Custom LSM: getting a null pointer dereference when trying to access a task security blob
Denis Obrezkov
denisobrezkov at gmail.com
Sun Jan 23 19:58:48 UTC 2022
>
> There's nowhere near enough information here to identify what's
> going wrong here. Is the KeyLock code otherwise a copy of Smack?
> Have you registered KeyLock correctly with the infrastructure?
>
Yes, right now the only difference is that I don't have a single
repository for all labels. For each task/inode I store only a pointer to
a head of a list of its own labels. I want to store pointers in
creds->security and inode->i_security. So, basically each subject will
have its own repository of (its) labels.
Right now, I have only one security context which is defined in my .c file:
struct keylock_known keylock_known_system = {
.label = "system\n",
.kl_mask = 7,
};
First tasks receive the pointer to this structure and I can see that the
pointer value for them is non-zero. But later I can see that other tasks
in keylock_inode_alloc_security have zero pointers,
I have two hypotheses. First is that my keylock_known_system is not
visible to other tasks (though it is initialized in a global scope of my
.c file). Second is that I didn't implement some crucial hooks and a new
task is created without a label. I have implemented those hooks:
static struct security_hook_list keylock_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(inode_alloc_security, keylock_inode_alloc_security),
LSM_HOOK_INIT(inode_init_security, keylock_inode_init_security),
LSM_HOOK_INIT(task_to_inode, keylock_task_to_inode),
LSM_HOOK_INIT(cred_transfer, keylock_cred_transfer),
LSM_HOOK_INIT(cred_alloc_blank, keylock_cred_alloc_blank),
};
And I initialized my KeyLock LSM in a way similar to that of SMACK.
--
Regards, Denis Obrezkov
More information about the Linux-security-module-archive
mailing list