NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ANDROID: kernel: Add restricted vendor hook in creds

Browse source 
Add restricted vendor hook for creds, so we get the creds
information to monitor cred lifetime. During the lifetime,
we store the creds information in a standalone protected
memory and keep track of integrity.

These hooks may be invoked in non-atomic context, so it's
necessary to use restricted ones.

Bug: 248994334
Change-Id: I57fbb759452302fa1ba1e720c76bfe671eab96b5
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
This commit is contained in:
Kuan-Ying Lee 2023-04-12 14:16:05 +08:00 • committed by Todd Kjos
parent 4da8c1036e
commit 05b36413b6
3 changed files with 44 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/android/vendor_hooks.c
View file

@ -36,6 +36,7 @@
#include <trace/hooks/cpuidle_psci.h>
#include <trace/hooks/vmscan.h>
#include <trace/hooks/avc.h>
#include <trace/hooks/creds.h>
#include <trace/hooks/selinux.h>
#include <trace/hooks/syscall_check.h>
#include <trace/hooks/remoteproc.h>
@ -131,6 +132,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_avc_insert);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_avc_node_delete);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_avc_node_replace);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_avc_lookup);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_commit_creds);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_exit_creds);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_override_creds);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_revert_creds);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_is_initialized);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_shmem_get_folio);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_mmap_file);

33
include/trace/hooks/creds.h Normal file
View file

@ -0,0 +1,33 @@
/* SPDX-License-Identifier: GPL-2.0 */
#undef TRACE_SYSTEM
#define TRACE_SYSTEM creds
#define TRACE_INCLUDE_PATH trace/hooks
#if !defined(_TRACE_HOOK_CREDS_H) || defined(TRACE_HEADER_MULTI_READ)
#define _TRACE_HOOK_CREDS_H
#include <trace/hooks/vendor_hooks.h>
/*
* Following tracepoints are not exported in tracefs and provide a
* mechanism for vendor modules to hook and extend functionality
*/
struct cred;
struct task_struct;
DECLARE_RESTRICTED_HOOK(android_rvh_commit_creds,
TP_PROTO(const struct task_struct *task, const struct cred *new),
TP_ARGS(task, new), 1);
DECLARE_RESTRICTED_HOOK(android_rvh_exit_creds,
TP_PROTO(const struct task_struct *task, const struct cred *cred),
TP_ARGS(task, cred), 1);
DECLARE_RESTRICTED_HOOK(android_rvh_override_creds,
TP_PROTO(const struct task_struct *task, const struct cred *new),
TP_ARGS(task, new), 1);
DECLARE_RESTRICTED_HOOK(android_rvh_revert_creds,
TP_PROTO(const struct task_struct *task, const struct cred *old),
TP_ARGS(task, old), 1);
#endif /* _TRACE_HOOK_CREDS_H */
/* This part must be outside protection */
#include <trace/define_trace.h>

6
kernel/cred.c
View file

@ -17,6 +17,8 @@
#include <linux/cn_proc.h>
#include <linux/uidgid.h>
#include <trace/hooks/creds.h>
#if 0
#define kdebug(FMT, ...) \
printk("[%-5.5s%5u] " FMT "\n", \
@ -181,6 +183,7 @@ void exit_creds(struct task_struct *tsk)
key_put(tsk->cached_requested_key);
tsk->cached_requested_key = NULL;
#endif
trace_android_rvh_exit_creds(tsk, cred);
}
/**
@ -499,6 +502,7 @@ int commit_creds(struct cred *new)
inc_rlimit_ucounts(new->ucounts, UCOUNT_RLIMIT_NPROC, 1);
rcu_assign_pointer(task->real_cred, new);
rcu_assign_pointer(task->cred, new);
trace_android_rvh_commit_creds(task, new);
if (new->user != old->user || new->user_ns != old->user_ns)
dec_rlimit_ucounts(old->ucounts, UCOUNT_RLIMIT_NPROC, 1);
alter_cred_subscribers(old, -2);
@ -576,6 +580,7 @@ const struct cred *override_creds(const struct cred *new)
get_new_cred((struct cred *)new);
alter_cred_subscribers(new, 1);
rcu_assign_pointer(current->cred, new);
trace_android_rvh_override_creds(current, new);
alter_cred_subscribers(old, -1);
kdebug("override_creds() = %p{%d,%d}", old,
@ -604,6 +609,7 @@ void revert_creds(const struct cred *old)
validate_creds(override);
alter_cred_subscribers(old, 1);
rcu_assign_pointer(current->cred, old);
trace_android_rvh_revert_creds(current, old);
alter_cred_subscribers(override, -1);
put_cred(override);
}