diff mbox series

[28/58] NET: Remove scaffolding on new secmarks

Message ID	20190531231020.628-29-casey@schaufler-ca.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH 28/58] NET: Remove scaffolding on new secmarks Date: Fri, 31 May 2019 16:09:50 -0700 Message-Id: <20190531231020.628-29-casey@schaufler-ca.com> In-Reply-To: <20190531231020.628-1-casey@schaufler-ca.com> References: <20190531231020.628-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk
Series	LSM: Module stacking for AppArmor \| expand [00/58] LSM: Module stacking for AppArmor [01/58] LSM: Infrastructure management of the superblock [02/58] LSM: Infrastructure management of the sock security [03/58] LSM: Infrastructure management of the key security blob [04/58] LSM: Create an lsm_export data structure. [05/58] LSM: Use lsm_export in the inode_getsecid hooks [06/58] LSM: Use lsm_export in the cred_getsecid hooks [07/58] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks [08/58] LSM: Use lsm_export in the kernel_ask_as hooks [09/58] LSM: Use lsm_export in the getpeersec_dgram hooks [10/58] LSM: Use lsm_export in the audit_rule_match hooks [11/58] LSM: Use lsm_export in the secid_to_secctx hooks [12/58] LSM: Use lsm_export in the secctx_to_secid hooks [13/58] LSM: Use lsm_export in security_audit_rule_match [14/58] LSM: Use lsm_export in security_kernel_act_as [15/58] LSM: Use lsm_export in security_socket_getpeersec_dgram [16/58] LSM: Use lsm_export in security_secctx_to_secid [17/58] LSM: Use lsm_export in security_secid_to_secctx [18/58] LSM: Use lsm_export in security_ipc_getsecid [19/58] LSM: Use lsm_export in security_task_getsecid [20/58] LSM: Use lsm_export in security_inode_getsecid [21/58] LSM: Use lsm_export in security_cred_getsecid [22/58] Audit: Change audit_sig_sid to audit_sig_lsm [23/58] Audit: Convert target_sid to an lsm_export structure [24/58] Audit: Convert osid to an lsm_export structure [25/58] IMA: Clean out lsm_export scaffolding [26/58] NET: Change the UNIXCB from a secid to an lsm_export [27/58] NET: Remove scaffolding on secmarks [28/58] NET: Remove scaffolding on new secmarks [29/58] NET: Remove netfilter scaffolding for lsm_export [30/58] Netlabel: Replace secids with lsm_export [31/58] LSM: Remove lsm_export scaffolding functions [32/58] IMA: FIXUP prototype using lsm_export [33/58] Smack: Restore the release_secctx hook [34/58] AppArmor: Remove unnecessary hook stub [35/58] LSM: Limit calls to certain module hooks [36/58] LSM: Create a data structure for a security context [37/58] LSM: Use lsm_context in secid_to_secctx hooks [38/58] LSM: Use lsm_context in secctx_to_secid hooks [39/58] LSM: Use lsm_context in inode_getsecctx hooks [40/58] LSM: Use lsm_context in inode_notifysecctx hooks [41/58] LSM: Use lsm_context in dentry_init_security hooks [42/58] LSM: Use lsm_context in security_dentry_init_security [43/58] LSM: Use lsm_context in security_inode_notifysecctx [44/58] LSM: Use lsm_context in security_inode_getsecctx [45/58] LSM: Use lsm_context in security_secctx_to_secid [46/58] LSM: Use lsm_context in release_secctx hooks [47/58] LSM: Use lsm_context in security_release_secctx [48/58] LSM: Use lsm_context in security_secid_to_secctx [49/58] fs: remove lsm_context scaffolding [50/58] LSM: Add the release function to the lsm_context

Commit Message

Casey Schaufler May 31, 2019, 11:09 p.m. UTC

Replace the lsm_export scaffolding in nft_meta.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 net/netfilter/nft_meta.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 598bea8e4799..a1d3dab5bc25 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -580,11 +580,17 @@  static int nft_secmark_compute_secid(struct nft_secmark *priv)
 	u32 tmp_secid = 0;
 	int err;
 
+	lsm_export_init(&le);
 	err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &le);
 	if (err)
 		return err;
 
-	lsm_export_secid(&le, &tmp_secid);
+	/* Use the "best" secid */
+	if (le.selinux)
+		tmp_secid = le.selinux;
+	else
+		tmp_secid = le.smack;
+
 	if (!tmp_secid)
 		return -ENOENT;