| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <91cc89cd-a9c0-4936-8449-1b9ac6273dfc@schaufler-ca.com>
Date: Thu, 20 Feb 2025 09:03:49 -0800
From: Casey Schaufler <casey@...aufler-ca.com>
To: "Dr. David Alan Gilbert" <linux@...blig.org>
Cc: paul@...l-moore.com, davem@...emloft.net, edumazet@...gle.com,
kuba@...nel.org, pabeni@...hat.com, horms@...nel.org,
linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH net-next] netlabel: Remove unused cfg_calipso funcs
On 2/20/2025 8:48 AM, Dr. David Alan Gilbert wrote:
> * Casey Schaufler (casey@...aufler-ca.com) wrote:
>> On 2/20/2025 6:08 AM, linux@...blig.org wrote:
>>> From: "Dr. David Alan Gilbert" <linux@...blig.org>
>>>
>>> netlbl_cfg_calipso_map_add(), netlbl_cfg_calipso_add() and
>>> netlbl_cfg_calipso_del() were added in 2016 as part of
>>> commit 3f09354ac84c ("netlabel: Implement CALIPSO config functions for
>>> SMACK.")
>>>
>>> Remove them.
>> Please don't. The Smack CALIPSO implementation has been delayed
>> for a number of reasons, some better than others, but is still on
>> the roadmap.
> Hmm OK.
> If it makes it to 10 years next year then perhaps it should hold
> a birthday party!
The difference between network and security developers is that a
network developer thinks 10 microseconds is a long time, while a
security developer thinks 10 years is no time at all.
>
> Dave
>
>>> (I see a few other changes in that original commit, whether they
>>> are reachable I'm not sure).
>>>
>>> Signed-off-by: Dr. David Alan Gilbert <linux@...blig.org>
>>> ---
>>> include/net/netlabel.h | 26 -------
>>> net/netlabel/netlabel_kapi.c | 133 -----------------------------------
>>> 2 files changed, 159 deletions(-)
>>>
>>> diff --git a/include/net/netlabel.h b/include/net/netlabel.h
>>> index 02914b1df38b..37c9bcfd5345 100644
>>> --- a/include/net/netlabel.h
>>> +++ b/include/net/netlabel.h
>>> @@ -435,14 +435,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
>>> const struct in_addr *addr,
>>> const struct in_addr *mask,
>>> struct netlbl_audit *audit_info);
>>> -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
>>> - struct netlbl_audit *audit_info);
>>> -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
>>> -int netlbl_cfg_calipso_map_add(u32 doi,
>>> - const char *domain,
>>> - const struct in6_addr *addr,
>>> - const struct in6_addr *mask,
>>> - struct netlbl_audit *audit_info);
>>> /*
>>> * LSM security attribute operations
>>> */
>>> @@ -561,24 +553,6 @@ static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
>>> {
>>> return -ENOSYS;
>>> }
>>> -static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
>>> - struct netlbl_audit *audit_info)
>>> -{
>>> - return -ENOSYS;
>>> -}
>>> -static inline void netlbl_cfg_calipso_del(u32 doi,
>>> - struct netlbl_audit *audit_info)
>>> -{
>>> - return;
>>> -}
>>> -static inline int netlbl_cfg_calipso_map_add(u32 doi,
>>> - const char *domain,
>>> - const struct in6_addr *addr,
>>> - const struct in6_addr *mask,
>>> - struct netlbl_audit *audit_info)
>>> -{
>>> - return -ENOSYS;
>>> -}
>>> static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
>>> u32 offset)
>>> {
>>> diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
>>> index cd9160bbc919..13b4bc1c30ec 100644
>>> --- a/net/netlabel/netlabel_kapi.c
>>> +++ b/net/netlabel/netlabel_kapi.c
>>> @@ -394,139 +394,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
>>> return ret_val;
>>> }
>>>
>>> -/**
>>> - * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
>>> - * @doi_def: CALIPSO DOI definition
>>> - * @audit_info: NetLabel audit information
>>> - *
>>> - * Description:
>>> - * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on
>>> - * success and negative values on failure.
>>> - *
>>> - */
>>> -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
>>> - struct netlbl_audit *audit_info)
>>> -{
>>> -#if IS_ENABLED(CONFIG_IPV6)
>>> - return calipso_doi_add(doi_def, audit_info);
>>> -#else /* IPv6 */
>>> - return -ENOSYS;
>>> -#endif /* IPv6 */
>>> -}
>>> -
>>> -/**
>>> - * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
>>> - * @doi: CALIPSO DOI
>>> - * @audit_info: NetLabel audit information
>>> - *
>>> - * Description:
>>> - * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on
>>> - * success and negative values on failure.
>>> - *
>>> - */
>>> -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
>>> -{
>>> -#if IS_ENABLED(CONFIG_IPV6)
>>> - calipso_doi_remove(doi, audit_info);
>>> -#endif /* IPv6 */
>>> -}
>>> -
>>> -/**
>>> - * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
>>> - * @doi: the CALIPSO DOI
>>> - * @domain: the domain mapping to add
>>> - * @addr: IP address
>>> - * @mask: IP address mask
>>> - * @audit_info: NetLabel audit information
>>> - *
>>> - * Description:
>>> - * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
>>> - * NetLabel subsystem. A @domain value of NULL adds a new default domain
>>> - * mapping. Returns zero on success, negative values on failure.
>>> - *
>>> - */
>>> -int netlbl_cfg_calipso_map_add(u32 doi,
>>> - const char *domain,
>>> - const struct in6_addr *addr,
>>> - const struct in6_addr *mask,
>>> - struct netlbl_audit *audit_info)
>>> -{
>>> -#if IS_ENABLED(CONFIG_IPV6)
>>> - int ret_val = -ENOMEM;
>>> - struct calipso_doi *doi_def;
>>> - struct netlbl_dom_map *entry;
>>> - struct netlbl_domaddr_map *addrmap = NULL;
>>> - struct netlbl_domaddr6_map *addrinfo = NULL;
>>> -
>>> - doi_def = calipso_doi_getdef(doi);
>>> - if (doi_def == NULL)
>>> - return -ENOENT;
>>> -
>>> - entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
>>> - if (entry == NULL)
>>> - goto out_entry;
>>> - entry->family = AF_INET6;
>>> - if (domain != NULL) {
>>> - entry->domain = kstrdup(domain, GFP_ATOMIC);
>>> - if (entry->domain == NULL)
>>> - goto out_domain;
>>> - }
>>> -
>>> - if (addr == NULL && mask == NULL) {
>>> - entry->def.calipso = doi_def;
>>> - entry->def.type = NETLBL_NLTYPE_CALIPSO;
>>> - } else if (addr != NULL && mask != NULL) {
>>> - addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
>>> - if (addrmap == NULL)
>>> - goto out_addrmap;
>>> - INIT_LIST_HEAD(&addrmap->list4);
>>> - INIT_LIST_HEAD(&addrmap->list6);
>>> -
>>> - addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
>>> - if (addrinfo == NULL)
>>> - goto out_addrinfo;
>>> - addrinfo->def.calipso = doi_def;
>>> - addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
>>> - addrinfo->list.addr = *addr;
>>> - addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
>>> - addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
>>> - addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
>>> - addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
>>> - addrinfo->list.mask = *mask;
>>> - addrinfo->list.valid = 1;
>>> - ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
>>> - if (ret_val != 0)
>>> - goto cfg_calipso_map_add_failure;
>>> -
>>> - entry->def.addrsel = addrmap;
>>> - entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
>>> - } else {
>>> - ret_val = -EINVAL;
>>> - goto out_addrmap;
>>> - }
>>> -
>>> - ret_val = netlbl_domhsh_add(entry, audit_info);
>>> - if (ret_val != 0)
>>> - goto cfg_calipso_map_add_failure;
>>> -
>>> - return 0;
>>> -
>>> -cfg_calipso_map_add_failure:
>>> - kfree(addrinfo);
>>> -out_addrinfo:
>>> - kfree(addrmap);
>>> -out_addrmap:
>>> - kfree(entry->domain);
>>> -out_domain:
>>> - kfree(entry);
>>> -out_entry:
>>> - calipso_doi_putdef(doi_def);
>>> - return ret_val;
>>> -#else /* IPv6 */
>>> - return -ENOSYS;
>>> -#endif /* IPv6 */
>>> -}
>>> -
>>> /*
>>> * Security Attribute Functions
>>> */
Powered by blists - more mailing lists