[PATCH] sns: add syscall to check signed state of a process [4/4]

[PATCH] sns: add syscall to check signed state of a process [4/4]

[Alexander Wuerstlein]

Makes it possible for a userspace process to ask for the trustworthiness of
another process.

Signed-off-by: Johannes Schlumberger <spjsschl@cip.informatik.uni-erlangen.de>
---
 arch/i386/kernel/syscall_table.S |    1 +
 include/asm-i386/unistd.h        |    3 ++-
 security/sns.c                   |   15 +++++++++++++++
 3 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index bf6adce..e8ba35a 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -323,3 +323,4 @@ ENTRY(sys_call_table)
 	.long sys_signalfd
 	.long sys_timerfd
 	.long sys_eventfd
+	.long sys_sns_is_trusted	/* 320 */
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index e84ace1..3f8df3e 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -329,10 +329,11 @@
 #define __NR_signalfd		321
 #define __NR_timerfd		322
 #define __NR_eventfd		323
+#define __NR_sns_is_trusted	324
 
 #ifdef __KERNEL__
 
-#define NR_syscalls 324
+#define NR_syscalls 325
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/security/sns.c b/security/sns.c
index 3192a90..1978f7c 100644
--- a/security/sns.c
+++ b/security/sns.c
@@ -112,3 +112,18 @@ int sns_signature_valid(struct file *file)
 	crypto_free_hash(tfm);
 	return ret;
 }
+
+asmlinkage int sys_sns_is_trusted(pid_t p)
+{
+	struct task_struct *t;
+	rcu_read_lock();
+	t = find_task_by_pid(p);
+	if (IS_ERR(t)) {
+		rcu_read_unlock();
+		return -EINVAL;
+	}
+	p = t->sns_valid_sig; /*locking needed*/
+	rcu_read_unlock();
+	return p;
+}
+EXPORT_SYMBOL_GPL(sys_sns_is_trusted);
-- 
1.5.2.1

Re: [PATCH] sns: add syscall to check signed state of a process [4/4]

[Akinobu Mita]

2007/6/22, Alexander Wuerstlein <arw@arw.name>:

> +asmlinkage int sys_sns_is_trusted(pid_t p)
> +{
> +       struct task_struct *t;
> +       rcu_read_lock();
> +       t = find_task_by_pid(p);
> +       if (IS_ERR(t)) {

Shouldn't it be:
if (!t) {
        ...
?

find_task_by_pid() returns NULL on failure.

> +               rcu_read_unlock();
> +               return -EINVAL;
> +       }
> +       p = t->sns_valid_sig; /*locking needed*/
> +       rcu_read_unlock();
> +       return p;
> +}

Re: [PATCH] sns: add syscall to check signed state of a process [4/4]

[Alexander Wuerstlein]

On 070621 18:34, Akinobu Mita <akinobu.mita@gmail.com> wrote:
> 2007/6/22, Alexander Wuerstlein <arw@arw.name>:
>
>> +asmlinkage int sys_sns_is_trusted(pid_t p)
>> +{
>> +       struct task_struct *t;
>> +       rcu_read_lock();
>> +       t = find_task_by_pid(p);
>> +       if (IS_ERR(t)) {
>
> Shouldn't it be:
> if (!t) {
>        ...
> ?
>
> find_task_by_pid() returns NULL on failure.

You seem to be right, the rest of the kernel just does 'if (!t)'. We just used
IS_ERR() as the 'check for evil pointers' function.




Ciao,

Alexander Wuerstlein.

Re: [PATCH] sns: add syscall to check signed state of a process [4/4]

[Jan Engelhardt]

On Jun 21 2007 18:49, Alexander Wuerstlein wrote:
>
>You seem to be right, the rest of the kernel just does 'if (!t)'. We just used
>IS_ERR() as the 'check for evil pointers' function.

But NULL is not covered by IS_ERR.


	Jan
-- 

[PATCH] signed binaries support [0/4]

[Johannes Schlumberger]

Hi,

We (two students of CS) built a system for signing binaries and verifying them
before executing. Our main focus was to implement a way to inhibit execution
of suid-binaries, which are not trustworthy (i.e. not signed). Of course this
can also be used to grant other access rights, capabilities, etc.

The signature (e.g. HMAC-SHA1 with a shared secret) is stored in extended
filesystem attributes (userland-signing-tool provided) [1]. Depending on the
outcome of our check (performed during exec) a newly introduced flag in
the task_struct is set. To be able to also check libraries, we introduced a
similar flag in the vm_area struct. Depending on the state of the flag, the
suid/sgid bit on the file is honored or ignored. If a process behaves badly
(e.g mapping executable memory writable or loading an untrusted library) it
is handled appropriately (killed in our current implementation).

In the current state our code is of course very expermimental and should be
handled with care.

We mainly seek comments, suggestions and wisdom before we tackle the more
difficult tasks, like proper signatures (public-key-systems, etc.).

regards,
	Johannes

[1] http://git.informatik.uni-erlangen.de/?p=ssuid-userland&a=snapshot;h=HEAD

-- 
Johannes Schlumberger                      Department of Computer Science IV
Martensstrasse 1  D-91058 Erlangen Germany  University of Erlangen-Nuremberg
             http://wwwcip.informatik.uni-erlangen.de/~spjsschl

[PATCH] sns: add syscall to check signed state of a process [4/4]

[Alexander Wuerstlein]

Makes it possible for a userspace process to ask for the trustworthiness of
another process.

Signed-off-by: Johannes Schlumberger <spjsschl@cip.informatik.uni-erlangen.de>
---
 arch/i386/kernel/syscall_table.S |    1 +
 include/asm-i386/unistd.h        |    3 ++-
 security/sns.c                   |   15 +++++++++++++++
 3 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index bf6adce..e8ba35a 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -323,3 +323,4 @@ ENTRY(sys_call_table)
 	.long sys_signalfd
 	.long sys_timerfd
 	.long sys_eventfd
+	.long sys_sns_is_trusted	/* 320 */
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index e84ace1..3f8df3e 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -329,10 +329,11 @@
 #define __NR_signalfd		321
 #define __NR_timerfd		322
 #define __NR_eventfd		323
+#define __NR_sns_is_trusted	324
 
 #ifdef __KERNEL__
 
-#define NR_syscalls 324
+#define NR_syscalls 325
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/security/sns.c b/security/sns.c
index 3192a90..1978f7c 100644
--- a/security/sns.c
+++ b/security/sns.c
@@ -112,3 +112,18 @@ int sns_signature_valid(struct file *file)
 	crypto_free_hash(tfm);
 	return ret;
 }
+
+asmlinkage int sys_sns_is_trusted(pid_t p)
+{
+	struct task_struct *t;
+	rcu_read_lock();
+	t = find_task_by_pid(p);
+	if (IS_ERR(t)) {
+		rcu_read_unlock();
+		return -EINVAL;
+	}
+	p = t->sns_valid_sig; /*locking needed*/
+	rcu_read_unlock();
+	return p;
+}
+EXPORT_SYMBOL_GPL(sys_sns_is_trusted);
-- 
1.5.2.1