| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241014151450.73674-7-casey@schaufler-ca.com>
Date: Mon, 14 Oct 2024 08:14:50 -0700
From: Casey Schaufler <casey@...aufler-ca.com>
To: casey@...aufler-ca.com,
paul@...l-moore.com,
linux-security-module@...r.kernel.org
Cc: jmorris@...ei.org,
serge@...lyn.com,
keescook@...omium.org,
john.johansen@...onical.com,
penguin-kernel@...ove.sakura.ne.jp,
stephen.smalley.work@...il.com,
linux-kernel@...r.kernel.org,
selinux@...r.kernel.org,
mic@...ikod.net
Subject: [PATCH v2 6/6] LSM: Use lsm_context in security_inode_notifysecctx
Use the lsm_context structure in the security_inode_notifysecctx()
interface. Its sole user is already using lsm_context to store
the data.
Signed-off-by: Casey Schaufler <casey@...aufler-ca.com>
---
fs/nfs/inode.c | 3 +--
include/linux/lsm_hook_defs.h | 3 ++-
include/linux/security.h | 4 ++--
security/security.c | 7 +++----
security/selinux/hooks.c | 5 +++--
security/smack/smack_lsm.c | 6 +++---
6 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index d00a6304133a..9bd38c0f3b09 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -359,8 +359,7 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr)
if ((fattr->valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL) && inode->i_security) {
error = security_inode_notifysecctx(inode,
- fattr->label->lsmctx.context,
- fattr->label->lsmctx.len);
+ &fattr->label->lsmctx);
if (error)
printk(KERN_ERR "%s() %s %d "
"security_inode_notifysecctx() %d\n",
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index e2f1ce37c41e..afadbce8bb60 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -301,7 +301,8 @@ LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop,
LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)
LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp)
LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
-LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
+LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode,
+ struct lsm_context *cp)
LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode,
struct lsm_context *cp)
diff --git a/include/linux/security.h b/include/linux/security.h
index 3ad59666e56c..6dcb0046531d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -570,7 +570,7 @@ int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp);
int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
void security_release_secctx(struct lsm_context *cp);
void security_inode_invalidate_secctx(struct inode *inode);
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
+int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp);
int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
int security_locked_down(enum lockdown_reason what);
@@ -1563,7 +1563,7 @@ static inline void security_inode_invalidate_secctx(struct inode *inode)
{
}
-static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static inline int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp);
{
return -EOPNOTSUPP;
}
diff --git a/security/security.c b/security/security.c
index 1d57e4e1bceb..c961edb0af57 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4387,8 +4387,7 @@ EXPORT_SYMBOL(security_inode_invalidate_secctx);
/**
* security_inode_notifysecctx() - Notify the LSM of an inode's security label
* @inode: inode
- * @ctx: secctx
- * @ctxlen: length of secctx
+ * @ctx: LSM context
*
* Notify the security module of what the security context of an inode should
* be. Initializes the incore security context managed by the security module
@@ -4399,9 +4398,9 @@ EXPORT_SYMBOL(security_inode_invalidate_secctx);
*
* Return: Returns 0 on success, error on failure.
*/
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp)
{
- return call_int_hook(inode_notifysecctx, inode, ctx, ctxlen);
+ return call_int_hook(inode_notifysecctx, inode, cp);
}
EXPORT_SYMBOL(security_inode_notifysecctx);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b9286c2c5efe..6aeb8468e568 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6656,10 +6656,11 @@ static void selinux_inode_invalidate_secctx(struct inode *inode)
/*
* called with inode->i_mutex locked
*/
-static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static int selinux_inode_notifysecctx(struct inode *inode,
+ struct lsm_context *cp)
{
int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
- ctx, ctxlen, 0);
+ cp->context, cp->len, 0);
/* Do not return error when suppressing label (SBLABEL_MNT not set). */
return rc == -EOPNOTSUPP ? 0 : rc;
}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c9ec4d93fb13..c5d7652395c1 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4887,10 +4887,10 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
* Now that there's a list such a hook adds cost.
*/
-static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static int smack_inode_notifysecctx(struct inode *inode, struct lsm_context *cp)
{
- return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
- ctxlen, 0);
+ return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, cp->context,
+ cp->len, 0);
}
static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
--
2.46.0
Powered by blists - more mailing lists