lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 5 Sep 2020 22:45:57 -0400 From: Paul Moore <paul@...l-moore.com> To: Casey Schaufler <casey@...aufler-ca.com> Cc: casey.schaufler@...el.com, James Morris <jmorris@...ei.org>, linux-security-module@...r.kernel.org, selinux@...r.kernel.org, linux-audit@...hat.com, keescook@...omium.org, john.johansen@...onical.com, penguin-kernel@...ove.sakura.ne.jp, Stephen Smalley <sds@...ho.nsa.gov>, linux-integrity@...r.kernel.org, netdev@...r.kernel.org Subject: Re: [PATCH v20 14/23] LSM: Ensure the correct LSM context releaser On Wed, Aug 26, 2020 at 11:16 AM Casey Schaufler <casey@...aufler-ca.com> wrote: > > Add a new lsmcontext data structure to hold all the information > about a "security context", including the string, its size and > which LSM allocated the string. The allocation information is > necessary because LSMs have different policies regarding the > lifecycle of these strings. SELinux allocates and destroys > them on each use, whereas Smack provides a pointer to an entry > in a list that never goes away. > > Reviewed-by: Kees Cook <keescook@...omium.org> > Reviewed-by: John Johansen <john.johansen@...onical.com> > Acked-by: Stephen Smalley <sds@...ho.nsa.gov> > Signed-off-by: Casey Schaufler <casey@...aufler-ca.com> > Cc: linux-integrity@...r.kernel.org > Cc: netdev@...r.kernel.org > --- > drivers/android/binder.c | 10 ++++--- > fs/ceph/xattr.c | 6 ++++- > fs/nfs/nfs4proc.c | 8 ++++-- > fs/nfsd/nfs4xdr.c | 7 +++-- > include/linux/security.h | 35 +++++++++++++++++++++++-- > include/net/scm.h | 5 +++- > kernel/audit.c | 14 +++++++--- > kernel/auditsc.c | 12 ++++++--- > net/ipv4/ip_sockglue.c | 4 ++- > net/netfilter/nf_conntrack_netlink.c | 4 ++- > net/netfilter/nf_conntrack_standalone.c | 4 ++- > net/netfilter/nfnetlink_queue.c | 13 ++++++--- > net/netlabel/netlabel_unlabeled.c | 19 +++++++++++--- > net/netlabel/netlabel_user.c | 4 ++- > security/security.c | 11 ++++---- > 15 files changed, 121 insertions(+), 35 deletions(-) One small comment below, but otherwise ... Acked-by: Paul Moore <paul@...l-moore.com> > +/** > + * lsmcontext_init - initialize an lsmcontext structure. > + * @cp: Pointer to the context to initialize > + * @context: Initial context, or NULL > + * @size: Size of context, or 0 > + * @slot: Which LSM provided the context > + * > + * Fill in the lsmcontext from the provided information. > + * This is a scaffolding function that will be removed when > + * lsmcontext integration is complete. > + */ > +static inline void lsmcontext_init(struct lsmcontext *cp, char *context, > + u32 size, int slot) > +{ > + cp->slot = slot; > + cp->context = context; > + cp->len = size; > +} Here is another case where some of the intermediate code, and perhaps some of the final code, can probably be simplified if lsmcontext_init() returns the lsmcontext pointer. -- paul moore www.paul-moore.com
Powered by blists - more mailing lists