From patchwork Thu Mar 23 17:30:22 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sunyeop Lee X-Patchwork-Id: 19717 Received: (qmail 15028 invoked by alias); 23 Mar 2017 17:32:10 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 14995 invoked by uid 89); 23 Mar 2017 17:32:09 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.6 required=5.0 tests=BAYES_00, FREEMAIL_ENVFROM_END_DIGIT, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_PASS autolearn=ham version=3.3.2 spammy= X-HELO: mail-pf0-f175.google.com X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=md0jMobOfLeNfzIRZoNBceMmSOU3KSNT9VlzFKNiD6I=; b=tCPvS1fkStkyFRDF3qOxlQ1SfTlFzVGSRGgsIBiQnwVO49aLKsdm2HU97psUe/Uhqi HfpJKeV+NVuk3PrrhnafelNJ27xW5PfI2h7IhrE9u3GRcbB5KRJY730rHbL/3OI2jCbX x0voJh6RG10bu5jKNfViH9bKekzbeUjGqIaL6GlyMaNvPgVci+H+qMmL/9geS7naqGf2 R3rldnZwMT2QK/8f3EsyI8WhNOoatXqoUKwlsbQCREkL7HbNmGI8X0crmHOB3B0fsoli 8H1fHphrBYLyh4rfb+ndxjIH6GsdXCZ6YzMWgKIfSsliCcaQmopmQCPSF0Si/KMxMDPz Ol3Q== X-Gm-Message-State: AFeK/H0Ad7Xbq0NJ8BKY7cYbycBLkMmLgT3KCJdZtlNt+Z+H2fwC8J0S65zFfcQs7wqYPA== X-Received: by 10.84.229.2 with SMTP id b2mr5233677plk.154.1490290327903; Thu, 23 Mar 2017 10:32:07 -0700 (PDT) From: Sunyeop Lee To: libc-alpha@sourceware.org Cc: Sunyeop Lee Subject: [PATCH] Update old tunables framework document/script. Date: Thu, 23 Mar 2017 17:30:22 +0000 Message-Id: <1490290222-8978-1-git-send-email-sunyeop97@gmail.com> Since commit 8b9e9c3c0bae497ad5e2d0ae2f333f62feddcc12, security_level replaces is_secure. There were some old files need to be updated. 2017-03-23 Sunyeop Lee * README.tunables: Updated descriptions. * elf/dl-tunables.list: Fixed typo: SXID_NONE -> NONE. * scripts/gen-tunables.awk: Updated the code related to the commit. --- README.tunables | 14 +++++++------- elf/dl-tunables.list | 2 +- scripts/gen-tunables.awk | 12 ++++++------ 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/README.tunables b/README.tunables index df74f3b..aace2fc 100644 --- a/README.tunables +++ b/README.tunables @@ -58,13 +58,13 @@ The list of allowed attributes are: - env_alias: An alias environment variable -- is_secure: Specify whether the tunable should be read for setuid - binaries. True allows the tunable to be read for - setuid binaries while false disables it. Note that - even if this is set as true and the value is read, it - may not be used if it does not validate against the - acceptable values or is not considered safe by the - module. +- security_level: Specify security level of the tunable. Valid values: + + SXID_ERASE: (default) Don't read for AT_SECURE binaries and + removed so that child processes can't read it. + SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for + non-AT_SECURE subprocesses. + NONE: Read all the time. 2. Call either the TUNABLE_SET_VALUE and pass into it the tunable name and a pointer to the variable that should be set with the tunable value. diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list index cb9e8f1..b9f1488 100644 --- a/elf/dl-tunables.list +++ b/elf/dl-tunables.list @@ -27,7 +27,7 @@ # removed so that child processes can't read it. # SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for # non-AT_SECURE subprocesses. -# SXID_NONE: Read all the time. +# NONE: Read all the time. glibc { malloc { diff --git a/scripts/gen-tunables.awk b/scripts/gen-tunables.awk index e7bfc22..601240a 100644 --- a/scripts/gen-tunables.awk +++ b/scripts/gen-tunables.awk @@ -51,8 +51,8 @@ $1 == "}" { if (!env_alias[top_ns][ns][tunable]) { env_alias[top_ns][ns][tunable] = "NULL" } - if (!is_secure[top_ns][ns][tunable]) { - is_secure[top_ns][ns][tunable] = "SXID_ERASE" + if (!security_level[top_ns][ns][tunable]) { + security_level[top_ns][ns][tunable] = "SXID_ERASE" } tunable = "" @@ -104,12 +104,12 @@ $1 == "}" { } else if (attr == "security_level") { if (val == "SXID_ERASE" || val == "SXID_IGNORE" || val == "NONE") { - is_secure[top_ns][ns][tunable] = val + security_level[top_ns][ns][tunable] = val } else { - printf("Line %d: Invalid value (%s) for is_secure: %s, ", NR, val, + printf("Line %d: Invalid value (%s) for security_level: %s, ", NR, val, $0) - print("Allowed values are 'true' or 'false'") + print("Allowed values are 'SXID_ERASE', 'SXID_IGNORE', or 'NONE'") exit 1 } } @@ -148,7 +148,7 @@ END { printf (" {TUNABLE_NAME_S(%s, %s, %s)", t, n, m) printf (", {TUNABLE_TYPE_%s, %s, %s}, {.numval = 0}, NULL, TUNABLE_SECLEVEL_%s, %s},\n", types[t][n][m], minvals[t][n][m], maxvals[t][n][m], - is_secure[t][n][m], env_alias[t][n][m]); + security_level[t][n][m], env_alias[t][n][m]); } } }