Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
* [GIT PULL] Smack patches for v5.4 - retry
@ 2019-09-23 20:14 Casey Schaufler
  2019-09-23 21:35 ` Linus Torvalds
  0 siblings, 1 reply; 3+ messages in thread
From: Casey Schaufler @ 2019-09-23 20:14 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: Linux Security Module list, LKML, casey

Hello Linus

Thank for the instruction. I think this is correct.
I have four patches for v5.4. Nothing is major. All but one are in
response to mechanically detected potential issues. The remaining
patch cleans up kernel-doc notations.


The following changes since commit 0ecfebd2b52404ae0c54a878c872bb93363ada36:

  Linux 5.2 (2019-07-07 15:41:56 -0700)

are available in the Git repository at:

  https://github.com/cschaufler/smack-next.git tags/smack-for-5.4-rc1

for you to fetch changes up to e5bfad3d7acc5702f32aafeb388362994f4d7bd0:

  smack: use GFP_NOFS while holding inode_smack::smk_lock (2019-09-04 09:37:07 -0700)

----------------------------------------------------------------
I have four patches for v5.4. Nothing is major. All but one are in
response to mechanically detected potential issues. The remaining
patch cleans up kernel-doc notations.

----------------------------------------------------------------
Eric Biggers (1):
      smack: use GFP_NOFS while holding inode_smack::smk_lock

Jann Horn (1):
      Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set

Jia-Ju Bai (1):
      security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb()

luanshi (1):
      smack: fix some kernel-doc notations

 security/smack/smack_access.c |  6 +++---
 security/smack/smack_lsm.c    | 40 ++++++++++++++++++++--------------------
 2 files changed, 23 insertions(+), 23 deletions(-)



^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [GIT PULL] Smack patches for v5.4 - retry
  2019-09-23 20:14 [GIT PULL] Smack patches for v5.4 - retry Casey Schaufler
@ 2019-09-23 21:35 ` Linus Torvalds
  2019-09-23 21:38   ` Linus Torvalds
  0 siblings, 1 reply; 3+ messages in thread
From: Linus Torvalds @ 2019-09-23 21:35 UTC (permalink / raw)
  To: Casey Schaufler; +Cc: Linux Security Module list, LKML

On Mon, Sep 23, 2019 at 1:14 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
>
> Thank for the instruction. I think this is correct.

Looks fine, pulled.

That said, when I look closer:

> Jia-Ju Bai (1):
>       security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb()

This one seems wrong.

Not seriously so, but the quoting the logic from the commit:

    In smack_socket_sock_rcv_skb(), there is an if statement
    on line 3920 to check whether skb is NULL:

        if (skb && skb->secmark != 0)

    This check indicates skb can be NULL in some cases.

and the fact is, skb _cannot_ be NULL, because when you test the
security of receiving an skb, you by definition always have an skb.

There is one single place that calls security_sock_rcv_skb(), and it
very much has a real skb.

So instead of adding a _new_ test for skb being NULL, the old test for
a NULL skb should just have been removed. It really doesn't make any
sense to have a NULL skb in that path - if some memory allocation had
failed on the receive path, that just means that the receive is never
done, it doesn't mean that you'd test a NULL skb for security policy
violations.

Anyway, it's pulled, but I think somebody should have checked and
thought about the automated tool reports a bit more..

               Linus

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [GIT PULL] Smack patches for v5.4 - retry
  2019-09-23 21:35 ` Linus Torvalds
@ 2019-09-23 21:38   ` Linus Torvalds
  0 siblings, 0 replies; 3+ messages in thread
From: Linus Torvalds @ 2019-09-23 21:38 UTC (permalink / raw)
  To: Casey Schaufler; +Cc: Linux Security Module list, LKML

On Mon, Sep 23, 2019 at 2:35 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Sep 23, 2019 at 1:14 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
> >
> > Thank for the instruction. I think this is correct.
>
> Looks fine, pulled.

Oh, btw, can you get more signatures on your pgp key? I actually care
more about having a key than having a key with lots of signatures (*),
but signatures and a chain of trust would be good too.

                   Linus

(*) To me, keys are more of a "yeah, I'm the same person that usually
sends these pull requests" than some kind of hard identity.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-23 20:14 [GIT PULL] Smack patches for v5.4 - retry Casey Schaufler
2019-09-23 21:35 ` Linus Torvalds
2019-09-23 21:38   ` Linus Torvalds

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git