linux-kernel - Re: [PATCH 02/15] security: move LSM xattrnames to xattr.h

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 24 Jun 2010 20:49:25 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
CC:	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	David Safford <safford@...son.ibm.com>,
	Dave Hansen <dave@...ux.vnet.ibm.com>,
	Mimi Zohar <zohar@...ibm.com>
Subject: Re: [PATCH 02/15] security: move LSM xattrnames to xattr.h

Mimi Zohar wrote:
> Make the security extended attributes names global.
>
> Signed-off-by: Mimi Zohar <zohar@...ibm.com>
> Acked-by: Serge Hallyn <serue@...ibm.com>
> ---
>  include/linux/capability.h |    3 ---
>  include/linux/xattr.h      |   10 ++++++++++
>  security/selinux/hooks.c   |    3 ---
>  security/smack/smack.h     |    2 --
>  4 files changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index 39e5ff5..90012b9 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -49,9 +49,6 @@ typedef struct __user_cap_data_struct {
>  } __user *cap_user_data_t;
>  
>  
> -#define XATTR_CAPS_SUFFIX "capability"
> -#define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
> -
>  #define VFS_CAP_REVISION_MASK	0xFF000000
>  #define VFS_CAP_REVISION_SHIFT	24
>  #define VFS_CAP_FLAGS_MASK	~VFS_CAP_REVISION_MASK
> diff --git a/include/linux/xattr.h b/include/linux/xattr.h
> index 0cfa1e9..62ca853 100644
> --- a/include/linux/xattr.h
> +++ b/include/linux/xattr.h
> @@ -33,6 +33,16 @@
>  #define XATTR_USER_PREFIX "user."
>  #define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1)
>  
> +/* Security namespace */
> +#define XATTR_SELINUX_SUFFIX "selinux"
> +#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
> +
> +#define XATTR_SMACK_SUFFIX "SMACK64"
> +#define XATTR_NAME_SMACK XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
> +
> +#define XATTR_CAPS_SUFFIX "capability"
> +#define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
> +
>  struct inode;
>  struct dentry;
>  
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 0f524b7..85338f0 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -87,9 +87,6 @@
>  #include "netlabel.h"
>  #include "audit.h"
>  
> -#define XATTR_SELINUX_SUFFIX "selinux"
> -#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
> -
>  #define NUM_SEL_MNT_OPTS 5
>  
>  extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
> diff --git a/security/smack/smack.h b/security/smack/smack.h
> index c6e9aca..9c773e3 100644
> --- a/security/smack/smack.h
> +++ b/security/smack/smack.h
> @@ -126,10 +126,8 @@ struct smack_known {
>  /*
>   * xattr names
>   */
> -#define XATTR_SMACK_SUFFIX	"SMACK64"
>  #define XATTR_SMACK_IPIN	"SMACK64IPIN"
>  #define XATTR_SMACK_IPOUT	"SMACK64IPOUT"
> -#define XATTR_NAME_SMACK	XATTR_SECURITY_PREFIX XATTR_SMACK_SUFFIX
>  #define XATTR_NAME_SMACKIPIN	XATTR_SECURITY_PREFIX XATTR_SMACK_IPIN
>  #define XATTR_NAME_SMACKIPOUT	XATTR_SECURITY_PREFIX XATTR_SMACK_IPOUT
>   

Why just the SMACK64 attribute name, and not the others? They are
manipulated with the same interfaces (well, fsetxattr, fgetxattr)
as the SMACK64 attribute. There isn't any conceptual difference and
the rationale for moving attribute names really ought to apply to
them as well.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/