Skip to content

Commit ca661c5

Browse files
torvaldstorvalds
committed
Merge tag 'selinux-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux updates from Paul Moore: "Really only a few notable changes: - Continue the coding style/formatting fixup work This is the bulk of the diffstat in this pull request, with the focus this time around being the security/selinux/ss directory. We've only got a couple of files left to cleanup and once we're done with that we can start enabling some automatic style verfication and introduce tooling to help new folks format their code correctly. - Don't restrict xattr copy-up when SELinux policy is not loaded This helps systems that use overlayfs, or similar filesystems, preserve their SELinux labels during early boot when the SELinux policy has yet to be loaded. - Reduce the work we do during inode initialization time This isn't likely to show up in any benchmark results, but we removed an unnecessary SELinux object class lookup/calculation during inode initialization. - Correct the return values in selinux_socket_getpeersec_dgram() We had some inconsistencies with respect to our return values across selinux_socket_getpeersec_dgram() and selinux_socket_getpeersec_stream(). This provides a more uniform set of error codes across the two functions and should help make it easier for users to identify the source of a failure" * tag 'selinux-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: (24 commits) selinux: fix style issues in security/selinux/ss/symtab.c selinux: fix style issues in security/selinux/ss/symtab.h selinux: fix style issues in security/selinux/ss/sidtab.c selinux: fix style issues in security/selinux/ss/sidtab.h selinux: fix style issues in security/selinux/ss/services.h selinux: fix style issues in security/selinux/ss/policydb.c selinux: fix style issues in security/selinux/ss/policydb.h selinux: fix style issues in security/selinux/ss/mls_types.h selinux: fix style issues in security/selinux/ss/mls.c selinux: fix style issues in security/selinux/ss/mls.h selinux: fix style issues in security/selinux/ss/hashtab.c selinux: fix style issues in security/selinux/ss/hashtab.h selinux: fix style issues in security/selinux/ss/ebitmap.c selinux: fix style issues in security/selinux/ss/ebitmap.h selinux: fix style issues in security/selinux/ss/context.h selinux: fix style issues in security/selinux/ss/context.h selinux: fix style issues in security/selinux/ss/constraint.h selinux: fix style issues in security/selinux/ss/conditional.c selinux: fix style issues in security/selinux/ss/conditional.h selinux: fix style issues in security/selinux/ss/avtab.c ...
2 parents 9187210 + a1fc793 commit ca661c5

22 files changed

+724
-731
lines changed

‎security/selinux/hooks.c

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2920,23 +2920,22 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
29202920
struct superblock_security_struct *sbsec;
29212921
struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
29222922
u32 newsid, clen;
2923+
u16 newsclass;
29232924
int rc;
29242925
char *context;
29252926

29262927
sbsec = selinux_superblock(dir->i_sb);
29272928

29282929
newsid = tsec->create_sid;
2929-
2930-
rc = selinux_determine_inode_label(tsec, dir, qstr,
2931-
inode_mode_to_security_class(inode->i_mode),
2932-
&newsid);
2930+
newsclass = inode_mode_to_security_class(inode->i_mode);
2931+
rc = selinux_determine_inode_label(tsec, dir, qstr, newsclass, &newsid);
29332932
if (rc)
29342933
return rc;
29352934

29362935
/* Possibly defer initialization to selinux_complete_init. */
29372936
if (sbsec->flags & SE_SBINITIALIZED) {
29382937
struct inode_security_struct *isec = selinux_inode(inode);
2939-
isec->sclass = inode_mode_to_security_class(inode->i_mode);
2938+
isec->sclass = newsclass;
29402939
isec->sid = newsid;
29412940
isec->initialized = LABEL_INITIALIZED;
29422941
}
@@ -3534,9 +3533,10 @@ static int selinux_inode_copy_up_xattr(const char *name)
35343533
{
35353534
/* The copy_up hook above sets the initial context on an inode, but we
35363535
* don't then want to overwrite it by blindly copying all the lower
3537-
* xattrs up. Instead, we have to filter out SELinux-related xattrs.
3536+
* xattrs up. Instead, filter out SELinux-related xattrs following
3537+
* policy load.
35383538
*/
3539-
if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3539+
if (selinux_initialized() && strcmp(name, XATTR_NAME_SELINUX) == 0)
35403540
return 1; /* Discard */
35413541
/*
35423542
* Any other attribute apart from SELINUX is not claimed, supported
@@ -5194,31 +5194,33 @@ static int selinux_socket_getpeersec_stream(struct socket *sock,
51945194
return err;
51955195
}
51965196

5197-
static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5197+
static int selinux_socket_getpeersec_dgram(struct socket *sock,
5198+
struct sk_buff *skb, u32 *secid)
51985199
{
51995200
u32 peer_secid = SECSID_NULL;
52005201
u16 family;
5201-
struct inode_security_struct *isec;
52025202

52035203
if (skb && skb->protocol == htons(ETH_P_IP))
52045204
family = PF_INET;
52055205
else if (skb && skb->protocol == htons(ETH_P_IPV6))
52065206
family = PF_INET6;
52075207
else if (sock)
52085208
family = sock->sk->sk_family;
5209-
else
5210-
goto out;
5209+
else {
5210+
*secid = SECSID_NULL;
5211+
return -EINVAL;
5212+
}
52115213

52125214
if (sock && family == PF_UNIX) {
5215+
struct inode_security_struct *isec;
52135216
isec = inode_security_novalidate(SOCK_INODE(sock));
52145217
peer_secid = isec->sid;
52155218
} else if (skb)
52165219
selinux_skb_peerlbl_sid(skb, family, &peer_secid);
52175220

5218-
out:
52195221
*secid = peer_secid;
52205222
if (peer_secid == SECSID_NULL)
5221-
return -EINVAL;
5223+
return -ENOPROTOOPT;
52225224
return 0;
52235225
}
52245226

‎security/selinux/ss/avtab.c

Lines changed: 51 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,17 @@
1+
/* SPDX-License-Identifier: GPL-2.0-only */
12
/*
23
* Implementation of the access vector table type.
34
*
45
* Author : Stephen Smalley, <[email protected]>
56
*/
67

7-
/* Updated: Frank Mayer <[email protected]> and Karl MacMillan <[email protected]>
8-
*
9-
* Added conditional policy language extensions
10-
*
11-
* Copyright (C) 2003 Tresys Technology, LLC
12-
* This program is free software; you can redistribute it and/or modify
13-
* it under the terms of the GNU General Public License as published by
14-
* the Free Software Foundation, version 2.
8+
/* Updated: Frank Mayer <[email protected]> and
9+
* Karl MacMillan <[email protected]>
10+
* Added conditional policy language extensions
11+
* Copyright (C) 2003 Tresys Technology, LLC
1512
*
1613
* Updated: Yuichi Nakamura <[email protected]>
17-
* Tuned number of hash slots for avtab to reduce memory usage
14+
* Tuned number of hash slots for avtab to reduce memory usage
1815
*/
1916

2017
#include <linux/bitops.h>
@@ -36,19 +33,20 @@ static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask)
3633
static const u32 c2 = 0x1b873593;
3734
static const u32 r1 = 15;
3835
static const u32 r2 = 13;
39-
static const u32 m = 5;
40-
static const u32 n = 0xe6546b64;
36+
static const u32 m = 5;
37+
static const u32 n = 0xe6546b64;
4138

4239
u32 hash = 0;
4340

44-
#define mix(input) do { \
45-
u32 v = input; \
46-
v *= c1; \
47-
v = (v << r1) | (v >> (32 - r1)); \
48-
v *= c2; \
49-
hash ^= v; \
41+
#define mix(input) \
42+
do { \
43+
u32 v = input; \
44+
v *= c1; \
45+
v = (v << r1) | (v >> (32 - r1)); \
46+
v *= c2; \
47+
hash ^= v; \
5048
hash = (hash << r2) | (hash >> (32 - r2)); \
51-
hash = hash * m + n; \
49+
hash = hash * m + n; \
5250
} while (0)
5351

5452
mix(keyp->target_class);
@@ -66,9 +64,10 @@ static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask)
6664
return hash & mask;
6765
}
6866

69-
static struct avtab_node*
70-
avtab_insert_node(struct avtab *h, struct avtab_node **dst,
71-
const struct avtab_key *key, const struct avtab_datum *datum)
67+
static struct avtab_node *avtab_insert_node(struct avtab *h,
68+
struct avtab_node **dst,
69+
const struct avtab_key *key,
70+
const struct avtab_datum *datum)
7271
{
7372
struct avtab_node *newnode;
7473
struct avtab_extended_perms *xperms;
@@ -99,7 +98,7 @@ avtab_insert_node(struct avtab *h, struct avtab_node **dst,
9998
static int avtab_node_cmp(const struct avtab_key *key1,
10099
const struct avtab_key *key2)
101100
{
102-
u16 specified = key1->specified & ~(AVTAB_ENABLED|AVTAB_ENABLED_OLD);
101+
u16 specified = key1->specified & ~(AVTAB_ENABLED | AVTAB_ENABLED_OLD);
103102

104103
if (key1->source_type == key2->source_type &&
105104
key1->target_type == key2->target_type &&
@@ -129,8 +128,7 @@ static int avtab_insert(struct avtab *h, const struct avtab_key *key,
129128
return -EINVAL;
130129

131130
hvalue = avtab_hash(key, h->mask);
132-
for (prev = NULL, cur = h->htable[hvalue];
133-
cur;
131+
for (prev = NULL, cur = h->htable[hvalue]; cur;
134132
prev = cur, cur = cur->next) {
135133
cmp = avtab_node_cmp(key, &cur->key);
136134
/* extended perms may not be unique */
@@ -163,8 +161,7 @@ struct avtab_node *avtab_insert_nonunique(struct avtab *h,
163161
if (!h || !h->nslot || h->nel == U32_MAX)
164162
return NULL;
165163
hvalue = avtab_hash(key, h->mask);
166-
for (prev = NULL, cur = h->htable[hvalue];
167-
cur;
164+
for (prev = NULL, cur = h->htable[hvalue]; cur;
168165
prev = cur, cur = cur->next) {
169166
cmp = avtab_node_cmp(key, &cur->key);
170167
if (cmp <= 0)
@@ -188,8 +185,7 @@ struct avtab_node *avtab_search_node(struct avtab *h,
188185
return NULL;
189186

190187
hvalue = avtab_hash(key, h->mask);
191-
for (cur = h->htable[hvalue]; cur;
192-
cur = cur->next) {
188+
for (cur = h->htable[hvalue]; cur; cur = cur->next) {
193189
cmp = avtab_node_cmp(key, &cur->key);
194190
if (cmp == 0)
195191
return cur;
@@ -199,8 +195,8 @@ struct avtab_node *avtab_search_node(struct avtab *h,
199195
return NULL;
200196
}
201197

202-
struct avtab_node*
203-
avtab_search_node_next(struct avtab_node *node, u16 specified)
198+
struct avtab_node *avtab_search_node_next(struct avtab_node *node,
199+
u16 specified)
204200
{
205201
struct avtab_key tmp_key;
206202
struct avtab_node *cur;
@@ -314,17 +310,19 @@ void avtab_hash_eval(struct avtab *h, const char *tag)
314310

315311
if (chain_len > max_chain_len)
316312
max_chain_len = chain_len;
317-
chain2_len_sum += (unsigned long long)chain_len * chain_len;
313+
chain2_len_sum +=
314+
(unsigned long long)chain_len * chain_len;
318315
}
319316
}
320317

321318
pr_debug("SELinux: %s: %d entries and %d/%d buckets used, "
322-
"longest chain length %d, sum of chain length^2 %llu\n",
323-
tag, h->nel, slots_used, h->nslot, max_chain_len,
324-
chain2_len_sum);
319+
"longest chain length %d, sum of chain length^2 %llu\n",
320+
tag, h->nel, slots_used, h->nslot, max_chain_len,
321+
chain2_len_sum);
325322
}
326323
#endif /* CONFIG_SECURITY_SELINUX_DEBUG */
327324

325+
/* clang-format off */
328326
static const uint16_t spec_order[] = {
329327
AVTAB_ALLOWED,
330328
AVTAB_AUDITDENY,
@@ -336,6 +334,7 @@ static const uint16_t spec_order[] = {
336334
AVTAB_XPERMS_AUDITALLOW,
337335
AVTAB_XPERMS_DONTAUDIT
338336
};
337+
/* clang-format on */
339338

340339
int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
341340
int (*insertf)(struct avtab *a, const struct avtab_key *k,
@@ -365,9 +364,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
365364
if (items2 > ARRAY_SIZE(buf32)) {
366365
pr_err("SELinux: avtab: entry overflow\n");
367366
return -EINVAL;
368-
369367
}
370-
rc = next_entry(buf32, fp, sizeof(u32)*items2);
368+
rc = next_entry(buf32, fp, sizeof(u32) * items2);
371369
if (rc) {
372370
pr_err("SELinux: avtab: truncated entry\n");
373371
return rc;
@@ -400,8 +398,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
400398
pr_err("SELinux: avtab: null entry\n");
401399
return -EINVAL;
402400
}
403-
if ((val & AVTAB_AV) &&
404-
(val & AVTAB_TYPE)) {
401+
if ((val & AVTAB_AV) && (val & AVTAB_TYPE)) {
405402
pr_err("SELinux: avtab: entry has both access vectors and types\n");
406403
return -EINVAL;
407404
}
@@ -428,7 +425,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
428425
return 0;
429426
}
430427

431-
rc = next_entry(buf16, fp, sizeof(u16)*4);
428+
rc = next_entry(buf16, fp, sizeof(u16) * 4);
432429
if (rc) {
433430
pr_err("SELinux: avtab: truncated entry\n");
434431
return rc;
@@ -454,10 +451,11 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
454451
}
455452

456453
if ((vers < POLICYDB_VERSION_XPERMS_IOCTL) &&
457-
(key.specified & AVTAB_XPERMS)) {
454+
(key.specified & AVTAB_XPERMS)) {
458455
pr_err("SELinux: avtab: policy version %u does not "
459-
"support extended permissions rules and one "
460-
"was specified\n", vers);
456+
"support extended permissions rules and one "
457+
"was specified\n",
458+
vers);
461459
return -EINVAL;
462460
} else if (key.specified & AVTAB_XPERMS) {
463461
memset(&xperms, 0, sizeof(struct avtab_extended_perms));
@@ -471,7 +469,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
471469
pr_err("SELinux: avtab: truncated entry\n");
472470
return rc;
473471
}
474-
rc = next_entry(buf32, fp, sizeof(u32)*ARRAY_SIZE(xperms.perms.p));
472+
rc = next_entry(buf32, fp,
473+
sizeof(u32) * ARRAY_SIZE(xperms.perms.p));
475474
if (rc) {
476475
pr_err("SELinux: avtab: truncated entry\n");
477476
return rc;
@@ -507,7 +506,6 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol)
507506
__le32 buf[1];
508507
u32 nel, i;
509508

510-
511509
rc = next_entry(buf, fp, sizeof(u32));
512510
if (rc < 0) {
513511
pr_err("SELinux: avtab: truncated table\n");
@@ -561,7 +559,8 @@ int avtab_write_item(struct policydb *p, const struct avtab_node *cur, void *fp)
561559
return rc;
562560

563561
if (cur->key.specified & AVTAB_XPERMS) {
564-
rc = put_entry(&cur->datum.u.xperms->specified, sizeof(u8), 1, fp);
562+
rc = put_entry(&cur->datum.u.xperms->specified, sizeof(u8), 1,
563+
fp);
565564
if (rc)
566565
return rc;
567566
rc = put_entry(&cur->datum.u.xperms->driver, sizeof(u8), 1, fp);
@@ -570,7 +569,7 @@ int avtab_write_item(struct policydb *p, const struct avtab_node *cur, void *fp)
570569
for (i = 0; i < ARRAY_SIZE(cur->datum.u.xperms->perms.p); i++)
571570
buf32[i] = cpu_to_le32(cur->datum.u.xperms->perms.p[i]);
572571
rc = put_entry(buf32, sizeof(u32),
573-
ARRAY_SIZE(cur->datum.u.xperms->perms.p), fp);
572+
ARRAY_SIZE(cur->datum.u.xperms->perms.p), fp);
574573
} else {
575574
buf32[0] = cpu_to_le32(cur->datum.u.data);
576575
rc = put_entry(buf32, sizeof(u32), 1, fp);
@@ -593,8 +592,7 @@ int avtab_write(struct policydb *p, struct avtab *a, void *fp)
593592
return rc;
594593

595594
for (i = 0; i < a->nslot; i++) {
596-
for (cur = a->htable[i]; cur;
597-
cur = cur->next) {
595+
for (cur = a->htable[i]; cur; cur = cur->next) {
598596
rc = avtab_write_item(p, cur, fp);
599597
if (rc)
600598
return rc;
@@ -606,10 +604,9 @@ int avtab_write(struct policydb *p, struct avtab *a, void *fp)
606604

607605
void __init avtab_cache_init(void)
608606
{
609-
avtab_node_cachep = kmem_cache_create("avtab_node",
610-
sizeof(struct avtab_node),
611-
0, SLAB_PANIC, NULL);
612-
avtab_xperms_cachep = kmem_cache_create("avtab_extended_perms",
613-
sizeof(struct avtab_extended_perms),
614-
0, SLAB_PANIC, NULL);
607+
avtab_node_cachep = kmem_cache_create(
608+
"avtab_node", sizeof(struct avtab_node), 0, SLAB_PANIC, NULL);
609+
avtab_xperms_cachep = kmem_cache_create(
610+
"avtab_extended_perms", sizeof(struct avtab_extended_perms), 0,
611+
SLAB_PANIC, NULL);
615612
}

0 commit comments

Comments
 (0)