Why is there an alignment from cred->security?

Why is there an alignment from cred->security?

[Denis Obrezkov]

I am digging through the SMACK code. There are the lines:

static inline struct task_smack *smack_cred(const struct cred *cred)
{
        return cred->security + smack_blob_sizes.lbs_cred;
}

and smack_blob_sizes are defined as:

struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
        .lbs_cred = sizeof(struct task_smack),
        .lbs_file = sizeof(struct smack_known *),
        .lbs_inode = sizeof(struct inode_smack),
        .lbs_ipc = sizeof(struct smack_known *),
        .lbs_msg_msg = sizeof(struct smack_known *),
};

So, basically, to get a struct we take the size of the struct as an
offset for cred->security, right? I can't understand why. So, we have
the following memory layout:

|_________(zeroes)__________|_____task_smack content____|
^                           ^                           ^
cred->security     cred->security +              cred->security +
                 sizeof(struct task_smack)   2*sizeof(struct task_smack)

Do I misunderstand something?


-- 
Regards, Denis Obrezkov

Re: Why is there an alignment from cred->security?

[Casey Schaufler]

On 1/18/2022 3:33 AM, Denis Obrezkov wrote:
> I am digging through the SMACK code. There are the lines:
>
> static inline struct task_smack *smack_cred(const struct cred *cred)
> {
>          return cred->security + smack_blob_sizes.lbs_cred;
> }
>
> and smack_blob_sizes are defined as:
>
> struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
>          .lbs_cred = sizeof(struct task_smack),
>          .lbs_file = sizeof(struct smack_known *),
>          .lbs_inode = sizeof(struct inode_smack),
>          .lbs_ipc = sizeof(struct smack_known *),
>          .lbs_msg_msg = sizeof(struct smack_known *),
> };
>
> So, basically, to get a struct we take the size of the struct as an
> offset for cred->security, right? I can't understand why. So, we have
> the following memory layout:
>
> |_________(zeroes)__________|_____task_smack content____|
> ^                           ^                           ^
> cred->security     cred->security +              cred->security +
>                   sizeof(struct task_smack)   2*sizeof(struct task_smack)
>
> Do I misunderstand something?

There may be more than one security module that uses the credential
security blob. The lbs_cred value will be 0 if only Smack is using
the credential blob. If another security module is also using the
blob that value will reflect where in the blob the Smack data resides.
See security/security.c for the details.