A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

selinux lsm IB/core: Implement LSM notification system

Browse source 
Add a generic notificaiton mechanism in the LSM. Interested consumers
can register a callback with the LSM and security modules can produce
events.

Because access to Infiniband QPs are enforced in the setup phase of a
connection security should be enforced again if the policy changes.
Register infiniband devices for policy change notification and check all
QPs on that device when the notification is received.

Add a call to the notification mechanism from SELinux when the AVC
cache changes or setenforce is cleared.

Signed-off-by: Daniel Jurgens <[email protected]>
Acked-by: James Morris <[email protected]>
Acked-by: Doug Ledford <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
This commit is contained in:
Daniel Jurgens 2017-05-19 15:48:53 +03:00 • committed by Paul Moore
commit 8f408ab64b
5 changed files with 109 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
security/selinux/hooks.c
View file

@ -171,6 +171,14 @@ static int selinux_netcache_avc_callback(u32 event)
return 0;
}
static int selinux_lsm_notifier_avc_callback(u32 event)
{
if (event == AVC_CALLBACK_RESET)
call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
return 0;
}
/*
* initialise the security for the init task
*/
@ -6387,6 +6395,9 @@ static __init int selinux_init(void)
if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
panic("SELinux: Unable to register AVC netcache callback\n");
if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
panic("SELinux: Unable to register AVC LSM notifier callback\n");
if (selinux_enforcing)
printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
else

2
security/selinux/selinuxfs.c
View file

@ -154,6 +154,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
avc_ss_reset(0);
selnl_notify_setenforce(selinux_enforcing);
selinux_status_update_setenforce(selinux_enforcing);
if (!selinux_enforcing)
call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
}
length = count;
out: