• D
    CRED: Allow kernel services to override LSM settings for task actions · 3a3b7ce9
    David Howells 提交于
    Allow kernel services to override LSM settings appropriate to the actions
    performed by a task by duplicating a set of credentials, modifying it and then
    using task_struct::cred to point to it when performing operations on behalf of
    a task.
    
    This is used, for example, by CacheFiles which has to transparently access the
    cache on behalf of a process that thinks it is doing, say, NFS accesses with a
    potentially inappropriate (with respect to accessing the cache) set of
    credentials.
    
    This patch provides two LSM hooks for modifying a task security record:
    
     (*) security_kernel_act_as() which allows modification of the security datum
         with which a task acts on other objects (most notably files).
    
     (*) security_kernel_create_files_as() which allows modification of the
         security datum that is used to initialise the security data on a file that
         a task creates.
    
    The patch also provides four new credentials handling functions, which wrap the
    LSM functions:
    
     (1) prepare_kernel_cred()
    
         Prepare a set of credentials for a kernel service to use, based either on
         a daemon's credentials or on init_cred.  All the keyrings are cleared.
    
     (2) set_security_override()
    
         Set the LSM security ID in a set of credentials to a specific security
         context, assuming permission from the LSM policy.
    
     (3) set_security_override_from_ctx()
    
         As (2), but takes the security context as a string.
    
     (4) set_create_files_as()
    
         Set the file creation LSM security ID in a set of credentials to be the
         same as that on a particular inode.
    
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [Smack changes]
    Signed-off-by: NDavid Howells <dhowells@redhat.com>
    Signed-off-by: NJames Morris <jmorris@namei.org>
    3a3b7ce9
cred.c 14.3 KB