selinux.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Casey Schaufler <casey@schaufler-ca.com>
To: "David Laight" <David.Laight@ACULAB.COM>,
	LSM <linux-security-module@vger.kernel.org>,
	"James Morris" <jmorris@namei.org>,
	"SE Linux" <selinux@tycho.nsa.gov>,
	LKLM <linux-kernel@vger.kernel.org>,
	"John Johansen" <john.johansen@canonical.com>,
	"Kees Cook" <keescook@chromium.org>,
	"Tetsuo Handa" <penguin-kernel@i-love.sakura.ne.jp>,
	"Paul Moore" <paul@paul-moore.com>,
	"Stephen Smalley" <sds@tycho.nsa.gov>,
	"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
	"Alexey Dobriyan" <adobriyan@gmail.com>,
	"Mickaël Salaün" <mic@digikod.net>,
	"Salvatore Mesoraca" <s.mesoraca16@gmail.com>
Subject: Re: [PATCH v3 09/16] SELinux: Abstract use of file security blob
Date: Thu, 20 Sep 2018 08:20:50 -0700	[thread overview]
Message-ID: <4db0c110-c1aa-aac8-901f-a9abf662b605@schaufler-ca.com> (raw)
In-Reply-To: <124ae3859e8141deb35ed8355370b4ed@AcuMS.aculab.com>

On 9/20/2018 1:51 AM, David Laight wrote:
> From: Casey Schaufler
>> Sent: 20 September 2018 01:21
>>
>> SELinux: Abstract use of file security blob
>>
>> Don't use the file->f_security pointer directly.
>> Provide a helper function that provides the security blob pointer.
> ...
>> +static inline struct file_security_struct *selinux_file(const struct file *file)
>> +{
>> +	return file->f_security;
>> +}
>> +
> Why?

In patch 16/16 this becomes:

 static inline struct file_security_struct *selinux_file(const struct file *file)
 {
+#ifdef CONFIG_SECURITY_STACKING
+	return file->f_security + selinux_blob_sizes.lbs_file;
+#else
 	return file->f_security;
+#endif
 }

You could hard code this bit everywhere it's used, but that
would be prone to error. I'm not generally an abstractionist
myself, but it these cases abstraction adds value.

  reply	other threads:[~2018-09-20 15:27 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-20  0:03 [PATCH v3 00/16] LSM: Module stacking in support of SARA and Landlock Casey Schaufler
2018-09-20  0:19 ` [PATCH v3 01/16] procfs: add smack subdir to attrs Casey Schaufler
2018-09-20  0:19 ` [PATCH v3 02/16] Smack: Abstract use of cred security blob Casey Schaufler
2018-09-20  0:19 ` [PATCH v3 03/16] SELinux: " Casey Schaufler
2018-09-20  0:20 ` [PATCH v3 04/16] SELinux: Remove cred security blob poisoning Casey Schaufler
2018-09-20  0:20 ` [PATCH v3 05/16] SELinux: Remove unused selinux_is_enabled Casey Schaufler
2018-09-20  0:20 ` [PATCH v3 06/16] AppArmor: Abstract use of cred security blob Casey Schaufler
2018-09-20  0:20 ` [PATCH v3 07/16] TOMOYO: " Casey Schaufler
2018-09-20 17:13   ` Kees Cook
2018-09-20  0:20 ` [PATCH v3 08/16] LSM: Infrastructure management of the " Casey Schaufler
2018-09-20  0:20 ` [PATCH v3 09/16] SELinux: Abstract use of file " Casey Schaufler
2018-09-20  8:51   ` David Laight
2018-09-20 15:20     ` Casey Schaufler [this message]
2018-09-20  0:21 ` [PATCH v3 10/16] LSM: Infrastructure management of the " Casey Schaufler
2018-09-20 17:25   ` Kees Cook
2018-09-20  0:21 ` [PATCH v3 11/16] SELinux: Abstract use of inode " Casey Schaufler
2018-09-20  0:21 ` [PATCH v3 12/16] Smack: " Casey Schaufler
2018-09-20  0:21 ` [PATCH v3 13/16] LSM: Infrastructure management of the inode security Casey Schaufler
2018-09-20  0:21 ` [PATCH v3 14/16] LSM: Infrastructure management of the task security blob Casey Schaufler
2018-09-20 17:39   ` Kees Cook
2018-09-20  0:21 ` [PATCH v3 15/16] LSM: Infrastructure management of the ipc " Casey Schaufler
2018-09-20 17:44   ` Kees Cook
2018-09-20  0:21 ` [PATCH v3 16/16] LSM: Blob sharing support for S.A.R.A and LandLock Casey Schaufler
2018-09-20 17:56   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4db0c110-c1aa-aac8-901f-a9abf662b605@schaufler-ca.com \
    --to=casey@schaufler-ca.com \
    --cc=David.Laight@ACULAB.COM \
    --cc=adobriyan@gmail.com \
    --cc=jmorris@namei.org \
    --cc=john.johansen@canonical.com \
    --cc=keescook@chromium.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mic@digikod.net \
    --cc=paul@paul-moore.com \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=s.mesoraca16@gmail.com \
    --cc=sds@tycho.nsa.gov \
    --cc=selinux@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).