Weekly Edition
Return to the Kernel pageRecent Features
| |||||||||||||
2.5.38-lsm-ipc.patch
The patch below adds the LSM hooks for System V IPC to the 2.5.38 kernel.
diff -X /home/sds/dontdiff -ru linux-2.5.38/include/linux/ipc.h lsm-ipc-2.5.38/include/linux/ipc.h
--- linux-2.5.38/include/linux/ipc.h Sun Sep 22 00:24:57 2002
+++ lsm-ipc-2.5.38/include/linux/ipc.h Tue Sep 24 11:32:00 2002
@@ -63,6 +63,7 @@
gid_t cgid;
mode_t mode;
unsigned long seq;
+ void *security;
};
#endif /* __KERNEL__ */
diff -X /home/sds/dontdiff -ru linux-2.5.38/include/linux/msg.h lsm-ipc-2.5.38/include/linux/msg.h
--- linux-2.5.38/include/linux/msg.h Sun Sep 22 00:25:11 2002
+++ lsm-ipc-2.5.38/include/linux/msg.h Tue Sep 24 11:32:00 2002
@@ -69,6 +69,7 @@
long m_type;
int m_ts; /* message text size */
struct msg_msgseg* next;
+ void *security;
/* the actual message follows immediately */
};
diff -X /home/sds/dontdiff -ru linux-2.5.38/include/linux/security.h lsm-ipc-2.5.38/include/linux/security.h
--- linux-2.5.38/include/linux/security.h Sun Sep 22 00:25:02 2002
+++ lsm-ipc-2.5.38/include/linux/security.h Tue Sep 24 11:32:00 2002
@@ -572,6 +572,159 @@
* is being reparented to the init task.
* @p contains the task_struct for the kernel thread.
*
+ * Security hooks affecting all System V IPC operations.
+ *
+ * @ipc_permission:
+ * Check user, group, and other permissions for access to IPC
+ * @ipcp contains the IPC permission set
+ * @flag contains the desired (requested) permission set
+ * Return 0 if permission is granted.
+ * @ipc_getinfo:
+ * Check permission to retrieve information on previously allocated IPC
+ * resources. Called by the IPC resource control syscalls, shmctl,
+ * msgctl, semctl with a @cmd argument of: IPC_INFO, SEM_INFO, MSG_INFO,
+ * or SHM_INFO as appropriate.
+ * @id contains the resource identifier
+ * @cmd contains the operation to be performed
+ * Return 0 if permission is granted.
+ *
+ * Security hooks for individual messages held in System V IPC message queues
+ * @msg_msg_alloc_security:
+ * Allocate and attach a security structure to the msg->security field.
+ * The security field is initialized to NULL when the structure is first
+ * created.
+ * @msg contains the message structure to be modified.
+ * Return 0 if operation was successful and permission is granted.
+ * @msg_msg_free_security:
+ * Deallocate the security structure for this message.
+ * @msg contains the message structure to be modified.
+ *
+ *
+ * Security hooks for System V IPC Message Queues
+ *
+ * @msg_queue_alloc_security:
+ * Allocate and attach a security structure to the
+ * msq->q_perm.security field. The security field is initialized to
+ * NULL when the structure is first created.
+ * @msq contains the message queue structure to be modified.
+ * Return 0 if operation was successful and permission is granted.
+ * @msg_queue_free_security:
+ * Deallocate security structure for this message queue.
+ * @msq contains the message queue structure to be modified.
+ * @msg_queue_associate:
+ * Check permission when a message queue is requested through the
+ * msgget system call. This hook is only called when returning the
+ * message queue identifier for an existing message queue, not when a
+ * new message queue is created.
+ * @msq contains the message queue to act upon.
+ * @msqid contains the resource identifier.
+ * @msqflg contains the operation control flags.
+ * Return 0 if permission is granted.
+ * @msg_queue_msgctl:
+ * Check permission when a message control operation specified by @cmd
+ * is to be performed on the message queue @msq, with identifier
+ * @msqid.
+ * @msq contains the message queue to act upon.
+ * @msqid contains the resource identifier.
+ * @cmd contains the operation to be performed.
+ * Return 0 if permission is granted.
+ * @msg_queue_msgsnd:
+ * Check permission before a message, @msg, is enqueued on the message
+ * queue, @msq, whose identifier is specified by the value of @msqid.
+ * @msq contains the message queue to send message to.
+ * @msg contains the message to be enqueued.
+ * @msqid contains resource identifier.
+ * @msqflg contains operational flags.
+ * Return 0 if permission is granted.
+ * @msg_queue_msgrcv:
+ * Check permission before a message, @msg, is removed from the message
+ * queue, @msq, whose identifier is specified by the value of @msqid. The
+ * @target task structure contains a pointer to the process that will be
+ * receiving the message (not equal to the current process when inline
+ * receives are being performed).
+ * @msq contains the message queue to retrieve message from.
+ * @msg contains the message destination.
+ * @target contains the task structure for recipient process.
+ * @type contains the type of message requested.
+ * @mode contains the operational flags.
+ * Return 0 if permission is granted.
+ *
+ * Security hooks for System V Shared Memory Segments
+ *
+ * @shm_alloc_security:
+ * Allocate and attach a security structure to the shp->shm_perm.security
+ * field. The security field is initialized to NULL when the structure is
+ * first created.
+ * @shp contains the shared memory structure to be modified.
+ * Return 0 if operation was successful and permission is granted.
+ * @shm_free_security:
+ * Deallocate the security struct for this memory segment.
+ * @shp contains the shared memory structure to be modified.
+ * @shm_associate:
+ * Check permission when a shared memory region is requested through the
+ * shmget system call. This hook is only called when returning the shared
+ * memory region identifier for an existing region, not when a new shared
+ * memory region is created.
+ * @shp contains the shared memory structure to be modified.
+ * @shmid contains the resource identifier.
+ * @shmflg contains the operation control flags.
+ * Return 0 if permission is granted.
+ * @shm_shmctl:
+ * Check permission when a shared memory control operation specified by
+ * @cmd is to be performed on the shared memory region @shp, with
+ * identifier @shmid.
+ * @shp contains shared memory structure to be modified.
+ * @shmid contains the resource identifier.
+ * @cmd contains the operation to be performed.
+ * Return 0 if permission is granted.
+ * @shm_shmat:
+ * Check permissions prior to allowing the shmat system call to attach the
+ * shared memory segment @shp, identified by @shmid, to the data segment
+ * of the calling process. The attaching address is specified by @shmaddr.
+ * @shp contains the shared memory structure to be modified.
+ * @shmid contains the resource identifier.
+ * @shmaddr contains the address to attach memory region to.
+ * @shmflg contains the operational flags.
+ * Return 0 if permission is granted.
+ *
+ * Security hooks for System V Semaphores
+ *
+ * @sem_alloc_security:
+ * Allocate and attach a security structure to the sma->sem_perm.security
+ * field. The security field is initialized to NULL when the structure is
+ * first created.
+ * @sma contains the semaphore structure
+ * Return 0 if operation was successful and permission is granted.
+ * @sem_free_security:
+ * deallocate security struct for this semaphore
+ * @sma contains the semaphore structure.
+ * @sem_associate:
+ * Check permission when a semaphore is requested through the semget
+ * system call. This hook is only called when returning the semaphore
+ * identifier for an existing semaphore, not when a new one must be
+ * created.
+ * @sma contains the semaphore structure.
+ * @semid contains the resource identifier.
+ * @semflg contains the operation control flags.
+ * Return 0 if permission is granted.
+ * @sem_semctl:
+ * Check permission when a semaphore operation specified by @cmd is to be
+ * performed on the semaphore @sma, with identifier @semid.
+ * @sma contains the semaphore structure.
+ * @semid contains the resource identifier.
+ * @cmd contains the operation to be performed.
+ * Return 0 if permission is granted.
+ * @sem_semop
+ * Check permissions before performing operations on members of the
+ * semaphore set @sma, identified by @semid. If the @alter flag is
+ * nonzero, the semaphore set may be modified.
+ * @sma contains the semaphore structure.
+ * @semid contains the resource identifier.
+ * @sops contains the operations to perform.
+ * @nsops contains the number of operations to perform.
+ * @alter contains the flag indicating whether changes are to be made.
+ * Return 0 if permission is granted.
+ *
* @ptrace:
* Check permission before allowing the @parent process to trace the
* @child process.
@@ -786,6 +939,38 @@
void (*task_kmod_set_label) (void);
void (*task_reparent_to_init) (struct task_struct * p);
+ int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
+ int (*ipc_getinfo) (int id, int cmd);
+
+ int (*msg_msg_alloc_security) (struct msg_msg * msg);
+ void (*msg_msg_free_security) (struct msg_msg * msg);
+
+ int (*msg_queue_alloc_security) (struct msg_queue * msq);
+ void (*msg_queue_free_security) (struct msg_queue * msq);
+ int (*msg_queue_associate) (struct msg_queue * msq, int msqid,
+ int msqflg);
+ int (*msg_queue_msgctl) (struct msg_queue * msq, int msqid, int cmd);
+ int (*msg_queue_msgsnd) (struct msg_queue * msq,
+ struct msg_msg * msg, int msqid, int msqflg);
+ int (*msg_queue_msgrcv) (struct msg_queue * msq,
+ struct msg_msg * msg,
+ struct task_struct * target,
+ long type, int mode);
+
+ int (*shm_alloc_security) (struct shmid_kernel * shp);
+ void (*shm_free_security) (struct shmid_kernel * shp);
+ int (*shm_associate) (struct shmid_kernel * shp, int shmid, int shmflg);
+ int (*shm_shmctl) (struct shmid_kernel * shp, int shmid, int cmd);
+ int (*shm_shmat) (struct shmid_kernel * shp, int shmid,
+ char *shmaddr, int shmflg);
+
+ int (*sem_alloc_security) (struct sem_array * sma);
+ void (*sem_free_security) (struct sem_array * sma);
+ int (*sem_associate) (struct sem_array * sma, int semid, int semflg);
+ int (*sem_semctl) (struct sem_array * sma, int semid, int cmd);
+ int (*sem_semop) (struct sem_array * sma, int semid,
+ struct sembuf * sops, unsigned nsops, int alter);
+
/* allow module stacking */
int (*register_security) (const char *name,
struct security_operations *ops);
diff -X /home/sds/dontdiff -ru linux-2.5.38/ipc/msg.c lsm-ipc-2.5.38/ipc/msg.c
--- linux-2.5.38/ipc/msg.c Sun Sep 22 00:24:58 2002
+++ lsm-ipc-2.5.38/ipc/msg.c Tue Sep 24 11:32:00 2002
@@ -89,6 +89,7 @@
static int newque (key_t key, int msgflg)
{
int id;
+ int retval;
struct msg_queue *msq;
msq = (struct msg_queue *) kmalloc (sizeof (*msq), GFP_KERNEL);
@@ -98,8 +99,16 @@
msq->q_perm.mode = (msgflg & S_IRWXUGO);
msq->q_perm.key = key;
+ msq->q_perm.security = NULL;
+ retval = security_ops->msg_queue_alloc_security(msq);
+ if (retval) {
+ kfree(msq);
+ return retval;
+ }
+
id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
if(id == -1) {
+ security_ops->msg_queue_free_security(msq);
kfree(msq);
return -ENOSPC;
}
@@ -120,6 +129,9 @@
static void free_msg(struct msg_msg* msg)
{
struct msg_msgseg* seg;
+
+ security_ops->msg_msg_free_security(msg);
+
seg = msg->next;
kfree(msg);
while(seg != NULL) {
@@ -145,6 +157,7 @@
return ERR_PTR(-ENOMEM);
msg->next = NULL;
+ msg->security = NULL;
if (copy_from_user(msg+1, src, alen)) {
err = -EFAULT;
@@ -174,6 +187,11 @@
len -= alen;
src = ((char*)src)+alen;
}
+
+ err = security_ops->msg_msg_alloc_security(msg);
+ if (err)
+ goto out_err;
+
return msg;
out_err:
@@ -259,6 +277,8 @@
msq = msg_rmid(id);
+ security_ops->msg_queue_free_security(msq);
+
expunge_all(msq,-EIDRM);
ss_wakeup(&msq->q_senders,1);
msg_unlock(id);
@@ -295,8 +315,12 @@
BUG();
if (ipcperms(&msq->q_perm, msgflg))
ret = -EACCES;
- else
- ret = msg_buildid(id, msq->q_perm.seq);
+ else {
+ int qid = msg_buildid(id, msq->q_perm.seq);
+ ret = security_ops->msg_queue_associate(msq, qid, msgflg);
+ if (!ret)
+ ret = qid;
+ }
msg_unlock(id);
}
up(&msg_ids.sem);
@@ -418,6 +442,11 @@
* due to padding, it's not enough
* to set all member fields.
*/
+
+ err = security_ops->ipc_getinfo(msqid, cmd);
+ if (err)
+ return err;
+
memset(&msginfo,0,sizeof(msginfo));
msginfo.msgmni = msg_ctlmni;
msginfo.msgmax = msg_ctlmax;
@@ -468,6 +497,10 @@
if (ipcperms (&msq->q_perm, S_IRUGO))
goto out_unlock;
+ err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
+ if (err)
+ goto out_unlock;
+
kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
tbuf.msg_stime = msq->q_stime;
tbuf.msg_rtime = msq->q_rtime;
@@ -515,6 +548,11 @@
{
if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
goto out_unlock_up;
+
+ err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
+ if (err)
+ goto out_unlock_up;
+
msq->q_qbytes = setbuf.qbytes;
ipcp->uid = setbuf.uid;
@@ -534,6 +572,10 @@
break;
}
case IPC_RMID:
+ err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
+ if (err)
+ goto out_unlock_up;
+
freeque (msqid);
break;
}
@@ -580,7 +622,8 @@
struct msg_receiver* msr;
msr = list_entry(tmp,struct msg_receiver,r_list);
tmp = tmp->next;
- if(testmsg(msg,msr->r_msgtype,msr->r_mode)) {
+ if(testmsg(msg,msr->r_msgtype,msr->r_mode) &&
+ !security_ops->msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
list_del(&msr->r_list);
if(msr->r_maxsize < msg->m_ts) {
msr->r_msg = ERR_PTR(-E2BIG);
@@ -631,6 +674,10 @@
if (ipcperms(&msq->q_perm, S_IWUGO))
goto out_unlock_free;
+ err = security_ops->msg_queue_msgsnd(msq, msg, msqid, msgflg);
+ if (err)
+ goto out_unlock_free;
+
if(msgsz + msq->q_cbytes > msq->q_qbytes ||
1 + msq->q_qnum > msq->q_qbytes) {
struct msg_sender s;
@@ -729,7 +776,8 @@
found_msg=NULL;
while (tmp != &msq->q_messages) {
msg = list_entry(tmp,struct msg_msg,m_list);
- if(testmsg(msg,msgtyp,mode)) {
+ if(testmsg(msg,msgtyp,mode) &&
+ !security_ops->msg_queue_msgrcv(msq, msg, current, msgtyp, mode)) {
found_msg = msg;
if(mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
found_msg=msg;
@@ -747,6 +795,7 @@
err=-E2BIG;
goto out_unlock;
}
+
list_del(&msg->m_list);
msq->q_qnum--;
msq->q_rtime = CURRENT_TIME;
diff -X /home/sds/dontdiff -ru linux-2.5.38/ipc/sem.c lsm-ipc-2.5.38/ipc/sem.c
--- linux-2.5.38/ipc/sem.c Sun Sep 22 00:25:06 2002
+++ lsm-ipc-2.5.38/ipc/sem.c Tue Sep 24 11:32:00 2002
@@ -63,6 +63,7 @@
#include <linux/init.h>
#include <linux/proc_fs.h>
#include <linux/smp_lock.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include "util.h"
@@ -115,6 +116,7 @@
static int newary (key_t key, int nsems, int semflg)
{
int id;
+ int retval;
struct sem_array *sma;
int size;
@@ -133,8 +135,16 @@
sma->sem_perm.mode = (semflg & S_IRWXUGO);
sma->sem_perm.key = key;
+ sma->sem_perm.security = NULL;
+ retval = security_ops->sem_alloc_security(sma);
+ if (retval) {
+ ipc_free(sma, size);
+ return retval;
+ }
+
id = ipc_addid(&sem_ids, &sma->sem_perm, sc_semmni);
if(id == -1) {
+ security_ops->sem_free_security(sma);
ipc_free(sma, size);
return -ENOSPC;
}
@@ -177,8 +187,12 @@
err = -EINVAL;
else if (ipcperms(&sma->sem_perm, semflg))
err = -EACCES;
- else
- err = sem_buildid(id, sma->sem_perm.seq);
+ else {
+ int semid = sem_buildid(id, sma->sem_perm.seq);
+ err = security_ops->sem_associate(sma, semid, semflg);
+ if (!err)
+ err = semid;
+ }
sem_unlock(id);
}
@@ -399,6 +413,7 @@
int size;
sma = sem_rmid(id);
+ security_ops->sem_free_security(sma);
/* Invalidate the existing undo structures for this semaphore set.
* (They will be freed without any further action in sem_exit()
@@ -453,6 +468,10 @@
struct seminfo seminfo;
int max_id;
+ err = security_ops->ipc_getinfo(semid, cmd);
+ if (err)
+ return err;
+
memset(&seminfo,0,sizeof(seminfo));
seminfo.semmni = sc_semmni;
seminfo.semmns = sc_semmns;
@@ -494,6 +513,11 @@
err = -EACCES;
if (ipcperms (&sma->sem_perm, S_IRUGO))
goto out_unlock;
+
+ err = security_ops->sem_semctl(sma, semid, cmd);
+ if (err)
+ goto out_unlock;
+
id = sem_buildid(semid, sma->sem_perm.seq);
kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
@@ -537,6 +561,11 @@
if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
goto out_unlock;
+ err = security_ops->sem_semctl(sma, semid, cmd);
+ if (err)
+ goto out_unlock;
+
+ err = -EACCES;
switch (cmd) {
case GETALL:
{
@@ -728,6 +757,10 @@
goto out_unlock;
}
+ err = security_ops->sem_semctl(sma, semid, cmd);
+ if (err)
+ goto out_unlock;
+
switch(cmd){
case IPC_RMID:
freeary(semid);
@@ -1004,6 +1037,12 @@
error = -EACCES;
if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
goto out_unlock_semundo_free;
+
+ error = security_ops->sem_semop(sma, semid, sops, nsops, alter);
+ if (error)
+ goto out_unlock_semundo_free;
+ error = -EACCES;
+
if (undos) {
/* Make sure we have an undo structure
* for this process and this semaphore set.
diff -X /home/sds/dontdiff -ru linux-2.5.38/ipc/shm.c lsm-ipc-2.5.38/ipc/shm.c
--- linux-2.5.38/ipc/shm.c Sun Sep 22 00:25:10 2002
+++ lsm-ipc-2.5.38/ipc/shm.c Tue Sep 24 11:32:00 2002
@@ -24,6 +24,7 @@
#include <linux/mman.h>
#include <linux/proc_fs.h>
#include <linux/shmem_fs.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include "util.h"
@@ -113,6 +114,9 @@
shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
shm_rmid (shp->id);
shm_unlock(shp->id);
+
+ security_ops->shm_free_security(shp);
+
shmem_lock(shp->shm_file, 0);
fput (shp->shm_file);
kfree (shp);
@@ -185,6 +189,13 @@
shp->shm_perm.key = key;
shp->shm_flags = (shmflg & S_IRWXUGO);
+ shp->shm_perm.security = NULL;
+ error = security_ops->shm_alloc_security(shp);
+ if (error) {
+ kfree(shp);
+ return error;
+ }
+
sprintf (name, "SYSV%08x", key);
file = shmem_file_setup(name, size, VM_ACCOUNT);
error = PTR_ERR(file);
@@ -213,6 +224,7 @@
no_id:
fput(file);
no_file:
+ security_ops->shm_free_security(shp);
kfree(shp);
return error;
}
@@ -240,8 +252,12 @@
err = -EINVAL;
else if (ipcperms(&shp->shm_perm, shmflg))
err = -EACCES;
- else
- err = shm_buildid(id, shp->shm_perm.seq);
+ else {
+ int shmid = shm_buildid(id, shp->shm_perm.seq);
+ err = security_ops->shm_associate(shp, shmid, shmflg);
+ if (!err)
+ err = shmid;
+ }
shm_unlock(id);
}
up(&shm_ids.sem);
@@ -379,6 +395,10 @@
{
struct shminfo64 shminfo;
+ err = security_ops->ipc_getinfo(shmid, cmd);
+ if (err)
+ return err;
+
memset(&shminfo,0,sizeof(shminfo));
shminfo.shmmni = shminfo.shmseg = shm_ctlmni;
shminfo.shmmax = shm_ctlmax;
@@ -397,6 +417,10 @@
{
struct shm_info shm_info;
+ err = security_ops->ipc_getinfo(shmid, cmd);
+ if (err)
+ return err;
+
memset(&shm_info,0,sizeof(shm_info));
down(&shm_ids.sem);
shm_lockall();
@@ -422,6 +446,11 @@
shp = shm_lock(shmid);
if(shp==NULL)
return -EINVAL;
+
+ err = security_ops->shm_shmctl(shp, shmid, cmd);
+ if (err)
+ goto out_unlock;
+
if(cmd==SHM_STAT) {
err = -EINVAL;
if (shmid > shm_ids.max_id)
@@ -464,6 +493,11 @@
err = shm_checkid(shp,shmid);
if(err)
goto out_unlock;
+
+ err = security_ops->shm_shmctl(shp, shmid, cmd);
+ if (err)
+ goto out_unlock;
+
if(cmd==SHM_LOCK) {
shmem_lock(shp->shm_file, 1);
shp->shm_flags |= SHM_LOCKED;
@@ -494,6 +528,11 @@
err = shm_checkid(shp, shmid);
if(err)
goto out_unlock_up;
+
+ err = security_ops->shm_shmctl(shp, shmid, cmd);
+ if (err)
+ goto out_unlock_up;
+
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_SYS_ADMIN)) {
@@ -523,6 +562,11 @@
err = shm_checkid(shp,shmid);
if(err)
goto out_unlock_up;
+
+ err = security_ops->shm_shmctl(shp, shmid, cmd);
+ if (err)
+ goto out_unlock_up;
+
err=-EPERM;
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
@@ -613,6 +657,13 @@
shm_unlock(shmid);
return -EACCES;
}
+
+ err = security_ops->shm_shmat(shp, shmid, shmaddr, shmflg);
+ if (err) {
+ shm_unlock(shmid);
+ return err;
+ }
+
file = shp->shm_file;
size = file->f_dentry->d_inode->i_size;
shp->shm_nattch++;
diff -X /home/sds/dontdiff -ru linux-2.5.38/ipc/util.c lsm-ipc-2.5.38/ipc/util.c
--- linux-2.5.38/ipc/util.c Sun Sep 22 00:25:07 2002
+++ lsm-ipc-2.5.38/ipc/util.c Tue Sep 24 11:32:00 2002
@@ -19,6 +19,7 @@
#include <linux/vmalloc.h>
#include <linux/slab.h>
#include <linux/highuid.h>
+#include <linux/security.h>
#if defined(CONFIG_SYSVIPC)
@@ -263,7 +264,7 @@
!capable(CAP_IPC_OWNER))
return -1;
- return 0;
+ return security_ops->ipc_permission(ipcp, flag);
}
/*
diff -X /home/sds/dontdiff -ru linux-2.5.38/security/capability.c lsm-ipc-2.5.38/security/capability.c
--- linux-2.5.38/security/capability.c Sun Sep 22 00:25:06 2002
+++ lsm-ipc-2.5.38/security/capability.c Tue Sep 24 11:32:00 2002
@@ -679,6 +679,112 @@
return;
}
+static int cap_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
+{
+ return 0;
+}
+
+static int cap_ipc_getinfo (int id, int cmd)
+{
+ return 0;
+}
+
+static int cap_msg_msg_alloc_security (struct msg_msg *msg)
+{
+ return 0;
+}
+
+static void cap_msg_msg_free_security (struct msg_msg *msg)
+{
+ return;
+}
+
+static int cap_msg_queue_alloc_security (struct msg_queue *msq)
+{
+ return 0;
+}
+
+static void cap_msg_queue_free_security (struct msg_queue *msq)
+{
+ return;
+}
+
+static int cap_msg_queue_associate (struct msg_queue *msq, int msgid,
+ int msgflg)
+{
+ return 0;
+}
+
+static int cap_msg_queue_msgctl (struct msg_queue *msq, int msgid, int cmd)
+{
+ return 0;
+}
+
+static int cap_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
+ int msgid, int msgflg)
+{
+ return 0;
+}
+
+static int cap_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
+ struct task_struct *target, long type,
+ int mode)
+{
+ return 0;
+}
+
+static int cap_shm_alloc_security (struct shmid_kernel *shp)
+{
+ return 0;
+}
+
+static void cap_shm_free_security (struct shmid_kernel *shp)
+{
+ return;
+}
+
+static int cap_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
+{
+ return 0;
+}
+
+static int cap_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
+{
+ return 0;
+}
+
+static int cap_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
+ int shmflg)
+{
+ return 0;
+}
+
+static int cap_sem_alloc_security (struct sem_array *sma)
+{
+ return 0;
+}
+
+static void cap_sem_free_security (struct sem_array *sma)
+{
+ return;
+}
+
+static int cap_sem_associate (struct sem_array *sma, int semid, int semflg)
+{
+ return 0;
+}
+
+static int cap_sem_semctl (struct sem_array *sma, int semid, int cmd)
+{
+ return 0;
+}
+
+static int cap_sem_semop (struct sem_array *sma, int semid, struct sembuf *sops,
+ unsigned nsops, int alter)
+{
+ return 0;
+}
+
static int cap_register (const char *name, struct security_operations *ops)
{
return -EINVAL;
@@ -782,6 +888,31 @@
.task_kmod_set_label = cap_task_kmod_set_label,
.task_reparent_to_init = cap_task_reparent_to_init,
+ .ipc_permission = cap_ipc_permission,
+ .ipc_getinfo = cap_ipc_getinfo,
+
+ .msg_msg_alloc_security = cap_msg_msg_alloc_security,
+ .msg_msg_free_security = cap_msg_msg_free_security,
+
+ .msg_queue_alloc_security = cap_msg_queue_alloc_security,
+ .msg_queue_free_security = cap_msg_queue_free_security,
+ .msg_queue_associate = cap_msg_queue_associate,
+ .msg_queue_msgctl = cap_msg_queue_msgctl,
+ .msg_queue_msgsnd = cap_msg_queue_msgsnd,
+ .msg_queue_msgrcv = cap_msg_queue_msgrcv,
+
+ .shm_alloc_security = cap_shm_alloc_security,
+ .shm_free_security = cap_shm_free_security,
+ .shm_associate = cap_shm_associate,
+ .shm_shmctl = cap_shm_shmctl,
+ .shm_shmat = cap_shm_shmat,
+
+ .sem_alloc_security = cap_sem_alloc_security,
+ .sem_free_security = cap_sem_free_security,
+ .sem_associate = cap_sem_associate,
+ .sem_semctl = cap_sem_semctl,
+ .sem_semop = cap_sem_semop,
+
.register_security = cap_register,
.unregister_security = cap_unregister,
};
diff -X /home/sds/dontdiff -ru linux-2.5.38/security/dummy.c lsm-ipc-2.5.38/security/dummy.c
--- linux-2.5.38/security/dummy.c Sun Sep 22 00:25:03 2002
+++ lsm-ipc-2.5.38/security/dummy.c Tue Sep 24 11:32:00 2002
@@ -493,6 +493,112 @@
return;
}
+static int dummy_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
+{
+ return 0;
+}
+
+static int dummy_ipc_getinfo (int id, int cmd)
+{
+ return 0;
+}
+
+static int dummy_msg_msg_alloc_security (struct msg_msg *msg)
+{
+ return 0;
+}
+
+static void dummy_msg_msg_free_security (struct msg_msg *msg)
+{
+ return;
+}
+
+static int dummy_msg_queue_alloc_security (struct msg_queue *msq)
+{
+ return 0;
+}
+
+static void dummy_msg_queue_free_security (struct msg_queue *msq)
+{
+ return;
+}
+
+static int dummy_msg_queue_associate (struct msg_queue *msq, int msqid,
+ int msqflg)
+{
+ return 0;
+}
+
+static int dummy_msg_queue_msgctl (struct msg_queue *msq, int msqid, int cmd)
+{
+ return 0;
+}
+
+static int dummy_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
+ int msqid, int msgflg)
+{
+ return 0;
+}
+
+static int dummy_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
+ struct task_struct *target, long type,
+ int mode)
+{
+ return 0;
+}
+
+static int dummy_shm_alloc_security (struct shmid_kernel *shp)
+{
+ return 0;
+}
+
+static void dummy_shm_free_security (struct shmid_kernel *shp)
+{
+ return;
+}
+
+static int dummy_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
+{
+ return 0;
+}
+
+static int dummy_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
+{
+ return 0;
+}
+
+static int dummy_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
+ int shmflg)
+{
+ return 0;
+}
+
+static int dummy_sem_alloc_security (struct sem_array *sma)
+{
+ return 0;
+}
+
+static void dummy_sem_free_security (struct sem_array *sma)
+{
+ return;
+}
+
+static int dummy_sem_associate (struct sem_array *sma, int semid, int semflg)
+{
+ return 0;
+}
+
+static int dummy_sem_semctl (struct sem_array *sma, int semid, int cmd)
+{
+ return 0;
+}
+
+static int dummy_sem_semop (struct sem_array *sma, int semid,
+ struct sembuf *sops, unsigned nsops, int alter)
+{
+ return 0;
+}
+
static int dummy_register (const char *name, struct security_operations *ops)
{
return -EINVAL;
@@ -596,6 +702,31 @@
.task_kmod_set_label = dummy_task_kmod_set_label,
.task_reparent_to_init = dummy_task_reparent_to_init,
+ .ipc_permission = dummy_ipc_permission,
+ .ipc_getinfo = dummy_ipc_getinfo,
+
+ .msg_msg_alloc_security = dummy_msg_msg_alloc_security,
+ .msg_msg_free_security = dummy_msg_msg_free_security,
+
+ .msg_queue_alloc_security = dummy_msg_queue_alloc_security,
+ .msg_queue_free_security = dummy_msg_queue_free_security,
+ .msg_queue_associate = dummy_msg_queue_associate,
+ .msg_queue_msgctl = dummy_msg_queue_msgctl,
+ .msg_queue_msgsnd = dummy_msg_queue_msgsnd,
+ .msg_queue_msgrcv = dummy_msg_queue_msgrcv,
+
+ .shm_alloc_security = dummy_shm_alloc_security,
+ .shm_free_security = dummy_shm_free_security,
+ .shm_associate = dummy_shm_associate,
+ .shm_shmctl = dummy_shm_shmctl,
+ .shm_shmat = dummy_shm_shmat,
+
+ .sem_alloc_security = dummy_sem_alloc_security,
+ .sem_free_security = dummy_sem_free_security,
+ .sem_associate = dummy_sem_associate,
+ .sem_semctl = dummy_sem_semctl,
+ .sem_semop = dummy_sem_semop,
+
.register_security = dummy_register,
.unregister_security = dummy_unregister,
};
_______________________________________________
linux-security-module mailing list
linux-security-module@wirex.com
http://mail.wirex.com/mailman/listinfo/linux-security-module
|
|||||||||||||