dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

security: create task_free security callback 

The current LSM interface to cred_free is not sufficient for allowing
an LSM to track the life and death of a task. This patch adds the
task_free hook so that an LSM can clean up resources on task death.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Kees Cook 2011-12-21 12:17:03 -08:00 committed by James Morris
parent 9e3ff38647
commit 1a2a4d06e1
4 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
include/linux/security.h
View File

@ -651,6 +651,10 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* manual page for definitions of the @clone_flags.
* @clone_flags contains the flags indicating what should be shared.
* Return 0 if permission is granted.
* @task_free:
* @task task being freed
* Handle release of task-related resources. (Note that this can be called
* from interrupt context.)
* @cred_alloc_blank:
* @cred points to the credentials.
* @gfp indicates the atomicity of any memory allocations.
@ -1493,6 +1497,7 @@ struct security_operations {
int (*dentry_open) (struct file *file, const struct cred *cred);
int (*task_create) (unsigned long clone_flags);
void (*task_free) (struct task_struct *task);
int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp);
void (*cred_free) (struct cred *cred);
int (*cred_prepare)(struct cred *new, const struct cred *old,
@ -1752,6 +1757,7 @@ int security_file_send_sigiotask(struct task_struct *tsk,
int security_file_receive(struct file *file);
int security_dentry_open(struct file *file, const struct cred *cred);
int security_task_create(unsigned long clone_flags);
void security_task_free(struct task_struct *task);
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
void security_cred_free(struct cred *cred);
int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
@ -2245,6 +2251,9 @@ static inline int security_task_create(unsigned long clone_flags)
return 0;
}
static inline void security_task_free(struct task_struct *task)
{ }
static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{
return 0;

1
kernel/fork.c
View File

@ -192,6 +192,7 @@ void __put_task_struct(struct task_struct *tsk)
WARN_ON(atomic_read(&tsk->usage));
WARN_ON(tsk == current);
security_task_free(tsk);
exit_creds(tsk);
delayacct_tsk_free(tsk);
put_signal_struct(tsk->signal);

5
security/capability.c
View File

@ -358,6 +358,10 @@ static int cap_task_create(unsigned long clone_flags)
return 0;
}
static void cap_task_free(struct task_struct *task)
{
}
static int cap_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{
return 0;
@ -954,6 +958,7 @@ void __init security_fixup_ops(struct security_operations *ops)
set_to_cap_if_null(ops, file_receive);
set_to_cap_if_null(ops, dentry_open);
set_to_cap_if_null(ops, task_create);
set_to_cap_if_null(ops, task_free);
set_to_cap_if_null(ops, cred_alloc_blank);
set_to_cap_if_null(ops, cred_free);
set_to_cap_if_null(ops, cred_prepare);

5
security/security.c
View File

@ -729,6 +729,11 @@ int security_task_create(unsigned long clone_flags)
return security_ops->task_create(clone_flags);
}
void security_task_free(struct task_struct *task)
{
security_ops->task_free(task);
}
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{
return security_ops->cred_alloc_blank(cred, gfp);