Wrap new lsm_get_self_attr and lsm_set_self_attr syscalls

Create a system call lsm_get_self_attr() to provide the security
module maintained attributes of the current process.
Create a system call lsm_set_self_attr() to set a security
module maintained attribute of the current process.
Historically these attributes have been exposed to user space via
entries in procfs under /proc/self/attr.

Declare lsm_get_self_attr and lsm_set_self_attr wrappers in
priv_syswrap-linux.h and hook it for {amd64,arm,arm64,mips64,\
ppc32,ppc64,riscv64,s390x,x86}-linux.

https://bugs.kde.org/show_bug.cgi?id=510563

diff --git a/coregrind/m_syswrap/priv_syswrap-linux.h b/coregrind/m_syswrap/priv_syswrap-linux.h
index ca462e896f7b88d0e1501945add63d7d2ce39cac..ead4928d4e7c1274e55d06f357a25c4bff183d1e 100644 (file)
--- a/coregrind/m_syswrap/priv_syswrap-linux.h
+++ b/coregrind/m_syswrap/priv_syswrap-linux.h
@@ -372,6 +372,8 @@ DECL_TEMPLATE(linux, sys_statmount);
 
 // Since Linux 6.10
 DECL_TEMPLATE(linux, sys_mseal);
+DECL_TEMPLATE(linux, sys_lsm_get_self_attr);
+DECL_TEMPLATE(linux, sys_lsm_set_self_attr);
 
 /* ---------------------------------------------------------------------
    Wrappers for sockets and ipc-ery.  These are split into standalone

diff --git a/coregrind/m_syswrap/syswrap-amd64-linux.c b/coregrind/m_syswrap/syswrap-amd64-linux.c
index 838bf5e84801938464bc250ac4fb0b866654e08a..0a2cbf1dd5d11a631ef5a46d1c27cc9e598b1017 100644 (file)
--- a/coregrind/m_syswrap/syswrap-amd64-linux.c
+++ b/coregrind/m_syswrap/syswrap-amd64-linux.c
@@ -909,6 +909,8 @@ static SyscallTableEntry syscall_table[] = {
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
    LINXY(__NR_statmount,         sys_statmount),         // 457
    LINXY(__NR_listmount,         sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_(__NR_mseal,             sys_mseal),             // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-arm-linux.c b/coregrind/m_syswrap/syswrap-arm-linux.c
index 1fda7ba8a029f3ed89406ad51a604c283165af30..8d339358081813a1d02566b87feff0f505519003 100644 (file)
--- a/coregrind/m_syswrap/syswrap-arm-linux.c
+++ b/coregrind/m_syswrap/syswrap-arm-linux.c
@@ -1081,6 +1081,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
    LINXY(__NR_statmount,         sys_statmount),         // 457
    LINXY(__NR_listmount,         sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_(__NR_mseal,             sys_mseal),             // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-arm64-linux.c b/coregrind/m_syswrap/syswrap-arm64-linux.c
index 175002e6ba8ec6c61f324d1a289eace8f8b15d16..693e9c17b2688b5a0a2d26f93f8355f8f6b4bd21 100644 (file)
--- a/coregrind/m_syswrap/syswrap-arm64-linux.c
+++ b/coregrind/m_syswrap/syswrap-arm64-linux.c
@@ -860,6 +860,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
    LINXY(__NR_statmount,         sys_statmount),         // 457
    LINXY(__NR_listmount,         sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_(__NR_mseal,             sys_mseal),             // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-linux.c b/coregrind/m_syswrap/syswrap-linux.c
index 1402c3d1f5f89f5ee31735feb66e5e75bd849272..28240c78eb59f36fa707bd98b0d9dca38fbc6b29 100644 (file)
--- a/coregrind/m_syswrap/syswrap-linux.c
+++ b/coregrind/m_syswrap/syswrap-linux.c
@@ -4482,6 +4482,43 @@ POST(sys_listmount)
    }
 }
 
+PRE(sys_lsm_get_self_attr)
+{
+   //  * sys_lsm_get_self_attr - Return current task's security module attributes
+   //  * @attr: which attribute to return
+   //  * @ctx: the user-space destination for the information, or NULL
+   //  * @size: pointer to the size of space available to receive the data
+   //  * @flags: special handling options. LSM_FLAG_SINGLE indicates that only
+   //  * attributes associated with the LSM identified in the passed @ctx be
+   //  * reported.
+   // SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
+   //                 ctx, u32 __user *, size, u32, flags)
+   PRINT("sys_lsm_get_self_attr (  %#" FMT_REGWORD "x, %#" FMT_REGWORD "x, %" FMT_REGWORD "u, %#" FMT_REGWORD "x)", ARG1, ARG2, ARG3, ARG4);
+   PRE_REG_READ4(long, "lsm_get_self_attr", unsigned int, attr, struct vki_lsm_ctx *, ctx, __vki_u32 *, size, __vki_u32, flags);
+   PRE_MEM_READ("lsm_get_self_attr(ctx)", ARG2, ARG3);
+}
+
+POST(sys_lsm_get_self_attr)
+{
+   if(ARG3 > 0)
+   {
+      POST_MEM_WRITE(ARG2, ARG3);
+   }
+}
+
+PRE(sys_lsm_set_self_attr)
+{
+   //  * sys_lsm_set_self_attr - Set current task's security module attribute
+   //  * @attr: which attribute to set
+   //  * @ctx: the LSM contexts
+   //  * @size: size of @ctx
+   //  * @flags: reserved for future use
+   // SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
+   //                 ctx, u32, size, u32, flags)
+   PRINT("sys_lsm_get_self_attr (  %#" FMT_REGWORD "x, %#" FMT_REGWORD "x, %" FMT_REGWORD "u, %#" FMT_REGWORD "x)", ARG1, ARG2, ARG3, ARG4);
+   PRE_REG_READ4(long, "lsm_set_self_attr", unsigned int, attr, struct vki_lsm_ctx *, ctx, __vki_u32 *, size, __vki_u32, flags);
+}
+
 PRE(sys_syncfs)
 {
    *flags |= SfMayBlock;

diff --git a/coregrind/m_syswrap/syswrap-mips32-linux.c b/coregrind/m_syswrap/syswrap-mips32-linux.c
index 4edfe8a703818b04cb6c3d6fdbe37be8be7af072..5c5dfa06495b48f3b6fe288f031b7badd8011842 100644 (file)
--- a/coregrind/m_syswrap/syswrap-mips32-linux.c
+++ b/coregrind/m_syswrap/syswrap-mips32-linux.c
@@ -1188,6 +1188,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINX_(__NR_fchmodat2,               sys_fchmodat2),               // 452
    LINXY(__NR_statmount,               sys_statmount),               // 457
    LINXY(__NR_listmount,               sys_listmount),               // 458
+   LINXY(__NR_lsm_get_self_attr,       sys_lsm_get_self_attr),       // 459
+   LINX_(__NR_lsm_set_self_attr,       sys_lsm_set_self_attr),       // 460
    LINX_(__NR_mseal,                   sys_mseal),                   // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-mips64-linux.c b/coregrind/m_syswrap/syswrap-mips64-linux.c
index 4fb6f060e360f17981ace189242bbb1573f5a4ff..280d46c8f628372ace48f21819a705281e0e8e2f 100644 (file)
--- a/coregrind/m_syswrap/syswrap-mips64-linux.c
+++ b/coregrind/m_syswrap/syswrap-mips64-linux.c
@@ -797,6 +797,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINXY (__NR_userfaultfd, sys_userfaultfd),
    LINXY (__NR_statmount, sys_statmount),
    LINXY (__NR_listmount, sys_listmount),
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr),
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr),
    LINX_ (__NR_mseal, sys_mseal),
    LINX_ (__NR_futex_waitv, sys_futex_waitv),
    LINX_ (__NR_quotactl_fd, sys_quotactl_fd),

diff --git a/coregrind/m_syswrap/syswrap-nanomips-linux.c b/coregrind/m_syswrap/syswrap-nanomips-linux.c
index f1a0b3c59376c0381adf29263306e0652360f49b..dca8e1fcf596b96d6cc838763956e01d3cd3b1ba 100644 (file)
--- a/coregrind/m_syswrap/syswrap-nanomips-linux.c
+++ b/coregrind/m_syswrap/syswrap-nanomips-linux.c
@@ -823,6 +823,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINX_ (__NR_fchmodat2,              sys_fchmodat2),
    LINXY (__NR_statmount,              sys_statmount),
    LINXY (__NR_listmount,              sys_listmount),
+   LINXY(__NR_lsm_get_self_attr,       sys_lsm_get_self_attr),
+   LINX_(__NR_lsm_set_self_attr,       sys_lsm_set_self_attr),
    LINX_ (__NR_mseal,                  sys_mseal),
    LINX_ (__NR_futex_waitv,            sys_futex_waitv),
 };

diff --git a/coregrind/m_syswrap/syswrap-ppc32-linux.c b/coregrind/m_syswrap/syswrap-ppc32-linux.c
index b1390f3aba83e724dde1dcdc7f63d3f2baa283d3..a1e9620a52e60b0828fc96eb896f2e9fd900d372 100644 (file)
--- a/coregrind/m_syswrap/syswrap-ppc32-linux.c
+++ b/coregrind/m_syswrap/syswrap-ppc32-linux.c
@@ -1087,6 +1087,8 @@ static SyscallTableEntry syscall_table[] = {
    LINX_ (__NR_fchmodat2,        sys_fchmodat2),         // 452
    LINXY (__NR_statmount,        sys_statmount),         // 457
    LINXY (__NR_listmount,        sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_ (__NR_mseal,            sys_mseal),             // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-ppc64-linux.c b/coregrind/m_syswrap/syswrap-ppc64-linux.c
index 4a08650846e9dccf996bb238b707990113263b35..15497b9a9e193a507a3db9e007c1552e460255d4 100644 (file)
--- a/coregrind/m_syswrap/syswrap-ppc64-linux.c
+++ b/coregrind/m_syswrap/syswrap-ppc64-linux.c
@@ -1065,6 +1065,8 @@ static SyscallTableEntry syscall_table[] = {
    LINX_ (__NR_fchmodat2,        sys_fchmodat2),         // 452
    LINXY (__NR_statmount,        sys_statmount),         // 457
    LINXY (__NR_listmount,        sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_ (__NR_mseal,            sys_mseal),             // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-riscv64-linux.c b/coregrind/m_syswrap/syswrap-riscv64-linux.c
index 5a1ea2553d799caf0af732bc8b5ccc7020cb0786..898129bffb023606b01644360b5581516ea196bb 100644 (file)
--- a/coregrind/m_syswrap/syswrap-riscv64-linux.c
+++ b/coregrind/m_syswrap/syswrap-riscv64-linux.c
@@ -608,6 +608,8 @@ static SyscallTableEntry syscall_main_table[] = {
    LINX_(__NR_fchmodat2, sys_fchmodat2),                           /* 452 */
    LINXY(__NR_statmount, sys_statmount),                           /* 457 */
    LINXY(__NR_listmount, sys_listmount),                           /* 458 */
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr),           /* 459 */
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr),           /* 460 */
    LINX_(__NR_mseal, sys_mseal),                                   /* 462 */
 };
 

diff --git a/coregrind/m_syswrap/syswrap-s390x-linux.c b/coregrind/m_syswrap/syswrap-s390x-linux.c
index acb4aefee87e49ba72f69e4531aa81912df31719..3ce13a65b7bf4cbeddba835722d6cd7d1c4b6973 100644 (file)
--- a/coregrind/m_syswrap/syswrap-s390x-linux.c
+++ b/coregrind/m_syswrap/syswrap-s390x-linux.c
@@ -900,6 +900,8 @@ static SyscallTableEntry syscall_table[] = {
    LINX_ (__NR_fchmodat2, sys_fchmodat2),                             // 452
    LINXY (__NR_statmount, sys_statmount),                             // 457
    LINXY (__NR_listmount, sys_listmount),                             // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr),              // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr),              // 460
    LINX_ (__NR_mseal, sys_mseal),                                     // 462
 };
 

diff --git a/coregrind/m_syswrap/syswrap-x86-linux.c b/coregrind/m_syswrap/syswrap-x86-linux.c
index f697a9e19d8ff951e480c7a591858ec0d8f6c442..2227b87cb5baef4e1b2cf09e63e2c609d93994b5 100644 (file)
--- a/coregrind/m_syswrap/syswrap-x86-linux.c
+++ b/coregrind/m_syswrap/syswrap-x86-linux.c
@@ -1682,6 +1682,8 @@ static SyscallTableEntry syscall_table[] = {
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
    LINXY(__NR_statmount,         sys_statmount),         // 457
    LINXY(__NR_listmount,         sys_listmount),         // 458
+   LINXY(__NR_lsm_get_self_attr, sys_lsm_get_self_attr), // 459
+   LINX_(__NR_lsm_set_self_attr, sys_lsm_set_self_attr), // 460
    LINX_(__NR_mseal,             sys_mseal),             // 462
 };
 

diff --git a/include/vki/vki-linux.h b/include/vki/vki-linux.h
index 1b32295bf222ab64f81a7fce2182bafad2c4b6f4..1461715c0dbd8f479d47576751876dda5f21f9f0 100644 (file)
--- a/include/vki/vki-linux.h
+++ b/include/vki/vki-linux.h
@@ -5574,6 +5574,18 @@ struct vki_statmount {
        char str[];             /* Variable size part containing strings */
 };
 
+//----------------------------------------------------------------------
+// From uapi/linux/lsm.h
+//----------------------------------------------------------------------
+
+struct vki_lsm_ctx {
+       __vki_u64 id;
+       __vki_u64 flags;
+       __vki_u64 len;
+       __vki_u64 ctx_len;
+       __vki_u8 ctx[]; /* __counted_by(ctx_len); */
+};
+
 /*--------------------------------------------------------------------*/
 /*--- end                                                          ---*/
 /*--------------------------------------------------------------------*/

diff --git a/include/vki/vki-scnums-shared-linux.h b/include/vki/vki-scnums-shared-linux.h
index 518131a1fd84cb6c3065518a2b52eec2751136fe..b2eae64aae8a87d9a52d2a302bf258eb1bd605c4 100644 (file)
--- a/include/vki/vki-scnums-shared-linux.h
+++ b/include/vki/vki-scnums-shared-linux.h
@@ -60,6 +60,8 @@
 #define __NR_fchmodat2         452
 #define __NR_statmount         457
 #define __NR_listmount         458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
 #define __NR_mseal             462
 
 #endif