 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void security_release_secctx(char *secdata, u32 seclen);
 
+void security_inode_invalidate_secctx(struct inode *inode);
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
@@ -1093,6 +1094,10 @@ static inline void security_release_secctx(char *secdata, u32 seclen)
 {
 }
 
+static inline void security_inode_invalidate_secctx(struct inode *inode)
+{
+}
+
 static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
 {
        return -EOPNOTSUPP;

diff --git a/security/security.c b/security/security.c
index c5beb7e9072125792e2c7043e2fa446619574399..e8ffd92ae2eb5a761bfafab5556df9c54c8bd32e 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -1161,6 +1161,12 @@ void security_release_secctx(char *secdata, u32 seclen)
 }
 EXPORT_SYMBOL(security_release_secctx);
 
+void security_inode_invalidate_secctx(struct inode *inode)
+{
+       call_void_hook(inode_invalidate_secctx, inode);
+}
+EXPORT_SYMBOL(security_inode_invalidate_secctx);
+
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
 {
        return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
@@ -1763,6 +1769,8 @@ struct security_hook_heads security_hook_heads = {
                LIST_HEAD_INIT(security_hook_heads.secctx_to_secid),
        .release_secctx =
                LIST_HEAD_INIT(security_hook_heads.release_secctx),
+       .inode_invalidate_secctx =
+               LIST_HEAD_INIT(security_hook_heads.inode_invalidate_secctx),
        .inode_notifysecctx =
                LIST_HEAD_INIT(security_hook_heads.inode_notifysecctx),
        .inode_setsecctx =

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1dc0d79a6a259e34b4636a527ed5503f5608bca2..ef3bd9d61c38cd0f2fd927786ede1199bba82fd6 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -820,7 +820,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                        goto out;
 
                root_isec->sid = rootcontext_sid;
-               root_isec->initialized = 1;
+               root_isec->initialized = LABEL_INITIALIZED;
        }
 
        if (defcontext_sid) {
@@ -1308,11 +1308,11 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
        unsigned len = 0;
        int rc = 0;
 
-       if (isec->initialized)
+       if (isec->initialized == LABEL_INITIALIZED)
                goto out;
 
        mutex_lock(&isec->lock);
-       if (isec->initialized)
+       if (isec->initialized == LABEL_INITIALIZED)
                goto out_unlock;
 
        sbsec = inode->i_sb->s_security;
@@ -1484,7 +1484,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                break;
        }
 
-       isec->initialized = 1;
+       isec->initialized = LABEL_INITIALIZED;
 
 out_unlock:
        mutex_unlock(&isec->lock);
@@ -2790,7 +2790,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
                struct inode_security_struct *isec = inode->i_security;
                isec->sclass = inode_mode_to_security_class(inode->i_mode);
                isec->sid = newsid;
-               isec->initialized = 1;
+               isec->initialized = LABEL_INITIALIZED;
        }
 
        if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
@@ -3089,7 +3089,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
 
        isec->sclass = inode_mode_to_security_class(inode->i_mode);
        isec->sid = newsid;
-       isec->initialized = 1;
+       isec->initialized = LABEL_INITIALIZED;
 
        return;
 }
@@ -3183,7 +3183,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
 
        isec->sclass = inode_mode_to_security_class(inode->i_mode);
        isec->sid = newsid;
-       isec->initialized = 1;
+       isec->initialized = LABEL_INITIALIZED;
        return 0;
 }
 
@@ -3761,7 +3761,7 @@ static void selinux_task_to_inode(struct task_struct *p,
        u32 sid = task_sid(p);
 
        isec->sid = sid;
-       isec->initialized = 1;
+       isec->initialized = LABEL_INITIALIZED;
 }
 
 /* Returns error only if unable to parse addresses */
@@ -4092,7 +4092,7 @@ static int selinux_socket_post_create(struct socket *sock, int family,
                        return err;
        }
 
-       isec->initialized = 1;
+       isec->initialized = LABEL_INITIALIZED;
 
        if (sock->sk) {
                sksec = sock->sk->sk_security;
@@ -4283,7 +4283,7 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
        isec = inode_security(SOCK_INODE(sock));
        newisec->sclass = isec->sclass;
        newisec->sid = isec->sid;
-       newisec->initialized = 1;
+       newisec->initialized = LABEL_INITIALIZED;
 
        return 0;
 }
@@ -5775,6 +5775,15 @@ static void selinux_release_secctx(char *secdata, u32 seclen)
        kfree(secdata);
 }
 
+static void selinux_inode_invalidate_secctx(struct inode *inode)
+{
+       struct inode_security_struct *isec = inode->i_security;
+
+       mutex_lock(&isec->lock);
+       isec->initialized = LABEL_INVALID;
+       mutex_unlock(&isec->lock);
+}
+
 /*
  *     called with inode->i_mutex locked
  */
@@ -6006,6 +6015,7 @@ static struct security_hook_list selinux_hooks[] = {
        LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
        LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
        LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
+       LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
        LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
        LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
        LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),

diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 81fa718d5cb38817fdda9ad580f8316ef5d3e5c6..a2ae05414ba1919041ec582b251cbb2c39f5a651 100644 (file)
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -37,6 +37,12 @@ struct task_security_struct {
        u32 sockcreate_sid;     /* fscreate SID */
 };
 
+enum label_initialized {
+       LABEL_MISSING,          /* not initialized */
+       LABEL_INITIALIZED,      /* inizialized */
+       LABEL_INVALID           /* invalid */
+};
+
 struct inode_security_struct {
        struct inode *inode;    /* back pointer to inode object */
        union {