CHROMIUM: kernel: Initial chromiumos security module.

Initially the chromiumos security module only prevents symlinks
in mount paths. Future versions will be more restrictive and
will be configurable using a driver interface.

BUG=chromium-os:21954
TEST=Use a mount path with a symlink and observe mount failure.

Change-Id: I47ade3b7be684ab9e0533ce5ffd1e81009eaebfe
Signed-off-by: Stephan Uphoff <ups@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/10581
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Mandeep Singh Baines <msb@chromium.org>
[3.4 kernel: added include linux/sched.h --grundler]

diff --git a/security/Kconfig b/security/Kconfig
index ccc61f8..a42bb65 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -188,6 +188,7 @@ source security/smack/Kconfig
 source security/tomoyo/Kconfig
 source security/apparmor/Kconfig
 source security/yama/Kconfig
+source security/chromiumos/Kconfig
 
 source security/integrity/Kconfig
 
@@ -198,6 +199,7 @@ choice
        default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
        default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
        default DEFAULT_SECURITY_YAMA if SECURITY_YAMA
+       default DEFAULT_SECURITY_CHROMIUMOS if SECURITY_CHROMIUMOS
        default DEFAULT_SECURITY_DAC
 
        help
@@ -219,6 +221,9 @@ choice
        config DEFAULT_SECURITY_YAMA
                bool "Yama" if SECURITY_YAMA=y
 
+       config DEFAULT_SECURITY_CHROMIUMOS
+               bool "Chromium OS" if SECURITY_CHROMIUMOS=y
+
        config DEFAULT_SECURITY_DAC
                bool "Unix Discretionary Access Controls"
 
@@ -231,6 +236,7 @@ config DEFAULT_SECURITY
        default "tomoyo" if DEFAULT_SECURITY_TOMOYO
        default "apparmor" if DEFAULT_SECURITY_APPARMOR
        default "yama" if DEFAULT_SECURITY_YAMA
+       default "chromiumos" if DEFAULT_SECURITY_CHROMIUMOS
        default "" if DEFAULT_SECURITY_DAC
 
 endmenu

diff --git a/security/Makefile b/security/Makefile
index c26c81e..359424a 100644 (file)
--- a/security/Makefile
+++ b/security/Makefile
@@ -8,6 +8,7 @@ subdir-$(CONFIG_SECURITY_SMACK)         += smack
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
 subdir-$(CONFIG_SECURITY_APPARMOR)     += apparmor
 subdir-$(CONFIG_SECURITY_YAMA)         += yama
+subdir-$(CONFIG_SECURITY_CHROMIUMOS)   += chromiumos
 
 # always enable default capabilities
 obj-y                                  += commoncap.o
@@ -23,6 +24,7 @@ obj-$(CONFIG_AUDIT)                   += lsm_audit.o
 obj-$(CONFIG_SECURITY_TOMOYO)          += tomoyo/built-in.o
 obj-$(CONFIG_SECURITY_APPARMOR)                += apparmor/built-in.o
 obj-$(CONFIG_SECURITY_YAMA)            += yama/built-in.o
+obj-$(CONFIG_SECURITY_CHROMIUMOS)      += chromiumos/built-in.o
 obj-$(CONFIG_CGROUP_DEVICE)            += device_cgroup.o
 
 # Object integrity file lists

diff --git a/security/chromiumos/Kconfig b/security/chromiumos/Kconfig
new file mode 100644 (file)
index 0000000..58bf508
--- /dev/null
+++ b/security/chromiumos/Kconfig
@@ -0,0 +1,10 @@
+config SECURITY_CHROMIUMOS
+       tristate "Chromium OS Security Module"
+       depends on SECURITY
+       help
+         The purpose of the Chromium OS security module is to reduce attacking
+         surface by preventing access to general purpose access modes not required
+         by Chromium OS.
+         Currently only the mount operation is restricted by requiring a mount point
+         path without symbolic links.
+

diff --git a/security/chromiumos/Makefile b/security/chromiumos/Makefile
new file mode 100644 (file)
index 0000000..7f441bd
--- /dev/null
+++ b/security/chromiumos/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SECURITY_CHROMIUMOS) += lsm.o

diff --git a/security/chromiumos/lsm.c b/security/chromiumos/lsm.c
new file mode 100644 (file)
index 0000000..202d906
--- /dev/null
+++ b/security/chromiumos/lsm.c
@@ -0,0 +1,55 @@
+/*
+ * Linux Security Module for Chromium OS
+ *
+ * Copyright 2011 Google Inc. All Rights Reserved
+ *
+ * Author:
+ *      Stephan Uphoff  <ups@google.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/security.h>
+#include <linux/sched.h>       /* current and other task related stuff */
+
+static int chromiumos_security_sb_mount(char *dev_name, struct path *path,
+                        char *type, unsigned long flags, void *data)
+{
+       int error = current->total_link_count ? -ELOOP : 0;
+
+       if (error) {
+               char name[sizeof(current->comm)];
+               printk(KERN_NOTICE "Chromium OS LSM: Mount path with symlinks"
+                       " prohibited - Task %s (pid = %d)\n",
+                       get_task_comm(name, current), task_pid_nr(current));
+       }
+
+       return error;
+}
+
+static struct security_operations chromiumos_security_ops = {
+       .name   = "chromiumos",
+       .sb_mount = chromiumos_security_sb_mount,
+};
+
+
+static int __init chromiumos_security_init(void)
+{
+       int error;
+
+       error = register_security(&chromiumos_security_ops);
+
+       if (error)
+               panic("Could not register chromiumos security module");
+
+       return error;
+}
+security_initcall(chromiumos_security_init);