Skip to content

Commit 76ecf30

Browse files
cschauflerpcmoore
cschaufler
authored and
pcmoore
committed
lsm: use lsm_context in security_inode_getsecctx
Change the security_inode_getsecctx() interface to fill a lsm_context structure instead of data and length pointers. This provides the information about which LSM created the context so that security_release_secctx() can use the correct hook. Cc: [email protected] Signed-off-by: Casey Schaufler <[email protected]> [PM: subject tweak] Signed-off-by: Paul Moore <[email protected]>
1 parent 2d470c7 commit 76ecf30

File tree

6 files changed

+31
-33
lines changed

6 files changed

+31
-33
lines changed

‎fs/nfsd/nfs4xdr.c‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2818,11 +2818,11 @@ static __be32 nfsd4_encode_nfsace4(struct xdr_stream *xdr, struct svc_rqst *rqst
28182818
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
28192819
static inline __be32
28202820
nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2821-
void *context, int len)
2821+
const struct lsm_context *context)
28222822
{
28232823
__be32 *p;
28242824

2825-
p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
2825+
p = xdr_reserve_space(xdr, context->len + 4 + 4 + 4);
28262826
if (!p)
28272827
return nfserr_resource;
28282828

@@ -2832,13 +2832,13 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
28322832
*/
28332833
*p++ = cpu_to_be32(0); /* lfs */
28342834
*p++ = cpu_to_be32(0); /* pi */
2835-
p = xdr_encode_opaque(p, context, len);
2835+
p = xdr_encode_opaque(p, context->context, context->len);
28362836
return 0;
28372837
}
28382838
#else
28392839
static inline __be32
28402840
nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2841-
void *context, int len)
2841+
struct lsm_context *context)
28422842
{ return 0; }
28432843
#endif
28442844

@@ -2920,8 +2920,7 @@ struct nfsd4_fattr_args {
29202920
struct kstatfs statfs;
29212921
struct nfs4_acl *acl;
29222922
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2923-
void *context;
2924-
int contextlen;
2923+
struct lsm_context context;
29252924
#endif
29262925
u32 rdattr_err;
29272926
bool contextsupport;
@@ -3376,8 +3375,7 @@ static __be32 nfsd4_encode_fattr4_suppattr_exclcreat(struct xdr_stream *xdr,
33763375
static __be32 nfsd4_encode_fattr4_sec_label(struct xdr_stream *xdr,
33773376
const struct nfsd4_fattr_args *args)
33783377
{
3379-
return nfsd4_encode_security_label(xdr, args->rqstp,
3380-
args->context, args->contextlen);
3378+
return nfsd4_encode_security_label(xdr, args->rqstp, &args->context);
33813379
}
33823380
#endif
33833381

@@ -3527,7 +3525,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
35273525
args.ignore_crossmnt = (ignore_crossmnt != 0);
35283526
args.acl = NULL;
35293527
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3530-
args.context = NULL;
3528+
args.context.context = NULL;
35313529
#endif
35323530

35333531
/*
@@ -3607,7 +3605,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
36073605
attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
36083606
if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
36093607
err = security_inode_getsecctx(d_inode(dentry),
3610-
&args.context, &args.contextlen);
3608+
&args.context);
36113609
else
36123610
err = -EOPNOTSUPP;
36133611
args.contextsupport = (err == 0);
@@ -3644,12 +3642,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
36443642

36453643
out:
36463644
#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3647-
if (args.context) {
3648-
struct lsm_context scaff; /* scaffolding */
3649-
3650-
lsmcontext_init(&scaff, args.context, args.contextlen, 0);
3651-
security_release_secctx(&scaff);
3652-
}
3645+
if (args.context.context)
3646+
security_release_secctx(&args.context);
36533647
#endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
36543648
kfree(args.acl);
36553649
if (tempfh) {

‎include/linux/lsm_hook_defs.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,8 +303,8 @@ LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp)
303303
LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
304304
LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
305305
LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
306-
LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, void **ctx,
307-
u32 *ctxlen)
306+
LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode,
307+
struct lsm_context *cp)
308308

309309
#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
310310
LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,

‎include/linux/security.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ void security_release_secctx(struct lsm_context *cp);
591591
void security_inode_invalidate_secctx(struct inode *inode);
592592
int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
593593
int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
594-
int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
594+
int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
595595
int security_locked_down(enum lockdown_reason what);
596596
int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
597597
void *val, size_t val_len, u64 id, u64 flags);
@@ -1591,7 +1591,8 @@ static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32
15911591
{
15921592
return -EOPNOTSUPP;
15931593
}
1594-
static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1594+
static inline int security_inode_getsecctx(struct inode *inode,
1595+
struct lsm_context *cp)
15951596
{
15961597
return -EOPNOTSUPP;
15971598
}

‎security/security.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4426,17 +4426,17 @@ EXPORT_SYMBOL(security_inode_setsecctx);
44264426
/**
44274427
* security_inode_getsecctx() - Get the security label of an inode
44284428
* @inode: inode
4429-
* @ctx: secctx
4430-
* @ctxlen: length of secctx
4429+
* @cp: security context
44314430
*
4432-
* On success, returns 0 and fills out @ctx and @ctxlen with the security
4433-
* context for the given @inode.
4431+
* On success, returns 0 and fills out @cp with the security context
4432+
* for the given @inode.
44344433
*
44354434
* Return: Returns 0 on success, error on failure.
44364435
*/
4437-
int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4436+
int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
44384437
{
4439-
return call_int_hook(inode_getsecctx, inode, ctx, ctxlen);
4438+
memset(cp, 0, sizeof(*cp));
4439+
return call_int_hook(inode_getsecctx, inode, cp);
44404440
}
44414441
EXPORT_SYMBOL(security_inode_getsecctx);
44424442

‎security/selinux/hooks.c‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6711,14 +6711,16 @@ static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
67116711
ctx, ctxlen, 0, NULL);
67126712
}
67136713

6714-
static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6714+
static int selinux_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
67156715
{
6716-
int len = 0;
6716+
int len;
67176717
len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
6718-
XATTR_SELINUX_SUFFIX, ctx, true);
6718+
XATTR_SELINUX_SUFFIX,
6719+
(void **)&cp->context, true);
67196720
if (len < 0)
67206721
return len;
6721-
*ctxlen = len;
6722+
cp->len = len;
6723+
cp->id = LSM_ID_SELINUX;
67226724
return 0;
67236725
}
67246726
#ifdef CONFIG_KEYS

‎security/smack/smack_lsm.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4898,12 +4898,13 @@ static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
48984898
ctx, ctxlen, 0, NULL);
48994899
}
49004900

4901-
static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4901+
static int smack_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
49024902
{
49034903
struct smack_known *skp = smk_of_inode(inode);
49044904

4905-
*ctx = skp->smk_known;
4906-
*ctxlen = strlen(skp->smk_known);
4905+
cp->context = skp->smk_known;
4906+
cp->len = strlen(skp->smk_known);
4907+
cp->id = LSM_ID_SMACK;
49074908
return 0;
49084909
}
49094910

0 commit comments

Comments
 (0)