From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, keescook@chromium.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, sds@tycho.nsa.gov
Subject: [PATCH 12/59] LSM: Use lsm_export in the secid_to_secctx hooks
Date: Tue, 9 Apr 2019 12:58:37 -0700 [thread overview]
Message-ID: <20190409195924.1509-13-casey@schaufler-ca.com> (raw)
In-Reply-To: <20190409195924.1509-1-casey@schaufler-ca.com>
Convert the secid_to_secctx hooks to use the lsm_export
structure instead of a u32 secid. There is some scaffolding
involved that will be removed when security_secid_to_secctx()
is updated.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
include/linux/lsm_hooks.h | 5 +++--
security/apparmor/include/secid.h | 2 +-
security/apparmor/secid.c | 6 ++----
security/security.c | 5 ++++-
security/selinux/hooks.c | 6 +++++-
security/smack/smack_lsm.c | 9 +++++++--
6 files changed, 22 insertions(+), 11 deletions(-)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 690ab020508e..11ace5c923bd 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1322,7 +1322,7 @@
* This does mean that the length could change between calls to check the
* length and the next call which actually allocates and returns the
* secdata.
- * @secid contains the security ID.
+ * @l points to the security information.
* @secdata contains the pointer that stores the converted security
* context.
* @seclen pointer which contains the length of the data
@@ -1672,7 +1672,8 @@ union security_list_options {
int (*getprocattr)(struct task_struct *p, char *name, char **value);
int (*setprocattr)(const char *name, void *value, size_t size);
int (*ismaclabel)(const char *name);
- int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
+ int (*secid_to_secctx)(struct lsm_export *l, char **secdata,
+ u32 *seclen);
int (*secctx_to_secid)(const char *secdata, u32 seclen, u32 *secid);
void (*release_secctx)(char *secdata, u32 seclen);
diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/secid.h
index c283c620efe3..03369183f512 100644
--- a/security/apparmor/include/secid.h
+++ b/security/apparmor/include/secid.h
@@ -26,7 +26,7 @@ struct aa_label;
#define AA_SECID_WILDCARD 1
struct aa_label *aa_secid_to_label(struct lsm_export *l);
-int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
+int apparmor_secid_to_secctx(struct lsm_export *l, char **secdata, u32 *seclen);
int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
void apparmor_release_secctx(char *secdata, u32 seclen);
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index 1546c45a2a18..ab4dc165e43e 100644
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -81,15 +81,13 @@ static inline void aa_import_secid(struct lsm_export *l, u32 secid)
l->apparmor = secid;
}
-int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+int apparmor_secid_to_secctx(struct lsm_export *l, char **secdata, u32 *seclen)
{
/* TODO: cache secctx and ref count so we don't have to recreate */
- struct lsm_export data;
struct aa_label *label;
int len;
- aa_import_secid(&data, secid);
- label = aa_secid_to_label(&data);
+ label = aa_secid_to_label(l);
AA_BUG(!seclen);
diff --git a/security/security.c b/security/security.c
index 60dd064c0531..adf4cb768665 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2002,7 +2002,10 @@ EXPORT_SYMBOL(security_ismaclabel);
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
- return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata,
+ struct lsm_export data;
+
+ lsm_export_to_all(&data, secid);
+ return call_int_hook(secid_to_secctx, -EOPNOTSUPP, &data, secdata,
seclen);
}
EXPORT_SYMBOL(security_secid_to_secctx);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index bfd0f1f5979f..16d902158e8a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6301,8 +6301,12 @@ static int selinux_ismaclabel(const char *name)
return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
}
-static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+static int selinux_secid_to_secctx(struct lsm_export *l, char **secdata,
+ u32 *seclen)
{
+ u32 secid;
+
+ selinux_import_secid(l, &secid);
return security_sid_to_context(&selinux_state, secid,
secdata, seclen);
}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a3776501965d..809af981f14c 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4433,9 +4433,14 @@ static int smack_ismaclabel(const char *name)
*
* Exists for networking code.
*/
-static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+static int smack_secid_to_secctx(struct lsm_export *l, char **secdata,
+ u32 *seclen)
{
- struct smack_known *skp = smack_from_secid(secid);
+ struct smack_known *skp;
+ u32 secid;
+
+ smack_import_secid(l, &secid);
+ skp = smack_from_secid(secid);
if (secdata)
*secdata = skp->smk_known;
--
2.19.1
next prev parent reply other threads:[~2019-04-09 20:00 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-09 19:58 [PATCH 00/59] LSM: Module stacking for AppArmor Casey Schaufler
2019-04-09 19:58 ` [PATCH 01/59] LSM: Infrastructure management of the superblock Casey Schaufler
2019-04-09 19:58 ` [PATCH 02/59] LSM: Infrastructure management of the sock security Casey Schaufler
2019-04-09 19:58 ` [PATCH 03/59] LSM: Infrastructure management of the key security blob Casey Schaufler
2019-04-09 19:58 ` [PATCH 04/59] LSM: Create an lsm_export data structure Casey Schaufler
2019-04-09 19:58 ` [PATCH 05/59] LSM: Use lsm_export in the inode_getsecid hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 06/59] LSM: Use lsm_export in the cred_getsecid hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 07/59] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 08/59] LSM: Use lsm_export in the kernel_ask_as hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 09/59] LSM: Use lsm_export in the getpeersec_dgram hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 10/59] LSM: Use lsm_export in the audit_rule_match hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 11/59] LSM: Fix logical operation in lsm_export checks Casey Schaufler
2019-04-09 19:58 ` Casey Schaufler [this message]
2019-04-09 19:58 ` [PATCH 13/59] LSM: Use lsm_export in the secctx_to_secid hooks Casey Schaufler
2019-04-09 19:58 ` [PATCH 14/59] LSM: Use lsm_export in security_audit_rule_match Casey Schaufler
2019-04-09 19:58 ` [PATCH 15/59] LSM: Use lsm_export in security_kernel_act_as Casey Schaufler
2019-04-09 19:58 ` [PATCH 16/59] LSM: Use lsm_export in security_socket_getpeersec_dgram Casey Schaufler
2019-04-09 19:58 ` [PATCH 17/59] LSM: Use lsm_export in security_secctx_to_secid Casey Schaufler
2019-04-09 19:58 ` [PATCH 18/59] LSM: Use lsm_export in security_secid_to_secctx Casey Schaufler
2019-04-09 19:58 ` [PATCH 19/59] LSM: Use lsm_export in security_ipc_getsecid Casey Schaufler
2019-04-09 19:58 ` [PATCH 20/59] LSM: Use lsm_export in security_task_getsecid Casey Schaufler
2019-04-09 19:58 ` [PATCH 21/59] LSM: Use lsm_export in security_inode_getsecid Casey Schaufler
2019-04-09 19:58 ` [PATCH 22/59] LSM: Use lsm_export in security_cred_getsecid Casey Schaufler
2019-04-09 19:58 ` [PATCH 23/59] Audit: Change audit_sig_sid to audit_sig_lsm Casey Schaufler
2019-04-09 19:58 ` [PATCH 24/59] Audit: Convert target_sid to an lsm_export structure Casey Schaufler
2019-04-09 19:58 ` [PATCH 25/59] Audit: Convert osid " Casey Schaufler
2019-04-09 19:58 ` [PATCH 26/59] IMA: Clean out lsm_export scaffolding Casey Schaufler
2019-04-09 19:58 ` [PATCH 27/59] NET: Store LSM access information in the socket blob for UDS Casey Schaufler
2019-04-09 19:58 ` [PATCH 28/59] NET: Remove scaffolding on secmarks Casey Schaufler
2019-04-09 19:58 ` [PATCH 29/59] NET: Remove scaffolding on new secmarks Casey Schaufler
2019-04-09 19:58 ` [PATCH 30/59] NET: Remove netfilter scaffolding for lsm_export Casey Schaufler
2019-04-09 19:58 ` [PATCH 31/59] Netlabel: Replace secids with lsm_export Casey Schaufler
2019-04-09 19:58 ` [PATCH 32/59] LSM: Remove lsm_export scaffolding functions Casey Schaufler
2019-04-09 19:58 ` [PATCH 33/59] IMA: FIXUP prototype using lsm_export Casey Schaufler
2019-04-09 19:58 ` [PATCH 34/59] Smack: Restore the release_secctx hook Casey Schaufler
2019-04-09 19:59 ` [PATCH 35/59] AppArmor: Remove unnecessary hook stub Casey Schaufler
2019-04-09 19:59 ` [PATCH 36/59] LSM: Limit calls to certain module hooks Casey Schaufler
2019-04-09 19:59 ` [PATCH 37/59] LSM: Create a data structure for a security context Casey Schaufler
2019-04-09 19:59 ` [PATCH 38/59] LSM: Use lsm_context in secid_to_secctx hooks Casey Schaufler
2019-04-09 19:59 ` [PATCH 39/59] LSM: Use lsm_context in secctx_to_secid hooks Casey Schaufler
2019-04-09 19:59 ` [PATCH 40/59] LSM: Use lsm_context in inode_getsecctx hooks Casey Schaufler
-- strict thread matches above, loose matches on Subject: below --
2019-04-09 21:38 [PATCH 00/59] LSM: Module stacking for AppArmor Casey Schaufler
2019-04-09 21:38 ` [PATCH 12/59] LSM: Use lsm_export in the secid_to_secctx hooks Casey Schaufler
2019-04-09 19:17 [PATCH 00/59] LSM: Module stacking for AppArmor Casey Schaufler
2019-04-09 19:18 ` [PATCH 12/59] LSM: Use lsm_export in the secid_to_secctx hooks Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190409195924.1509-13-casey@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).