[5/5] LSM: Use lsm_context in security_inode_notifysecctx

Commit Message

Casey Schaufler Sept. 17, 2024, 11:52 p.m. UTC

Use the lsm_context structure in the security_inode_notifysecctx()
interface. Its sole user is already using lsm_context to store
the data.

Signed-off-by: Casey Schaufler <[e-mail]>
---
 fs/nfs/inode.c                | 3 +--
 include/linux/lsm_hook_defs.h | 3 ++-
 include/linux/security.h      | 4 ++--
 security/security.c           | 7 +++----
 security/selinux/hooks.c      | 5 +++--
 security/smack/smack_lsm.c    | 6 +++---
 6 files changed, 14 insertions(+), 14 deletions(-)

Patch

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 056ddc876cb5..4323a39c14c1 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -359,8 +359,7 @@  void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr)
 
 	if ((fattr->valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL) && inode->i_security) {
 		error = security_inode_notifysecctx(inode,
-						fattr->label->lsmctx.context,
-						fattr->label->lsmctx.len);
+						    &fattr->label->lsmctx);
 		if (error)
 			printk(KERN_ERR "%s() %s %d "
 					"security_inode_notifysecctx() %d\n",
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 6b671f4ada03..0216aeb4a3fd 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -298,7 +298,8 @@  LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop,
 LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)
 LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp)
 LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
-LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
+LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode,
+	 struct lsm_context *cp)
 LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
 LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode,
 	 struct lsm_context *cp)
diff --git a/include/linux/security.h b/include/linux/security.h
index c9c4845da3a6..1b1411fff6ac 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -555,7 +555,7 @@  int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void security_release_secctx(struct lsm_context *cp);
 void security_inode_invalidate_secctx(struct inode *inode);
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
+int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
 int security_locked_down(enum lockdown_reason what);
@@ -1536,7 +1536,7 @@  static inline void security_inode_invalidate_secctx(struct inode *inode)
 {
 }
 
-static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static inline int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp);
 {
 	return -EOPNOTSUPP;
 }
diff --git a/security/security.c b/security/security.c
index 020e7a89de16..44639d193ecd 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4268,8 +4268,7 @@  EXPORT_SYMBOL(security_inode_invalidate_secctx);
 /**
  * security_inode_notifysecctx() - Notify the LSM of an inode's security label
  * @inode: inode
- * @ctx: secctx
- * @ctxlen: length of secctx
+ * @ctx: LSM context
  *
  * Notify the security module of what the security context of an inode should
  * be.  Initializes the incore security context managed by the security module
@@ -4280,9 +4279,9 @@  EXPORT_SYMBOL(security_inode_invalidate_secctx);
  *
  * Return: Returns 0 on success, error on failure.
  */
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp)
 {
-	return call_int_hook(inode_notifysecctx, inode, ctx, ctxlen);
+	return call_int_hook(inode_notifysecctx, inode, cp);
 }
 EXPORT_SYMBOL(security_inode_notifysecctx);
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 93188e124f99..382c63d67743 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6665,10 +6665,11 @@  static void selinux_inode_invalidate_secctx(struct inode *inode)
 /*
  *	called with inode->i_mutex locked
  */
-static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static int selinux_inode_notifysecctx(struct inode *inode,
+				      struct lsm_context *cp)
 {
 	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
-					   ctx, ctxlen, 0);
+					   cp->context, cp->len, 0);
 	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
 	return rc == -EOPNOTSUPP ? 0 : rc;
 }
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b443859948e9..1dfc4292ea15 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4906,10 +4906,10 @@  static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
  * Now that there's a list such a hook adds cost.
  */
 
-static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static int smack_inode_notifysecctx(struct inode *inode, struct lsm_context *cp)
 {
-	return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
-				       ctxlen, 0);
+	return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, cp->context,
+				       cp->len, 0);
 }
 
 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)