root_plug.c 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141
  1. /*
  2. * Root Plug sample LSM module
  3. *
  4. * Originally written for a Linux Journal.
  5. *
  6. * Copyright (C) 2002 Greg Kroah-Hartman <greg@kroah.com>
  7. *
  8. * Prevents any programs running with egid == 0 if a specific USB device
  9. * is not present in the system. Yes, it can be gotten around, but is a
  10. * nice starting point for people to play with, and learn the LSM
  11. * interface.
  12. *
  13. * If you want to turn this into something with a semblance of security,
  14. * you need to hook the task_* functions also.
  15. *
  16. * See http://www.linuxjournal.com/article.php?sid=6279 for more information
  17. * about this code.
  18. *
  19. * This program is free software; you can redistribute it and/or
  20. * modify it under the terms of the GNU General Public License as
  21. * published by the Free Software Foundation, version 2 of the
  22. * License.
  23. */
  24. #include <linux/module.h>
  25. #include <linux/kernel.h>
  26. #include <linux/init.h>
  27. #include <linux/security.h>
  28. #include <linux/usb.h>
  29. /* flag to keep track of how we were registered */
  30. static int secondary;
  31. /* default is a generic type of usb to serial converter */
  32. static int vendor_id = 0x0557;
  33. static int product_id = 0x2008;
  34. module_param(vendor_id, uint, 0400);
  35. MODULE_PARM_DESC(vendor_id, "USB Vendor ID of device to look for");
  36. module_param(product_id, uint, 0400);
  37. MODULE_PARM_DESC(product_id, "USB Product ID of device to look for");
  38. /* should we print out debug messages */
  39. static int debug = 0;
  40. module_param(debug, bool, 0600);
  41. MODULE_PARM_DESC(debug, "Debug enabled or not");
  42. #if defined(CONFIG_SECURITY_ROOTPLUG_MODULE)
  43. #define MY_NAME THIS_MODULE->name
  44. #else
  45. #define MY_NAME "root_plug"
  46. #endif
  47. #define root_dbg(fmt, arg...) \
  48. do { \
  49. if (debug) \
  50. printk(KERN_DEBUG "%s: %s: " fmt , \
  51. MY_NAME , __FUNCTION__ , \
  52. ## arg); \
  53. } while (0)
  54. static int rootplug_bprm_check_security (struct linux_binprm *bprm)
  55. {
  56. struct usb_device *dev;
  57. root_dbg("file %s, e_uid = %d, e_gid = %d\n",
  58. bprm->filename, bprm->e_uid, bprm->e_gid);
  59. if (bprm->e_gid == 0) {
  60. dev = usb_find_device(vendor_id, product_id);
  61. if (!dev) {
  62. root_dbg("e_gid = 0, and device not found, "
  63. "task not allowed to run...\n");
  64. return -EPERM;
  65. }
  66. usb_put_dev(dev);
  67. }
  68. return 0;
  69. }
  70. static struct security_operations rootplug_security_ops = {
  71. /* Use the capability functions for some of the hooks */
  72. .ptrace = cap_ptrace,
  73. .capget = cap_capget,
  74. .capset_check = cap_capset_check,
  75. .capset_set = cap_capset_set,
  76. .capable = cap_capable,
  77. .bprm_apply_creds = cap_bprm_apply_creds,
  78. .bprm_set_security = cap_bprm_set_security,
  79. .task_post_setuid = cap_task_post_setuid,
  80. .task_reparent_to_init = cap_task_reparent_to_init,
  81. .bprm_check_security = rootplug_bprm_check_security,
  82. };
  83. static int __init rootplug_init (void)
  84. {
  85. /* register ourselves with the security framework */
  86. if (register_security (&rootplug_security_ops)) {
  87. printk (KERN_INFO
  88. "Failure registering Root Plug module with the kernel\n");
  89. /* try registering with primary module */
  90. if (mod_reg_security (MY_NAME, &rootplug_security_ops)) {
  91. printk (KERN_INFO "Failure registering Root Plug "
  92. " module with primary security module.\n");
  93. return -EINVAL;
  94. }
  95. secondary = 1;
  96. }
  97. printk (KERN_INFO "Root Plug module initialized, "
  98. "vendor_id = %4.4x, product id = %4.4x\n", vendor_id, product_id);
  99. return 0;
  100. }
  101. static void __exit rootplug_exit (void)
  102. {
  103. /* remove ourselves from the security framework */
  104. if (secondary) {
  105. if (mod_unreg_security (MY_NAME, &rootplug_security_ops))
  106. printk (KERN_INFO "Failure unregistering Root Plug "
  107. " module with primary module.\n");
  108. } else {
  109. if (unregister_security (&rootplug_security_ops)) {
  110. printk (KERN_INFO "Failure unregistering Root Plug "
  111. "module with the kernel\n");
  112. }
  113. }
  114. printk (KERN_INFO "Root Plug module removed\n");
  115. }
  116. security_initcall (rootplug_init);
  117. module_exit (rootplug_exit);
  118. MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article");
  119. MODULE_LICENSE("GPL");