blob: 79dc0610443b9b95a4f0d942eab48520a99a2fc1 [file] [log] [blame]
From 67699fea892540b8bdce95ae22ae43c94b684d29 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Date: Wed, 20 Jun 2012 14:29:14 +0200
Subject: [PATCH 04/15] security: Add Linux Security Modules hook for AF_BUS
sockets
AF_BUS implements a security hook bus_connect() to be used by LSM
to enforce connectivity security policies.
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
include/linux/security.h | 11 +++++++++++
security/capability.c | 7 +++++++
security/security.c | 7 +++++++
3 files changed, 25 insertions(+), 0 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 673afbb..fa26c6d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1578,6 +1578,8 @@ struct security_operations {
#ifdef CONFIG_SECURITY_NETWORK
int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
+ int (*bus_connect) (struct sock *sock, struct sock *other,
+ struct sock *newsk);
int (*unix_may_send) (struct socket *sock, struct socket *other);
int (*socket_create) (int family, int type, int protocol, int kern);
@@ -2517,6 +2519,8 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32
#ifdef CONFIG_SECURITY_NETWORK
int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
+int security_bus_connect(struct sock *sock, struct sock *other,
+ struct sock *newsk);
int security_unix_may_send(struct socket *sock, struct socket *other);
int security_socket_create(int family, int type, int protocol, int kern);
int security_socket_post_create(struct socket *sock, int family,
@@ -2564,6 +2568,13 @@ static inline int security_unix_stream_connect(struct sock *sock,
return 0;
}
+static inline int security_bus_connect(struct socket *sock,
+ struct sock *other,
+ struct sock *newsk)
+{
+ return 0;
+}
+
static inline int security_unix_may_send(struct socket *sock,
struct socket *other)
{
diff --git a/security/capability.c b/security/capability.c
index 5bb21b1..5b966a6 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -563,6 +563,12 @@ static int cap_unix_may_send(struct socket *sock, struct socket *other)
return 0;
}
+static int cap_bus_connect(struct sock *sock, struct sock *other,
+ struct sock *newsk)
+{
+ return 0;
+}
+
static int cap_socket_create(int family, int type, int protocol, int kern)
{
return 0;
@@ -1015,6 +1021,7 @@ void __init security_fixup_ops(struct security_operations *ops)
#ifdef CONFIG_SECURITY_NETWORK
set_to_cap_if_null(ops, unix_stream_connect);
set_to_cap_if_null(ops, unix_may_send);
+ set_to_cap_if_null(ops, bus_connect);
set_to_cap_if_null(ops, socket_create);
set_to_cap_if_null(ops, socket_post_create);
set_to_cap_if_null(ops, socket_bind);
diff --git a/security/security.c b/security/security.c
index bf619ff..54582ea 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1018,6 +1018,13 @@ int security_unix_may_send(struct socket *sock, struct socket *other)
}
EXPORT_SYMBOL(security_unix_may_send);
+int security_bus_connect(struct sock *sock, struct sock *other,
+ struct sock *newsk)
+{
+ return security_ops->bus_connect(sock, other, newsk);
+}
+EXPORT_SYMBOL(security_bus_connect);
+
int security_socket_create(int family, int type, int protocol, int kern)
{
return security_ops->socket_create(family, type, protocol, kern);
--
1.7.7.6