Skip to content

Commit 2d470c7

Browse files
cschauflerpcmoore
cschaufler
authored and
pcmoore
committed
lsm: replace context+len with lsm_context
Replace the (secctx,seclen) pointer pair with a single lsm_context pointer to allow return of the LSM identifier along with the context and context length. This allows security_release_secctx() to know how to release the context. Callers have been modified to use or save the returned data from the new structure. security_secid_to_secctx() and security_lsmproc_to_secctx() will now return the length value on success instead of 0. Cc: netdev@vger.kernel.org Cc: audit@vger.kernel.org Cc: netfilter-devel@vger.kernel.org Cc: Todd Kjos <tkjos@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [PM: subject tweak, kdoc fix, signedness fix from Dan Carpenter] Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent 6fba898 commit 2d470c7

File tree

17 files changed

+121
-125
lines changed

17 files changed

+121
-125
lines changed

‎drivers/android/binder.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3296,9 +3296,8 @@ static void binder_transaction(struct binder_proc *proc,
32963296
size_t added_size;
32973297

32983298
security_cred_getsecid(proc->cred, &secid);
3299-
ret = security_secid_to_secctx(secid, &lsmctx.context,
3300-
&lsmctx.len);
3301-
if (ret) {
3299+
ret = security_secid_to_secctx(secid, &lsmctx);
3300+
if (ret < 0) {
33023301
binder_txn_error("%d:%d failed to get security context\n",
33033302
thread->pid, proc->pid);
33043303
return_error = BR_FAILED_REPLY;

‎include/linux/lsm_hook_defs.h‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -295,10 +295,9 @@ LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, const char *name,
295295
char **value)
296296
LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size)
297297
LSM_HOOK(int, 0, ismaclabel, const char *name)
298-
LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata,
299-
u32 *seclen)
298+
LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, struct lsm_context *cp)
300299
LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop,
301-
char **secdata, u32 *seclen)
300+
struct lsm_context *cp)
302301
LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)
303302
LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp)
304303
LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)

‎include/linux/security.h‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -584,8 +584,8 @@ int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
584584
int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
585585
int security_netlink_send(struct sock *sk, struct sk_buff *skb);
586586
int security_ismaclabel(const char *name);
587-
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
588-
int security_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata, u32 *seclen);
587+
int security_secid_to_secctx(u32 secid, struct lsm_context *cp);
588+
int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp);
589589
int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
590590
void security_release_secctx(struct lsm_context *cp);
591591
void security_inode_invalidate_secctx(struct inode *inode);
@@ -1557,14 +1557,13 @@ static inline int security_ismaclabel(const char *name)
15571557
return 0;
15581558
}
15591559

1560-
static inline int security_secid_to_secctx(u32 secid, char **secdata,
1561-
u32 *seclen)
1560+
static inline int security_secid_to_secctx(u32 secid, struct lsm_context *cp)
15621561
{
15631562
return -EOPNOTSUPP;
15641563
}
15651564

15661565
static inline int security_lsmprop_to_secctx(struct lsm_prop *prop,
1567-
char **secdata, u32 *seclen)
1566+
struct lsm_context *cp)
15681567
{
15691568
return -EOPNOTSUPP;
15701569
}

‎include/net/scm.h‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,10 +109,9 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
109109
int err;
110110

111111
if (test_bit(SOCK_PASSSEC, &sock->flags)) {
112-
err = security_secid_to_secctx(scm->secid, &ctx.context,
113-
&ctx.len);
112+
err = security_secid_to_secctx(scm->secid, &ctx);
114113

115-
if (!err) {
114+
if (err >= 0) {
116115
put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, ctx.len,
117116
ctx.context);
118117
security_release_secctx(&ctx);

‎kernel/audit.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1473,9 +1473,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
14731473
case AUDIT_SIGNAL_INFO:
14741474
if (lsmprop_is_set(&audit_sig_lsm)) {
14751475
err = security_lsmprop_to_secctx(&audit_sig_lsm,
1476-
&lsmctx.context,
1477-
&lsmctx.len);
1478-
if (err)
1476+
&lsmctx);
1477+
if (err < 0)
14791478
return err;
14801479
}
14811480
sig_data = kmalloc(struct_size(sig_data, ctx, lsmctx.len),
@@ -2188,8 +2187,8 @@ int audit_log_task_context(struct audit_buffer *ab)
21882187
if (!lsmprop_is_set(&prop))
21892188
return 0;
21902189

2191-
error = security_lsmprop_to_secctx(&prop, &ctx.context, &ctx.len);
2192-
if (error) {
2190+
error = security_lsmprop_to_secctx(&prop, &ctx);
2191+
if (error < 0) {
21932192
if (error != -EINVAL)
21942193
goto error_path;
21952194
return 0;

‎kernel/auditsc.c‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1109,7 +1109,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
11091109
from_kuid(&init_user_ns, auid),
11101110
from_kuid(&init_user_ns, uid), sessionid);
11111111
if (lsmprop_is_set(prop)) {
1112-
if (security_lsmprop_to_secctx(prop, &ctx.context, &ctx.len)) {
1112+
if (security_lsmprop_to_secctx(prop, &ctx) < 0) {
11131113
audit_log_format(ab, " obj=(none)");
11141114
rc = 1;
11151115
} else {
@@ -1370,7 +1370,6 @@ static void audit_log_time(struct audit_context *context, struct audit_buffer **
13701370

13711371
static void show_special(struct audit_context *context, int *call_panic)
13721372
{
1373-
struct lsm_context lsmcxt;
13741373
struct audit_buffer *ab;
13751374
int i;
13761375

@@ -1393,16 +1392,14 @@ static void show_special(struct audit_context *context, int *call_panic)
13931392
from_kgid(&init_user_ns, context->ipc.gid),
13941393
context->ipc.mode);
13951394
if (lsmprop_is_set(&context->ipc.oprop)) {
1396-
char *ctx = NULL;
1397-
u32 len;
1395+
struct lsm_context lsmctx;
13981396

13991397
if (security_lsmprop_to_secctx(&context->ipc.oprop,
1400-
&ctx, &len)) {
1398+
&lsmctx) < 0) {
14011399
*call_panic = 1;
14021400
} else {
1403-
audit_log_format(ab, " obj=%s", ctx);
1404-
lsmcontext_init(&lsmcxt, ctx, len, 0);
1405-
security_release_secctx(&lsmcxt);
1401+
audit_log_format(ab, " obj=%s", lsmctx.context);
1402+
security_release_secctx(&lsmctx);
14061403
}
14071404
}
14081405
if (context->ipc.has_perm) {
@@ -1563,8 +1560,7 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
15631560
if (lsmprop_is_set(&n->oprop)) {
15641561
struct lsm_context ctx;
15651562

1566-
if (security_lsmprop_to_secctx(&n->oprop, &ctx.context,
1567-
&ctx.len)) {
1563+
if (security_lsmprop_to_secctx(&n->oprop, &ctx) < 0) {
15681564
if (call_panic)
15691565
*call_panic = 2;
15701566
} else {

‎net/ipv4/ip_sockglue.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,8 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
136136
if (err)
137137
return;
138138

139-
err = security_secid_to_secctx(secid, &ctx.context, &ctx.len);
140-
if (err)
139+
err = security_secid_to_secctx(secid, &ctx);
140+
if (err < 0)
141141
return;
142142

143143
put_cmsg(msg, SOL_IP, SCM_SECURITY, ctx.len, ctx.context);

‎net/netfilter/nf_conntrack_netlink.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -360,8 +360,8 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
360360
struct lsm_context ctx;
361361
int ret;
362362

363-
ret = security_secid_to_secctx(ct->secmark, &ctx.context, &ctx.len);
364-
if (ret)
363+
ret = security_secid_to_secctx(ct->secmark, &ctx);
364+
if (ret < 0)
365365
return 0;
366366

367367
ret = -1;
@@ -663,14 +663,14 @@ static inline size_t ctnetlink_acct_size(const struct nf_conn *ct)
663663
static inline int ctnetlink_secctx_size(const struct nf_conn *ct)
664664
{
665665
#ifdef CONFIG_NF_CONNTRACK_SECMARK
666-
int len, ret;
666+
int ret;
667667

668-
ret = security_secid_to_secctx(ct->secmark, NULL, &len);
669-
if (ret)
668+
ret = security_secid_to_secctx(ct->secmark, NULL);
669+
if (ret < 0)
670670
return 0;
671671

672672
return nla_total_size(0) /* CTA_SECCTX */
673-
+ nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
673+
+ nla_total_size(sizeof(char) * ret); /* CTA_SECCTX_NAME */
674674
#else
675675
return 0;
676676
#endif

‎net/netfilter/nf_conntrack_standalone.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,8 +175,8 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
175175
struct lsm_context ctx;
176176
int ret;
177177

178-
ret = security_secid_to_secctx(ct->secmark, &ctx.context, &ctx.len);
179-
if (ret)
178+
ret = security_secid_to_secctx(ct->secmark, &ctx);
179+
if (ret < 0)
180180
return;
181181

182182
seq_printf(s, "secctx=%s ", ctx.context);

‎net/netfilter/nfnetlink_queue.c‎

Lines changed: 11 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -470,18 +470,18 @@ static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk)
470470
return 0;
471471
}
472472

473-
static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
473+
static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx)
474474
{
475475
u32 seclen = 0;
476476
#if IS_ENABLED(CONFIG_NETWORK_SECMARK)
477+
477478
if (!skb || !sk_fullsock(skb->sk))
478479
return 0;
479480

480481
read_lock_bh(&skb->sk->sk_callback_lock);
481482

482483
if (skb->secmark)
483-
security_secid_to_secctx(skb->secmark, secdata, &seclen);
484-
484+
seclen = security_secid_to_secctx(skb->secmark, ctx);
485485
read_unlock_bh(&skb->sk->sk_callback_lock);
486486
#endif
487487
return seclen;
@@ -567,8 +567,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
567567
enum ip_conntrack_info ctinfo = 0;
568568
const struct nfnl_ct_hook *nfnl_ct;
569569
bool csum_verify;
570-
struct lsm_context scaff; /* scaffolding */
571-
char *secdata = NULL;
570+
struct lsm_context ctx;
572571
u32 seclen = 0;
573572
ktime_t tstamp;
574573

@@ -643,8 +642,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
643642
}
644643

645644
if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
646-
seclen = nfqnl_get_sk_secctx(entskb, &secdata);
647-
if (seclen)
645+
seclen = nfqnl_get_sk_secctx(entskb, &ctx);
646+
if (seclen >= 0)
648647
size += nla_total_size(seclen);
649648
}
650649

@@ -783,7 +782,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
783782
if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)
784783
goto nla_put_failure;
785784

786-
if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
785+
if (seclen && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context))
787786
goto nla_put_failure;
788787

789788
if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
@@ -811,21 +810,17 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
811810
}
812811

813812
nlh->nlmsg_len = skb->len;
814-
if (seclen) {
815-
lsmcontext_init(&scaff, secdata, seclen, 0);
816-
security_release_secctx(&scaff);
817-
}
813+
if (seclen >= 0)
814+
security_release_secctx(&ctx);
818815
return skb;
819816

820817
nla_put_failure:
821818
skb_tx_error(entskb);
822819
kfree_skb(skb);
823820
net_err_ratelimited("nf_queue: error creating packet message\n");
824821
nlmsg_failure:
825-
if (seclen) {
826-
lsmcontext_init(&scaff, secdata, seclen, 0);
827-
security_release_secctx(&scaff);
828-
}
822+
if (seclen >= 0)
823+
security_release_secctx(&ctx);
829824
return NULL;
830825
}
831826

0 commit comments

Comments
 (0)