[55/97] LSM: Use lsm_context in security_secid_to_secctx

Message ID	20190228221933.2551-56-casey@schaufler-ca.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 55/97] LSM: Use lsm_context in security_secid_to_secctx Date: Thu, 28 Feb 2019 14:18:51 -0800 Message-Id: <20190228221933.2551-56-casey@schaufler-ca.com> In-Reply-To: <20190228221933.2551-1-casey@schaufler-ca.com> References: <20190228221933.2551-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk
Series	LSM: Complete module stacking \| expand [00/97] LSM: Complete module stacking [01/97] LSM: Infrastructure management of the superblock [02/97] LSM: Infrastructure management of the sock security [03/97] LSM: Infrastructure management of the key security blob [04/97] SCAFFOLD: Move sock_graft out of sock.h [05/97] LSM: Create an lsm_export data structure. [06/97] LSM: Use lsm_export in the inode_getsecid hooks [07/97] SCAFFOLD: Move security.h out of route.h [08/97] LSM: Use lsm_export in the cred_getsecid hooks [09/97] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks [10/97] LSM: Use lsm_export in the sk_getsecid hooks [11/97] LSM: Use lsm_export in the kernel_ask_as hooks [12/97] LSM: Use lsm_export in the getpeersec_dgram hooks [13/97] LSM: Use lsm_export in the audit_rule_match hooks [14/97] LSM: Fix logical operation in lsm_export checks [15/97] LSM: Use lsm_export in the secid_to_secctx hooks [16/97] LSM: Use lsm_export in the secctx_to_secid hooks [17/97] LSM: Use lsm_export in security_audit_rule_match [18/97] LSM: Use lsm_export in security_kernel_act_as [19/97] LSM: Use lsm_export in security_socket_getpeersec_dgram [20/97] LSM: Use lsm_export in security_secctx_to_secid [21/97] LSM: Use lsm_export in security_secid_to_secctx [22/97] LSM: Use lsm_export in security_ipc_getsecid [23/97] LSM: Use lsm_export in security_task_getsecid [24/97] LSM: FIXUP - security_secctx_to_secid [25/97] LSM: FIXUP - security_secid_to_secctx [26/97] LSM: Use lsm_export in security_inode_getsecid [27/97] LSM: Use lsm_export in security_cred_getsecid [28/97] LSM: REVERT Use lsm_export in the sk_getsecid hooks [29/97] Audit: Change audit_sig_sid to audit_sig_lsm [30/97] Audit: Convert target_sid to an lsm_export structure [31/97] Audit: Convert osid to an lsm_export structure [32/97] IMA: Clean out lsm_export scaffolding [33/97] NET: Store LSM access information in the socket blob for UDS [34/97] NET: Remove scaffolding on secmarks [35/97] NET: Remove scaffolding on new secmarks [36/97] NET: Remove netfilter scaffolding for lsm_export [37/97] Netlabel: Replace secids with lsm_export [38/97] LSM: Remove lsm_export scaffolding functions [39/97] IMA: FIXUP prototype using lsm_export [40/97] Smack: Restore the release_secctx hook [41/97] AppArmor: Remove unnecessary hook stub [42/97] LSM: Limit calls to certain module hooks [43/97] LSM: Create a data structure for a security context [44/97] LSM: Use lsm_context in secid_to_secctx hooks [45/97] LSM: Use lsm_context in secctx_to_secid hooks [46/97] LSM: Use lsm_context in inode_getsecctx hooks [47/97] LSM: Use lsm_context in inode_notifysecctx hooks [48/97] LSM: Use lsm_context in dentry_init_security hooks [49/97] LSM: Use lsm_context in security_dentry_init_security [50/97] LSM: Use lsm_context in security_inode_notifysecctx [51/97] LSM: Use lsm_context in security_inode_getsecctx [52/97] LSM: Use lsm_context in security_secctx_to_secid [53/97] LSM: Use lsm_context in release_secctx hooks [54/97] LSM: Use lsm_context in security_release_secctx [55/97] LSM: Use lsm_context in security_secid_to_secctx [56/97] fs: remove lsm_context scaffolding [57/97] LSM: Add the release function to the lsm_context [58/97] LSM: Use lsm_context in inode_setsecctx hooks [59/97] LSM: Use lsm_context in security_inode_setsecctx [60/97] kernfs: remove lsm_context scaffolding [61/97] LSM: Remove unused macro [62/97] LSM: Special handling for secctx lsm hooks [63/97] SELinux: Use blob offset in current_sid [64/97] LSM: Specify which LSM to display with /proc/self/attr/display [65/97] AppArmor: Remove the exclusive flag [66/97] LSM: Add secmark_relabel_packet to the set of one call hooks [67/97] LSM: Make getting the secmark right cleaner with lsm_export_one_secid [68/97] netfilter: Fix memory leak introduced with lsm_context [69/97] Smack: Consolidate secmark conversions [70/97] netfilter: Remove unnecessary NULL check in lsm_context

diff --git a/include/linux/security.h b/include/linux/security.h index b5c03e326e32..46cc16a67212 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -81,10 +81,11 @@ struct lsm_export { u32 apparmor; u32 flags; }; -#define LSM_EXPORT_NONE 0x00 -#define LSM_EXPORT_SELINUX 0x01 -#define LSM_EXPORT_SMACK 0x02 -#define LSM_EXPORT_APPARMOR 0x04 +#define LSM_EXPORT_NONE 0x00000000 +#define LSM_EXPORT_SELINUX 0x00000001 +#define LSM_EXPORT_SMACK 0x00000002 +#define LSM_EXPORT_APPARMOR 0x00000004 +#define LSM_EXPORT_LENGTH 0x80000000 /* Only the length required */ static inline void lsm_export_init(struct lsm_export *l) { @@ -428,7 +429,7 @@ int security_setprocattr(const char *lsm, const char *name, void *value, size_t size); int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_ismaclabel(const char *name); -int security_secid_to_secctx(struct lsm_export *l, char **secdata, u32 *seclen); +int security_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp); int security_secctx_to_secid(struct lsm_context *cp, struct lsm_export *l); void security_release_secctx(struct lsm_context *cp); @@ -1197,7 +1198,7 @@ static inline int security_ismaclabel(const char *name) } static inline int security_secid_to_secctx(struct lsm_export *l, - char **secdata, u32 *seclen) + struct lsm_seccontext *cp) { return -EOPNOTSUPP; } diff --git a/include/net/scm.h b/include/net/scm.h index 7e242ebdd258..b25ca3b6a514 100644 --- a/include/net/scm.h +++ b/include/net/scm.h @@ -96,7 +96,7 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc int err; if (test_bit(SOCK_PASSSEC, &sock->flags)) { - err = security_secid_to_secctx(&scm->le, &lc.context, &lc.len); + err = security_secid_to_secctx(&scm->le, &lc); if (!err) { put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, diff --git a/kernel/audit.c b/kernel/audit.c index 55b9431489fc..87e5f6fffb7b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1416,8 +1416,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) } case AUDIT_SIGNAL_INFO: if (lsm_export_any(&audit_sig_lsm)) { - err = security_secid_to_secctx(&audit_sig_lsm, - &lc.context, &lc.len); + err = security_secid_to_secctx(&audit_sig_lsm, &lc); if (err) return err; } @@ -2166,7 +2165,7 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, if (lsm_export_any(&n->olsm)) { struct lsm_context lc; - if (security_secid_to_secctx(&n->olsm, &lc.context, &lc.len)) { + if (security_secid_to_secctx(&n->olsm, &lc)) { audit_log_format(ab, " osid=(unknown)"); if (call_panic) *call_panic = 2; @@ -2209,7 +2208,7 @@ int audit_log_task_context(struct audit_buffer *ab) if (!lsm_export_any(&le)) return 0; - error = security_secid_to_secctx(&le, &lc.context, &lc.len); + error = security_secid_to_secctx(&le, &lc); if (error) { if (error != -EINVAL) goto error_path; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 797a9f1847cb..8e48053d4a74 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -935,7 +935,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, unsigned int sessionid, struct lsm_export *l, char *comm) { - struct lsm_context lc = { .context = NULL, }; + struct lsm_context lc; struct audit_buffer *ab; int rc = 0; @@ -947,7 +947,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, from_kuid(&init_user_ns, auid), from_kuid(&init_user_ns, uid), sessionid); if (lsm_export_any(l)) { - if (security_secid_to_secctx(l, &lc.context, &lc.len)) { + if (security_secid_to_secctx(l, &lc)) { audit_log_format(ab, " obj=(none)"); rc = 1; } else { @@ -1161,8 +1161,8 @@ static void show_special(struct audit_context *context, int *call_panic) from_kgid(&init_user_ns, context->ipc.gid), context->ipc.mode); if (lsm_export_any(l)) { - struct lsm_context lc = { .context = NULL, }; - if (security_secid_to_secctx(l, &lc.context, &lc.len)) { + struct lsm_context lc; + if (security_secid_to_secctx(l, &lc)) { audit_log_format(ab, " osid=(unknown)"); *call_panic = 1; } else { diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 18a7fab8b2d3..56035b53952d 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -138,7 +138,7 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) if (err) return; - err = security_secid_to_secctx(&le, &lc.context, &lc.len); + err = security_secid_to_secctx(&le, &lc); if (err) return; diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 03c3488a37d8..72aeba0de49c 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -337,7 +337,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) le.selinux = ct->secmark; le.smack = ct->secmark; - ret = security_secid_to_secctx(&le, &lc.context, &lc.len); + ret = security_secid_to_secctx(&le, &lc); if (ret) return 0; @@ -622,18 +622,19 @@ static inline int ctnetlink_secctx_size(const struct nf_conn *ct) #ifdef CONFIG_NF_CONNTRACK_SECMARK int len, ret; struct lsm_export le; + struct lsm_context lc; lsm_export_init(&le); - le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; + le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK | LSM_EXPORT_LENGTH; le.selinux = ct->secmark; le.smack = ct->secmark; - ret = security_secid_to_secctx(&le, NULL, &len); + ret = security_secid_to_secctx(&le, &lc); if (ret) return 0; return nla_total_size(0) /* CTA_SECCTX */ - + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */ + + nla_total_size(sizeof(char) * lc.len); /* CTA_SECCTX_NAME */ #else return 0; #endif diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index e1a8eaa3a62d..8574a5611823 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -178,7 +178,7 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) le.selinux = ct->secmark; le.smack = ct->secmark; - ret = security_secid_to_secctx(&le, &lc.context, &lc.len); + ret = security_secid_to_secctx(&le, &lc); if (ret) return; diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index b70871693368..4a3d4b52caef 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -322,7 +322,7 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata) le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; le.selinux = skb->secmark; le.smack = skb->secmark; - security_secid_to_secctx(&le, &lc.context, &lc.len); + security_secid_to_secctx(&le, &lc); *secdata = lc.context; } diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 19cdcf58683d..f01c97eb6285 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -450,7 +450,7 @@ int netlbl_unlhsh_add(struct net *net, rcu_read_unlock(); if (audit_buf != NULL) { struct lsm_context lc; - if (security_secid_to_secctx(l, &lc.context, &lc.len) == 0) { + if (security_secid_to_secctx(l, &lc) == 0) { audit_log_format(audit_buf, " sec_obj=%s", lc.context); security_release_secctx(&lc); } @@ -504,8 +504,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, if (dev != NULL) dev_put(dev); if (entry != NULL && - security_secid_to_secctx(&entry->le, - &lc.context, &lc.len) == 0) { + security_secid_to_secctx(&entry->le, &lc) == 0) { audit_log_format(audit_buf, " sec_obj=%s", lc.context); security_release_secctx(&lc); } @@ -566,8 +565,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, if (dev != NULL) dev_put(dev); if (entry != NULL && - security_secid_to_secctx(&entry->le, - &lc.context, &lc.len) == 0) { + security_secid_to_secctx(&entry->le, &lc) == 0) { audit_log_format(audit_buf, " sec_obj=%s", lc.context); security_release_secctx(&lc); } @@ -1137,7 +1135,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd, lep = &addr6->le; } - ret_val = security_secid_to_secctx(lep, &lc.context, &lc.len); + ret_val = security_secid_to_secctx(lep, &lc); if (ret_val != 0) goto list_cb_failure; ret_val = nla_put(cb_arg->skb, diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c index 0418f0935199..11ea98525c4e 100644 --- a/net/netlabel/netlabel_user.c +++ b/net/netlabel/netlabel_user.c @@ -112,8 +112,7 @@ struct audit_buffer *netlbl_audit_start_common(int type, audit_info->sessionid); if (lsm_export_any(&audit_info->le) && - security_secid_to_secctx(&audit_info->le, &lc.context, - &lc.len) == 0) { + security_secid_to_secctx(&audit_info->le, &lc) == 0) { audit_log_format(audit_buf, " subj=%s", lc.context); security_release_secctx(&lc); } diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 46c8b9a67ac7..9dc17903a936 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -92,8 +92,7 @@ int apparmor_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) if (!label) return -EINVAL; - /* scaffolding check - Casey */ - if (cp) + if (!(l->flags & LSM_EXPORT_LENGTH)) len = aa_label_asxprint(&cp->context, root_ns, label, FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, diff --git a/security/security.c b/security/security.c index 4f0c7d2cd1dd..2b2520ba9554 100644 --- a/security/security.c +++ b/security/security.c @@ -1973,18 +1973,9 @@ int security_ismaclabel(const char *name) } EXPORT_SYMBOL(security_ismaclabel); -int security_secid_to_secctx(struct lsm_export *l, char **secdata, u32 *seclen) +int security_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) { - struct lsm_context lc = { .context = NULL, .len = 0, }; - int rc; - - rc = call_one_int_hook(secid_to_secctx, -EOPNOTSUPP, l, &lc); - if (secdata) - *secdata = lc.context; - else - security_release_secctx(&lc); - *seclen = lc.len; - return rc; + return call_one_int_hook(secid_to_secctx, -EOPNOTSUPP, l, cp); } EXPORT_SYMBOL(security_secid_to_secctx); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index ea9603b63f77..07213ae8929f 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6199,6 +6199,9 @@ static int selinux_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) u32 secid; selinux_import_secid(l, &secid); + if (l->flags & LSM_EXPORT_LENGTH) + return security_sid_to_context(&selinux_state, secid, + NULL, &cp->len); return security_sid_to_context(&selinux_state, secid, &cp->context, &cp->len); } diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 332ac71e8a41..1861587b3620 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4357,7 +4357,7 @@ static int smack_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) smack_import_secid(l, &secid); skp = smack_from_secid(secid); - cp->context = skp->smk_known; + cp->context = (l->flags & LSM_EXPORT_LENGTH) ? NULL : skp->smk_known; cp->len = strlen(skp->smk_known); return 0; }

[55/97] LSM: Use lsm_context in security_secid_to_secctx

Commit Message

Patch