diff options
| author | Kees Cook <kees.cook@canonical.com> | 2010-06-28 22:34:04 -0700 |
|---|---|---|
| committer | John Rigby <john.rigby@linaro.org> | 2011-11-16 14:24:23 -0700 |
| commit | 0c948fba39cbbfe73e72f1b6bfd991caa583c60d (patch) | |
| tree | 08045bcd2ce194743ec84e8d82d6ea9d3e81cac5 /include | |
| parent | a530aa9d98ce6fcb8dc6c1721ee743ba0cdc8fd2 (diff) | |
UBUNTU: ubuntu: Yama - create task_free security callback
The current LSM interface to cred_free is not sufficient for allowing
an LSM to track the life and death of a task. This patch adds the
task_free hook so that an LSM can clean up resources on task death.
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/security.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/include/linux/security.h b/include/linux/security.h index ebd2a53a3d0..ecd07ccc592 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -645,6 +645,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) * manual page for definitions of the @clone_flags. * @clone_flags contains the flags indicating what should be shared. * Return 0 if permission is granted. + * @task_free: + * @task task being freed + * Handle release of task-related resources. * @cred_alloc_blank: * @cred points to the credentials. * @gfp indicates the atomicity of any memory allocations. @@ -1495,6 +1498,7 @@ struct security_operations { int (*dentry_open) (struct file *file, const struct cred *cred); int (*task_create) (unsigned long clone_flags); + void (*task_free) (struct task_struct *task); int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp); void (*cred_free) (struct cred *cred); int (*cred_prepare)(struct cred *new, const struct cred *old, @@ -1752,6 +1756,7 @@ int security_file_send_sigiotask(struct task_struct *tsk, int security_file_receive(struct file *file); int security_dentry_open(struct file *file, const struct cred *cred); int security_task_create(unsigned long clone_flags); +void security_task_free(struct task_struct *task); int security_cred_alloc_blank(struct cred *cred, gfp_t gfp); void security_cred_free(struct cred *cred); int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp); @@ -2255,6 +2260,9 @@ static inline int security_task_create(unsigned long clone_flags) return 0; } +static inline void security_task_free(struct task_struct *task) +{ } + static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) { return 0; |