linux-kernel - [PATCH 3.16 13/61] selinux: Print 'sclass' as string when unrecognized netlink message occurs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1591725832.755257115@decadent.org.uk>
Date:   Tue, 09 Jun 2020 19:04:04 +0100
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        "Stephen Smalley" <sds@...ho.nsa.gov>,
        "Marek Milkovic" <mmilkovi@...hat.com>,
        "Paul Moore" <pmoore@...hat.com>
Subject: [PATCH 3.16 13/61] selinux: Print 'sclass' as string when
 unrecognized netlink message occurs

3.16.85-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Milkovic <mmilkovi@...hat.com>

commit cded3fffbeab777e6ad2ec05d4a3b62c5caca0f3 upstream.

This prints the 'sclass' field as string instead of index in unrecognized netlink message.
The textual representation makes it easier to distinguish the right class.

Signed-off-by: Marek Milkovic <mmilkovi@...hat.com>
Acked-by: Stephen Smalley <sds@...ho.nsa.gov>
[PM: 80-char width fixes]
Signed-off-by: Paul Moore <pmoore@...hat.com>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 security/selinux/hooks.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4685,8 +4685,9 @@ static int selinux_nlmsg_perm(struct soc
 		if (err == -EINVAL) {
 			printk(KERN_WARNING
 			       "SELinux: unrecognized netlink message:"
-			       " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
-			       sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
+			       " protocol=%hu nlmsg_type=%hu sclass=%s\n",
+			       sk->sk_protocol, nlh->nlmsg_type,
+			       secclass_map[sksec->sclass - 1].name);
 			if (!selinux_enforcing || security_get_allow_unknown())
 				err = 0;
 		}