Custom LSM: getting a null pointer dereference when trying to access a task security blob

[Casey Schaufler]

On 1/24/2022 1:56 AM, Denis Obrezkov wrote:
> It seems I didn't implement cred_prepare and it was crucial.

Smack uses a global list for a number of reasons, one of
which is that you need to hang the rules off of something.
Also, lifetime management of the data can be tricky. Finally,
if every instance of the label "IAmALabel" is stored in the
same place you never have to do a strcmp() to determine if
two labels match.

I'm curious about the value provided by KeyLock.

>
> On 23.01.22 20:58, Denibs Obrezkov wrote:
>
>> I have two hypotheses. First is that my keylock_known_system is not
>> visible to other tasks (though it is initialized in a global scope of my
>> .c file). Second is that I didn't implement some crucial hooks and a new
>> task is created without a label. I have implemented those hooks:
>>
>>
>> static struct security_hook_list keylock_hooks[] __lsm_ro_after_init = {
>>          LSM_HOOK_INIT(inode_alloc_security, keylock_inode_alloc_security),
>>          LSM_HOOK_INIT(inode_init_security, keylock_inode_init_security),
>>          LSM_HOOK_INIT(task_to_inode, keylock_task_to_inode),
>>          LSM_HOOK_INIT(cred_transfer, keylock_cred_transfer),
>>          LSM_HOOK_INIT(cred_alloc_blank, keylock_cred_alloc_blank),
>>
>> };
>>
>>
>> And I initialized my KeyLock LSM in a way similar to that of SMACK.
>>
>> --
>> Regards, Denis Obrezkov