[v39,30/42] LSM: Single calls in socket_getpeersec hooks

Commit Message

Casey Schaufler Dec. 15, 2023, 10:16 p.m. UTC

security_socket_getpeersec_stream() and security_socket_getpeersec_dgram()
can only provide a single security context or secid to their callers.
Open code these two hooks to return the first hook provided. Because
only one "major" LSM is allowed there will only be one hook in the list,
with the excepton being BPF. BPF is not expected to be using these
interfaces.

Signed-off-by: Casey Schaufler <[e-mail]>
---
 security/security.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

Patch

diff --git a/security/security.c b/security/security.c
index f2ef6032a925..3f0a4c5094a5 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4686,8 +4686,14 @@  EXPORT_SYMBOL(security_sock_rcv_skb);
 int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
 				      sockptr_t optlen, unsigned int len)
 {
-	return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
-			     optval, optlen, len);
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
+			     list)
+		return hp->hook.socket_getpeersec_stream(sock, optval, optlen,
+							 len);
+
+	return -ENOPROTOOPT;
 }
 
 /**
@@ -4707,8 +4713,13 @@  int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
 int security_socket_getpeersec_dgram(struct socket *sock,
 				     struct sk_buff *skb, u32 *secid)
 {
-	return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
-			     skb, secid);
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
+			     list)
+		return hp->hook.socket_getpeersec_dgram(sock, skb, secid);
+
+	return -ENOPROTOOPT;
 }
 EXPORT_SYMBOL(security_socket_getpeersec_dgram);