| Message ID | 20190903180134.16176-1-efremov@linux.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Smack: Move request_buffer from stack to smack_audit_data | expand |
On 9/3/2019 11:01 AM, Denis Efremov wrote: > request_buffer is required to describe an access type in a string for > the audit. The problem here is that the string is saved on the stack > and then passed by reference to the next function in request field of > the smack_audit_data structure. Referencing variables on a stack > and saving them in external data structures is usually considered > as bad and error-prone practice. You're adding space to the smack_audit_data structure on the off chance that the stack might disappear out from under something this function is calling. If you trace the code path, you'll find that doesn't happen. I can't say that I see any real value to this change. > Thus, this commit simply moves > the request_buffer from the stack to the stack_audit_data structure > and removes the necessity of stack referencing. strcat calls are > replaced with strlcat calls - a safer analog for strings concatenation > with bounds checking. Changing strcat to strlcat (or any variant, for that matter) when the source is a string constant and the destination size is known is completely pointless. > > Signed-off-by: Denis Efremov <efremov@linux.com> I appreciate the intention, but I don't see any real value here. I won't be taking this. > --- > security/smack/smack.h | 6 +++++- > security/smack/smack_access.c | 12 +++--------- > 2 files changed, 8 insertions(+), 10 deletions(-) > > diff --git a/security/smack/smack.h b/security/smack/smack.h > index 62529f382942..9eeefb865dfd 100644 > --- a/security/smack/smack.h > +++ b/security/smack/smack.h > @@ -278,7 +278,11 @@ struct smack_audit_data { > const char *function; > char *subject; > char *object; > - char *request; > +#ifdef CONFIG_SECURITY_SMACK_BRINGUP > + char request[SMK_NUM_ACCESS_TYPE + 5]; > +#else > + char request[SMK_NUM_ACCESS_TYPE + 1]; > +#endif > int result; > }; > > diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c > index f1c93a7be9ec..99e58d4a9980 100644 > --- a/security/smack/smack_access.c > +++ b/security/smack/smack_access.c > @@ -340,11 +340,6 @@ static void smack_log_callback(struct audit_buffer *ab, void *a) > void smack_log(char *subject_label, char *object_label, int request, > int result, struct smk_audit_info *ad) > { > -#ifdef CONFIG_SECURITY_SMACK_BRINGUP > - char request_buffer[SMK_NUM_ACCESS_TYPE + 5]; > -#else > - char request_buffer[SMK_NUM_ACCESS_TYPE + 1]; > -#endif > struct smack_audit_data *sad; > struct common_audit_data *a = &ad->a; > > @@ -360,7 +355,7 @@ void smack_log(char *subject_label, char *object_label, int request, > sad->function = "unknown"; > > /* end preparing the audit data */ > - smack_str_from_perm(request_buffer, request); > + smack_str_from_perm(sad->request, request); > sad->subject = subject_label; > sad->object = object_label; > #ifdef CONFIG_SECURITY_SMACK_BRINGUP > @@ -371,14 +366,13 @@ void smack_log(char *subject_label, char *object_label, int request, > * the logging policy says to do so. > */ > if (result == SMACK_UNCONFINED_SUBJECT) > - strcat(request_buffer, "(US)"); > + strlcat(sad->request, "(US)", sizeof(sad->request)); Have you ever heard of a C compiler that would not correctly terminate a constant string? I've been using them for over 40 years and have never seen a case where this was a problem. > else if (result == SMACK_UNCONFINED_OBJECT) > - strcat(request_buffer, "(UO)"); > + strlcat(sad->request, "(UO)", sizeof(sad->request)); > > if (result > 0) > result = 0; > #endif > - sad->request = request_buffer; > sad->result = result; > > common_lsm_audit(a, smack_log_callback, NULL);
diff --git a/security/smack/smack.h b/security/smack/smack.h index 62529f382942..9eeefb865dfd 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -278,7 +278,11 @@ struct smack_audit_data { const char *function; char *subject; char *object; - char *request; +#ifdef CONFIG_SECURITY_SMACK_BRINGUP + char request[SMK_NUM_ACCESS_TYPE + 5]; +#else + char request[SMK_NUM_ACCESS_TYPE + 1]; +#endif int result; }; diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index f1c93a7be9ec..99e58d4a9980 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -340,11 +340,6 @@ static void smack_log_callback(struct audit_buffer *ab, void *a) void smack_log(char *subject_label, char *object_label, int request, int result, struct smk_audit_info *ad) { -#ifdef CONFIG_SECURITY_SMACK_BRINGUP - char request_buffer[SMK_NUM_ACCESS_TYPE + 5]; -#else - char request_buffer[SMK_NUM_ACCESS_TYPE + 1]; -#endif struct smack_audit_data *sad; struct common_audit_data *a = &ad->a; @@ -360,7 +355,7 @@ void smack_log(char *subject_label, char *object_label, int request, sad->function = "unknown"; /* end preparing the audit data */ - smack_str_from_perm(request_buffer, request); + smack_str_from_perm(sad->request, request); sad->subject = subject_label; sad->object = object_label; #ifdef CONFIG_SECURITY_SMACK_BRINGUP @@ -371,14 +366,13 @@ void smack_log(char *subject_label, char *object_label, int request, * the logging policy says to do so. */ if (result == SMACK_UNCONFINED_SUBJECT) - strcat(request_buffer, "(US)"); + strlcat(sad->request, "(US)", sizeof(sad->request)); else if (result == SMACK_UNCONFINED_OBJECT) - strcat(request_buffer, "(UO)"); + strlcat(sad->request, "(UO)", sizeof(sad->request)); if (result > 0) result = 0; #endif - sad->request = request_buffer; sad->result = result; common_lsm_audit(a, smack_log_callback, NULL);
request_buffer is required to describe an access type in a string for the audit. The problem here is that the string is saved on the stack and then passed by reference to the next function in request field of the smack_audit_data structure. Referencing variables on a stack and saving them in external data structures is usually considered as bad and error-prone practice. Thus, this commit simply moves the request_buffer from the stack to the stack_audit_data structure and removes the necessity of stack referencing. strcat calls are replaced with strlcat calls - a safer analog for strings concatenation with bounds checking. Signed-off-by: Denis Efremov <efremov@linux.com> --- security/smack/smack.h | 6 +++++- security/smack/smack_access.c | 12 +++--------- 2 files changed, 8 insertions(+), 10 deletions(-)