netdev - Re: [PATCHv2 2/2] selinux: add gfp argument to security_xfrm_policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 10 Mar 2014 13:52:03 +0100
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Paul Moore <paul@...l-moore.com>
CC:	Nikolay Aleksandrov <nikolay@...hat.com>, <netdev@...r.kernel.org>,
	Dave Jones <davej@...hat.com>, Fan Du <fan.du@...driver.com>,
	"David S. Miller" <davem@...emloft.net>,
	LSM list <linux-security-module@...r.kernel.org>,
	SELinux list <selinux@...ho.nsa.gov>
Subject: Re: [PATCHv2 2/2] selinux: add gfp argument to
 security_xfrm_policy_alloc and fix callers

On Fri, Mar 07, 2014 at 05:27:17PM -0500, Paul Moore wrote:
> On Friday, March 07, 2014 12:44:19 PM Nikolay Aleksandrov wrote:
> > security_xfrm_policy_alloc can be called in atomic context so the
> > allocation should be done with GFP_ATOMIC. Add an argument to let the
> > callers choose the appropriate way. In order to do so a gfp argument
> > needs to be added to the method xfrm_policy_alloc_security in struct
> > security_operations and to the internal function
> > selinux_xfrm_alloc_user. After that switch to GFP_ATOMIC in the atomic
> > callers and leave GFP_KERNEL as before for the rest.
> > The path that needed the gfp argument addition is:
> > security_xfrm_policy_alloc -> security_ops.xfrm_policy_alloc_security ->
> > all users of xfrm_policy_alloc_security (e.g. selinux_xfrm_policy_alloc) ->
> > selinux_xfrm_alloc_user (here the allocation used to be GFP_KERNEL only)
> > 
> > Now adding a gfp argument to selinux_xfrm_alloc_user requires us to also
> > add it to security_context_to_sid which is used inside and prior to this
> > patch did only GFP_KERNEL allocation. So add gfp argument to
> > security_context_to_sid and adjust all of its callers as well.
> > 
> > CC: Paul Moore <paul@...l-moore.com>
> > CC: Dave Jones <davej@...hat.com>
> > CC: Steffen Klassert <steffen.klassert@...unet.com>
> > CC: Fan Du <fan.du@...driver.com>
> > CC: David S. Miller <davem@...emloft.net>
> > CC: LSM list <linux-security-module@...r.kernel.org>
> > CC: SELinux list <selinux@...ho.nsa.gov>
> > 
> > Signed-off-by: Nikolay Aleksandrov <nikolay@...hat.com>
> 
> This looks good to me, thanks for finding this and following through with a 
> patch.
> 
> Acked-by: Paul Moore <paul@...l-moore.com>
> 

Both patches applied to the ipsec tree.

Thanks everyone!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html