From: Michael Halcrow I have received positive feedback from various individuals who have applied my BSD Secure Levels LSM patch, and so at this point I am submitting it to you with a request to merge it in. Nothing has changed in this patch since when I last posted it to the LKML, so I am not re-sending it there. This first patch adds hooks to catch attempts to set the system clock back. Signed-off-by: Michael A. Halcrow Signed-off-by: Andrew Morton --- 25-akpm/arch/mips/kernel/sysirix.c | 10 ++++++++-- 25-akpm/arch/ppc64/kernel/time.c | 16 ++++++++++------ 25-akpm/include/linux/security.h | 19 +++++++++++++++++++ 25-akpm/kernel/time.c | 18 +++++++++++++----- 25-akpm/security/capability.c | 1 + 25-akpm/security/commoncap.c | 16 +++++++++++----- 25-akpm/security/dummy.c | 8 ++++++++ 7 files changed, 70 insertions(+), 18 deletions(-) diff -puN arch/mips/kernel/sysirix.c~bsd-secure-levels-lsm-add-time-hooks arch/mips/kernel/sysirix.c --- 25/arch/mips/kernel/sysirix.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/arch/mips/kernel/sysirix.c Thu Sep 30 16:37:38 2004 @@ -619,8 +619,14 @@ asmlinkage int irix_getgid(struct pt_reg asmlinkage int irix_stime(int value) { - if (!capable(CAP_SYS_TIME)) - return -EPERM; + int err; + struct timespec tv; + + tv.tv_sec = value; + tv.tv_nsec = 0; + err = security_settime(&tv, NULL); + if (err) + return err; write_seqlock_irq(&xtime_lock); xtime.tv_sec = value; diff -puN arch/ppc64/kernel/time.c~bsd-secure-levels-lsm-add-time-hooks arch/ppc64/kernel/time.c --- 25/arch/ppc64/kernel/time.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/arch/ppc64/kernel/time.c Thu Sep 30 16:37:38 2004 @@ -434,9 +434,7 @@ long ppc64_sys32_stime(int __user * tptr { int value; struct timespec myTimeval; - - if (!capable(CAP_SYS_TIME)) - return -EPERM; + int err; if (get_user(value, tptr)) return -EFAULT; @@ -444,6 +442,10 @@ long ppc64_sys32_stime(int __user * tptr myTimeval.tv_sec = value; myTimeval.tv_nsec = 0; + err = security_settime(&myTimeval, NULL); + if (err) + return err; + do_settimeofday(&myTimeval); return 0; @@ -459,9 +461,7 @@ long ppc64_sys_stime(long __user * tptr) { long value; struct timespec myTimeval; - - if (!capable(CAP_SYS_TIME)) - return -EPERM; + int err; if (get_user(value, tptr)) return -EFAULT; @@ -469,6 +469,10 @@ long ppc64_sys_stime(long __user * tptr) myTimeval.tv_sec = value; myTimeval.tv_nsec = 0; + err = security_settime(&myTimeval, NULL); + if (err) + return err; + do_settimeofday(&myTimeval); return 0; diff -puN include/linux/security.h~bsd-secure-levels-lsm-add-time-hooks include/linux/security.h --- 25/include/linux/security.h~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/include/linux/security.h Thu Sep 30 16:37:38 2004 @@ -40,6 +40,7 @@ struct ctl_table; * as the default capabilities functions */ extern int cap_capable (struct task_struct *tsk, int cap); +extern int cap_settime (struct timespec *ts, struct timezone *tz); extern int cap_ptrace (struct task_struct *parent, struct task_struct *child); extern int cap_capget (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); extern int cap_capset_check (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); @@ -1001,6 +1002,12 @@ struct swap_info_struct; * See the syslog(2) manual page for an explanation of the @type values. * @type contains the type of action. * Return 0 if permission is granted. + * @settime: + * Check permission to change the system time. + * struct timespec and timezone are defined in include/linux/time.h + * @ts contains new time + * @tz contains new timezone + * Return 0 if permission is granted. * @vm_enough_memory: * Check permissions for allocating a new virtual mapping. * @pages contains the number of pages. @@ -1036,6 +1043,7 @@ struct security_operations { int (*quotactl) (int cmds, int type, int id, struct super_block * sb); int (*quota_on) (struct file * f); int (*syslog) (int type); + int (*settime) (struct timespec *ts, struct timezone *tz); int (*vm_enough_memory) (long pages); int (*bprm_alloc_security) (struct linux_binprm * bprm); @@ -1291,6 +1299,12 @@ static inline int security_syslog(int ty return security_ops->syslog(type); } +static inline int security_settime(struct timespec *ts, struct timezone *tz) +{ + return security_ops->settime(ts, tz); +} + + static inline int security_vm_enough_memory(long pages) { return security_ops->vm_enough_memory(pages); @@ -1963,6 +1977,11 @@ static inline int security_syslog(int ty return cap_syslog(type); } +static inline int security_settime(struct timespec *ts, struct timezone *tz) +{ + return cap_settime(ts, tz); +} + static inline int security_vm_enough_memory(long pages) { return cap_vm_enough_memory(pages); diff -puN kernel/time.c~bsd-secure-levels-lsm-add-time-hooks kernel/time.c --- 25/kernel/time.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/kernel/time.c Thu Sep 30 16:37:38 2004 @@ -32,6 +32,8 @@ #include #include #include +#include + #include #include @@ -78,13 +80,17 @@ asmlinkage long sys_time(int __user * tl asmlinkage long sys_stime(time_t __user *tptr) { struct timespec tv; + int err; - if (!capable(CAP_SYS_TIME)) - return -EPERM; if (get_user(tv.tv_sec, tptr)) return -EFAULT; tv.tv_nsec = 0; + + err = security_settime(&tv, NULL); + if (err) + return err; + do_settimeofday(&tv); return 0; } @@ -146,10 +152,12 @@ inline static void warp_clock(void) int do_sys_settimeofday(struct timespec *tv, struct timezone *tz) { static int firsttime = 1; + int error = 0; + + error = security_settime(tv, tz); + if (error) + return error; - if (!capable(CAP_SYS_TIME)) - return -EPERM; - if (tz) { /* SMP safe, global irq locking makes it work. */ sys_tz = *tz; diff -puN security/capability.c~bsd-secure-levels-lsm-add-time-hooks security/capability.c --- 25/security/capability.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/security/capability.c Thu Sep 30 16:37:38 2004 @@ -30,6 +30,7 @@ static struct security_operations capabi .capset_check = cap_capset_check, .capset_set = cap_capset_set, .capable = cap_capable, + .settime = cap_settime, .netlink_send = cap_netlink_send, .netlink_recv = cap_netlink_recv, diff -puN security/commoncap.c~bsd-secure-levels-lsm-add-time-hooks security/commoncap.c --- 25/security/commoncap.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/security/commoncap.c Thu Sep 30 16:37:38 2004 @@ -27,20 +27,25 @@ int cap_capable (struct task_struct *tsk, int cap) { /* Derived from include/linux/sched.h:capable. */ - if (cap_raised (tsk->cap_effective, cap)) + if (cap_raised(tsk->cap_effective, cap)) return 0; - else + return -EPERM; +} + +int cap_settime(struct timespec *ts, struct timezone *tz) +{ + if (!capable(CAP_SYS_TIME)) return -EPERM; + return 0; } int cap_ptrace (struct task_struct *parent, struct task_struct *child) { /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */ if (!cap_issubset (child->cap_permitted, current->cap_permitted) && - !capable (CAP_SYS_PTRACE)) + !capable(CAP_SYS_PTRACE)) return -EPERM; - else - return 0; + return 0; } int cap_capget (struct task_struct *target, kernel_cap_t *effective, @@ -373,6 +378,7 @@ int cap_vm_enough_memory(long pages) } EXPORT_SYMBOL(cap_capable); +EXPORT_SYMBOL(cap_settime); EXPORT_SYMBOL(cap_ptrace); EXPORT_SYMBOL(cap_capget); EXPORT_SYMBOL(cap_capset_check); diff -puN security/dummy.c~bsd-secure-levels-lsm-add-time-hooks security/dummy.c --- 25/security/dummy.c~bsd-secure-levels-lsm-add-time-hooks Thu Sep 30 16:37:38 2004 +++ 25-akpm/security/dummy.c Thu Sep 30 16:37:38 2004 @@ -104,6 +104,13 @@ static int dummy_syslog (int type) return 0; } +static int dummy_settime (struct timeval *tv, struct timezone *tz) +{ + if (!capable(CAP_SYS_TIME)) + return -EPERM; + return 0; +} + /* * Check that a process has enough memory to allocate a new virtual * mapping. 0 means there is enough memory for the allocation to @@ -897,6 +904,7 @@ void security_fixup_ops (struct security set_to_dummy_if_null(ops, quota_on); set_to_dummy_if_null(ops, sysctl); set_to_dummy_if_null(ops, syslog); + set_to_dummy_if_null(ops, settime); set_to_dummy_if_null(ops, vm_enough_memory); set_to_dummy_if_null(ops, bprm_alloc_security); set_to_dummy_if_null(ops, bprm_free_security); _