| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aa6c6f4c-7d46-4e7e-bafc-f042436f47b6@schaufler-ca.com>
Date: Thu, 20 Feb 2025 07:35:07 -0800
From: Casey Schaufler <casey@...aufler-ca.com>
To: linux@...blig.org, paul@...l-moore.com, davem@...emloft.net,
edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, horms@...nel.org
Cc: linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH net-next] netlabel: Remove unused cfg_calipso funcs
On 2/20/2025 6:08 AM, linux@...blig.org wrote:
> From: "Dr. David Alan Gilbert" <linux@...blig.org>
>
> netlbl_cfg_calipso_map_add(), netlbl_cfg_calipso_add() and
> netlbl_cfg_calipso_del() were added in 2016 as part of
> commit 3f09354ac84c ("netlabel: Implement CALIPSO config functions for
> SMACK.")
>
> Remove them.
Please don't. The Smack CALIPSO implementation has been delayed
for a number of reasons, some better than others, but is still on
the roadmap.
>
> (I see a few other changes in that original commit, whether they
> are reachable I'm not sure).
>
> Signed-off-by: Dr. David Alan Gilbert <linux@...blig.org>
> ---
> include/net/netlabel.h | 26 -------
> net/netlabel/netlabel_kapi.c | 133 -----------------------------------
> 2 files changed, 159 deletions(-)
>
> diff --git a/include/net/netlabel.h b/include/net/netlabel.h
> index 02914b1df38b..37c9bcfd5345 100644
> --- a/include/net/netlabel.h
> +++ b/include/net/netlabel.h
> @@ -435,14 +435,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
> const struct in_addr *addr,
> const struct in_addr *mask,
> struct netlbl_audit *audit_info);
> -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> - struct netlbl_audit *audit_info);
> -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
> -int netlbl_cfg_calipso_map_add(u32 doi,
> - const char *domain,
> - const struct in6_addr *addr,
> - const struct in6_addr *mask,
> - struct netlbl_audit *audit_info);
> /*
> * LSM security attribute operations
> */
> @@ -561,24 +553,6 @@ static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
> {
> return -ENOSYS;
> }
> -static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> - struct netlbl_audit *audit_info)
> -{
> - return -ENOSYS;
> -}
> -static inline void netlbl_cfg_calipso_del(u32 doi,
> - struct netlbl_audit *audit_info)
> -{
> - return;
> -}
> -static inline int netlbl_cfg_calipso_map_add(u32 doi,
> - const char *domain,
> - const struct in6_addr *addr,
> - const struct in6_addr *mask,
> - struct netlbl_audit *audit_info)
> -{
> - return -ENOSYS;
> -}
> static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
> u32 offset)
> {
> diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
> index cd9160bbc919..13b4bc1c30ec 100644
> --- a/net/netlabel/netlabel_kapi.c
> +++ b/net/netlabel/netlabel_kapi.c
> @@ -394,139 +394,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
> return ret_val;
> }
>
> -/**
> - * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
> - * @doi_def: CALIPSO DOI definition
> - * @audit_info: NetLabel audit information
> - *
> - * Description:
> - * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on
> - * success and negative values on failure.
> - *
> - */
> -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> - struct netlbl_audit *audit_info)
> -{
> -#if IS_ENABLED(CONFIG_IPV6)
> - return calipso_doi_add(doi_def, audit_info);
> -#else /* IPv6 */
> - return -ENOSYS;
> -#endif /* IPv6 */
> -}
> -
> -/**
> - * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
> - * @doi: CALIPSO DOI
> - * @audit_info: NetLabel audit information
> - *
> - * Description:
> - * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on
> - * success and negative values on failure.
> - *
> - */
> -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
> -{
> -#if IS_ENABLED(CONFIG_IPV6)
> - calipso_doi_remove(doi, audit_info);
> -#endif /* IPv6 */
> -}
> -
> -/**
> - * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
> - * @doi: the CALIPSO DOI
> - * @domain: the domain mapping to add
> - * @addr: IP address
> - * @mask: IP address mask
> - * @audit_info: NetLabel audit information
> - *
> - * Description:
> - * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
> - * NetLabel subsystem. A @domain value of NULL adds a new default domain
> - * mapping. Returns zero on success, negative values on failure.
> - *
> - */
> -int netlbl_cfg_calipso_map_add(u32 doi,
> - const char *domain,
> - const struct in6_addr *addr,
> - const struct in6_addr *mask,
> - struct netlbl_audit *audit_info)
> -{
> -#if IS_ENABLED(CONFIG_IPV6)
> - int ret_val = -ENOMEM;
> - struct calipso_doi *doi_def;
> - struct netlbl_dom_map *entry;
> - struct netlbl_domaddr_map *addrmap = NULL;
> - struct netlbl_domaddr6_map *addrinfo = NULL;
> -
> - doi_def = calipso_doi_getdef(doi);
> - if (doi_def == NULL)
> - return -ENOENT;
> -
> - entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
> - if (entry == NULL)
> - goto out_entry;
> - entry->family = AF_INET6;
> - if (domain != NULL) {
> - entry->domain = kstrdup(domain, GFP_ATOMIC);
> - if (entry->domain == NULL)
> - goto out_domain;
> - }
> -
> - if (addr == NULL && mask == NULL) {
> - entry->def.calipso = doi_def;
> - entry->def.type = NETLBL_NLTYPE_CALIPSO;
> - } else if (addr != NULL && mask != NULL) {
> - addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
> - if (addrmap == NULL)
> - goto out_addrmap;
> - INIT_LIST_HEAD(&addrmap->list4);
> - INIT_LIST_HEAD(&addrmap->list6);
> -
> - addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
> - if (addrinfo == NULL)
> - goto out_addrinfo;
> - addrinfo->def.calipso = doi_def;
> - addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
> - addrinfo->list.addr = *addr;
> - addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
> - addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
> - addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
> - addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
> - addrinfo->list.mask = *mask;
> - addrinfo->list.valid = 1;
> - ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
> - if (ret_val != 0)
> - goto cfg_calipso_map_add_failure;
> -
> - entry->def.addrsel = addrmap;
> - entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
> - } else {
> - ret_val = -EINVAL;
> - goto out_addrmap;
> - }
> -
> - ret_val = netlbl_domhsh_add(entry, audit_info);
> - if (ret_val != 0)
> - goto cfg_calipso_map_add_failure;
> -
> - return 0;
> -
> -cfg_calipso_map_add_failure:
> - kfree(addrinfo);
> -out_addrinfo:
> - kfree(addrmap);
> -out_addrmap:
> - kfree(entry->domain);
> -out_domain:
> - kfree(entry);
> -out_entry:
> - calipso_doi_putdef(doi_def);
> - return ret_val;
> -#else /* IPv6 */
> - return -ENOSYS;
> -#endif /* IPv6 */
> -}
> -
> /*
> * Security Attribute Functions
> */
Powered by blists - more mailing lists