Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * Root Plug sample LSM module | |
3 | * | |
4 | * Originally written for a Linux Journal. | |
5 | * | |
6 | * Copyright (C) 2002 Greg Kroah-Hartman <greg@kroah.com> | |
7 | * | |
8 | * Prevents any programs running with egid == 0 if a specific USB device | |
9 | * is not present in the system. Yes, it can be gotten around, but is a | |
10 | * nice starting point for people to play with, and learn the LSM | |
11 | * interface. | |
12 | * | |
13 | * If you want to turn this into something with a semblance of security, | |
14 | * you need to hook the task_* functions also. | |
15 | * | |
16 | * See http://www.linuxjournal.com/article.php?sid=6279 for more information | |
17 | * about this code. | |
18 | * | |
19 | * This program is free software; you can redistribute it and/or | |
20 | * modify it under the terms of the GNU General Public License as | |
21 | * published by the Free Software Foundation, version 2 of the | |
22 | * License. | |
23 | */ | |
24 | ||
1da177e4 LT |
25 | #include <linux/kernel.h> |
26 | #include <linux/init.h> | |
27 | #include <linux/security.h> | |
28 | #include <linux/usb.h> | |
20510f2f | 29 | #include <linux/moduleparam.h> |
1da177e4 LT |
30 | |
31 | /* flag to keep track of how we were registered */ | |
32 | static int secondary; | |
33 | ||
34 | /* default is a generic type of usb to serial converter */ | |
35 | static int vendor_id = 0x0557; | |
36 | static int product_id = 0x2008; | |
37 | ||
38 | module_param(vendor_id, uint, 0400); | |
1da177e4 | 39 | module_param(product_id, uint, 0400); |
1da177e4 LT |
40 | |
41 | /* should we print out debug messages */ | |
42 | static int debug = 0; | |
43 | ||
44 | module_param(debug, bool, 0600); | |
1da177e4 | 45 | |
1da177e4 | 46 | #define MY_NAME "root_plug" |
1da177e4 LT |
47 | |
48 | #define root_dbg(fmt, arg...) \ | |
49 | do { \ | |
50 | if (debug) \ | |
51 | printk(KERN_DEBUG "%s: %s: " fmt , \ | |
dd6f953a | 52 | MY_NAME , __func__ , \ |
1da177e4 LT |
53 | ## arg); \ |
54 | } while (0) | |
55 | ||
56 | static int rootplug_bprm_check_security (struct linux_binprm *bprm) | |
57 | { | |
58 | struct usb_device *dev; | |
59 | ||
60 | root_dbg("file %s, e_uid = %d, e_gid = %d\n", | |
61 | bprm->filename, bprm->e_uid, bprm->e_gid); | |
62 | ||
63 | if (bprm->e_gid == 0) { | |
64 | dev = usb_find_device(vendor_id, product_id); | |
65 | if (!dev) { | |
66 | root_dbg("e_gid = 0, and device not found, " | |
67 | "task not allowed to run...\n"); | |
68 | return -EPERM; | |
69 | } | |
70 | usb_put_dev(dev); | |
71 | } | |
72 | ||
73 | return 0; | |
74 | } | |
75 | ||
76 | static struct security_operations rootplug_security_ops = { | |
77 | /* Use the capability functions for some of the hooks */ | |
78 | .ptrace = cap_ptrace, | |
79 | .capget = cap_capget, | |
80 | .capset_check = cap_capset_check, | |
81 | .capset_set = cap_capset_set, | |
82 | .capable = cap_capable, | |
83 | ||
84 | .bprm_apply_creds = cap_bprm_apply_creds, | |
85 | .bprm_set_security = cap_bprm_set_security, | |
86 | ||
87 | .task_post_setuid = cap_task_post_setuid, | |
88 | .task_reparent_to_init = cap_task_reparent_to_init, | |
55d00ccf | 89 | .task_prctl = cap_task_prctl, |
1da177e4 LT |
90 | |
91 | .bprm_check_security = rootplug_bprm_check_security, | |
92 | }; | |
93 | ||
94 | static int __init rootplug_init (void) | |
95 | { | |
96 | /* register ourselves with the security framework */ | |
97 | if (register_security (&rootplug_security_ops)) { | |
98 | printk (KERN_INFO | |
99 | "Failure registering Root Plug module with the kernel\n"); | |
100 | /* try registering with primary module */ | |
101 | if (mod_reg_security (MY_NAME, &rootplug_security_ops)) { | |
102 | printk (KERN_INFO "Failure registering Root Plug " | |
103 | " module with primary security module.\n"); | |
104 | return -EINVAL; | |
105 | } | |
106 | secondary = 1; | |
107 | } | |
108 | printk (KERN_INFO "Root Plug module initialized, " | |
109 | "vendor_id = %4.4x, product id = %4.4x\n", vendor_id, product_id); | |
110 | return 0; | |
111 | } | |
112 | ||
1da177e4 | 113 | security_initcall (rootplug_init); |