From patchwork Sat Sep 22 00:19:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10611287 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3E9E117EE for ; Sat, 22 Sep 2018 00:20:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3233A2C85D for ; Sat, 22 Sep 2018 00:20:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 270B12DF6C; Sat, 22 Sep 2018 00:20:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A04B72DF6A for ; Sat, 22 Sep 2018 00:20:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391774AbeIVGLU (ORCPT ); Sat, 22 Sep 2018 02:11:20 -0400 Received: from sonic304-18.consmr.mail.bf2.yahoo.com ([74.6.128.41]:40505 "EHLO sonic304-18.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391758AbeIVGLT (ORCPT ); Sat, 22 Sep 2018 02:11:19 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537575602; bh=D0y9tAp4PAnLglQyXk//qr5I8tURWoWKeQ4vbNh5qBc=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=RfBJSYzxfJzUQkSNuMy+AQ6Yqv7+bb4GA8ZAEzWdb4IumQP24nHbybzcaBWqR7S7njqQs8IeN4LnR6+GjMRVl7HNQC96+jbwhwv5T3RUIBcoB+xBeZiN8/sBZEHTbZRyIhs3hn5P7TryZKpw2pKyO+Zj+x9PusMfNUfJlR1VqVbkxC/1hmCFTIC+GX/aL9zEvKFioTvzkZdNAFR6Wy6hddYWm8OMCItcb0oItsMrwMqCm33LsHT30BNJescoP2WF86aoJpvWdnKcjF8i8RLOCYhGjcCa45A7vgLd/YuvsQreGeIOFdeQeLQOzN+vKCu9AxDb/Expw2e7t1Ia2Ws38w== X-YMail-OSG: Qel5dt4VM1k8Dot_WR.4AN6LFlsYE5SM5hOgVveiP2emFOshobHNfX8Mvk8jF1j 8l6kI8RPC5a.3GpJlHNr7_azhLDc0E0GpmSGsvCch..QwrpEbNpnUP.a6hRN0iteXhcRbgkS_l8p l_tuRX1Impqj_iKCN6REl4uKoYpFjCYTBGS.BUn3Sor52b13tXykVUad9GVtvlLhSNogaEa.FKwP dZFIyBaxORVYdJdc3AVkTS_hc2SxwyNJVsuih6zmCHfCt_GIQVrnn8e8WiuF.zW8EAdlApfqILIk fWKDdDsllkLnC4CU4cJ2ISZ_CxkCiGdPXP5u5uLS8hxu6gYVcWyk3U6BmeFlrkHNGW7aMmrrot2v 1be.7fF7rY5mKtYJC9eQaszwl.Ig8EGbdQSzcYQp9E6uOGQifxCOASRVDYyzzgUWrRe.dFjL1VtZ Re7jS4.NfL4cyIG3kLvYSR3yCMaK2mB08F_AxmJKUGyJ46dUrrsjYpHdG9ZsfZ2bSy9.7AqZxgon sR67uBYyAP9XzS4rMKzoMJTzM.h_18lbgNopPQspE7L_squaT._mCkcu1Aur_DO2D5owzqsQ3MQ1 9b5wmm2y58RvO7uzAewBViyFUO_VBm9ao2M4f1Y7ovc5KbcT_oKsx4vWk21EcxkTpynb9ABtGBjm 7l6pyNuNqcwtw4z3Hfb9R7DeYqjXNqGBkJuRqCXRDzdXvZ8SLp_6NM8ZHqcatCv_GbKQe0yvx2B. ZPGeavmyyCudN7TA7FojNVDfM1KWYUmhGnhK6g_L0xGTqdMQi_5Tb_OSs_WY8PQRw86u3ql4DA96 OFCIOaV4l_crT3ur2FujHTos4_ITdmL_b1cVhU4W1qPFCCu_UyEZg9nBZXx.DWqIg3.t6G1xwUXF t4Dx5Xn9Sj3OmNODtPDlXKWv.M3g7qVRVrreTwbttC70B5gEIlGcSiXuUtuj0e.hVKiv7Ptrd9Se zW.vOMCTb58HI97WjvHDdK_8AwaeDKVJWdCmwH2UPauaKVCKxsX0QvflkDloVXHQa7lzAwb1uON3 5NeygHA6ezspVHcfH9fZ3ABRIvP9pHVg.zN8duNfrNQ-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic304.consmr.mail.bf2.yahoo.com with HTTP; Sat, 22 Sep 2018 00:20:02 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp409.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 73f2d5a0b4ab1f0579e443cc260bef4f; Sat, 22 Sep 2018 00:20:00 +0000 (UTC) Subject: [PATCH v4 17/19] Smack: Abstract use of ipc security blobs To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: From: Casey Schaufler Message-ID: Date: Fri, 21 Sep 2018 17:19:54 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Don't use the ipc->security pointer directly. Don't use the msg_msg->security pointer directly. Provide helper functions that provides the security blob pointers. Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook --- security/smack/smack.h | 11 +++++++++++ security/smack/smack_lsm.c | 14 +++++++++----- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index add19b7efc96..52cea142fcf6 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -24,6 +24,7 @@ #include #include #include +#include /* * Use IPv6 port labeling if IPv6 is enabled and secmarks @@ -371,6 +372,16 @@ static inline struct inode_smack *smack_inode(const struct inode *inode) return inode->i_security; } +static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg) +{ + return (struct smack_known **)&msg->security; +} + +static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc) +{ + return (struct smack_known **)&ipc->security; +} + /* * Is the directory transmuting? */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 6617abb51732..4afc8899f83f 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2905,7 +2905,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg) */ static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) { - return (struct smack_known *)isp->security; + struct smack_known **blob = smack_ipc(isp); + + return *blob; } /** @@ -2916,9 +2918,9 @@ static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) */ static int smack_ipc_alloc_security(struct kern_ipc_perm *isp) { - struct smack_known *skp = smk_of_current(); + struct smack_known **blob = smack_ipc(isp); - isp->security = skp; + *blob = smk_of_current(); return 0; } @@ -3230,7 +3232,8 @@ static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg */ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) { - struct smack_known *iskp = ipp->security; + struct smack_known **blob = smack_ipc(ipp); + struct smack_known *iskp = *blob; int may = smack_flags_to_may(flag); struct smk_audit_info ad; int rc; @@ -3251,7 +3254,8 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) */ static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid) { - struct smack_known *iskp = ipp->security; + struct smack_known **blob = smack_ipc(ipp); + struct smack_known *iskp = *blob; *secid = iskp->smk_secid; }