[19/90] LSM: Use lsm_export in security_ipc_getsecid

Message ID	20190419004617.64627-20-casey@schaufler-ca.com (mailing list archive)
State	Not Applicable
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com Subject: [PATCH 19/90] LSM: Use lsm_export in security_ipc_getsecid Date: Thu, 18 Apr 2019 17:45:06 -0700 Message-Id: <20190419004617.64627-20-casey@schaufler-ca.com> In-Reply-To: <20190419004617.64627-1-casey@schaufler-ca.com> References: <20190419004617.64627-1-casey@schaufler-ca.com> Sender: selinux-owner@vger.kernel.org Precedence: bulk
Series	LSM: Module stacking for all \| expand [00/90] LSM: Module stacking for all [01/90] LSM: Infrastructure management of the superblock [02/90] LSM: Infrastructure management of the sock security [03/90] LSM: Infrastructure management of the key security blob [04/90] LSM: Create an lsm_export data structure. [05/90] LSM: Use lsm_export in the inode_getsecid hooks [06/90] LSM: Use lsm_export in the cred_getsecid hooks [07/90] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks [08/90] LSM: Use lsm_export in the kernel_ask_as hooks [09/90] LSM: Use lsm_export in the getpeersec_dgram hooks [10/90] LSM: Use lsm_export in the audit_rule_match hooks [11/90] LSM: Fix logical operation in lsm_export checks [12/90] LSM: Use lsm_export in the secid_to_secctx hooks [13/90] LSM: Use lsm_export in the secctx_to_secid hooks [14/90] LSM: Use lsm_export in security_audit_rule_match [15/90] LSM: Use lsm_export in security_kernel_act_as [16/90] LSM: Use lsm_export in security_socket_getpeersec_dgram [17/90] LSM: Use lsm_export in security_secctx_to_secid [18/90] LSM: Use lsm_export in security_secid_to_secctx [19/90] LSM: Use lsm_export in security_ipc_getsecid [20/90] LSM: Use lsm_export in security_task_getsecid [21/90] LSM: Use lsm_export in security_inode_getsecid [22/90] LSM: Use lsm_export in security_cred_getsecid [23/90] Audit: Change audit_sig_sid to audit_sig_lsm [24/90] Audit: Convert target_sid to an lsm_export structure [25/90] Audit: Convert osid to an lsm_export structure [26/90] IMA: Clean out lsm_export scaffolding [27/90] NET: Change the UNIXCB from a secid to an lsm_export [28/90] NET: Remove scaffolding on secmarks [29/90] NET: Remove scaffolding on new secmarks [30/90] NET: Remove netfilter scaffolding for lsm_export [31/90] Netlabel: Replace secids with lsm_export [32/90] LSM: Remove lsm_export scaffolding functions [33/90] IMA: FIXUP prototype using lsm_export [34/90] Smack: Restore the release_secctx hook [35/90] AppArmor: Remove unnecessary hook stub [36/90] LSM: Limit calls to certain module hooks [37/90] LSM: Create a data structure for a security context [38/90] LSM: Use lsm_context in secid_to_secctx hooks [39/90] LSM: Use lsm_context in secctx_to_secid hooks [40/90] LSM: Use lsm_context in inode_getsecctx hooks [41/90] LSM: Use lsm_context in inode_notifysecctx hooks [42/90] LSM: Use lsm_context in dentry_init_security hooks [43/90] LSM: Use lsm_context in security_dentry_init_security [44/90] LSM: Use lsm_context in security_inode_notifysecctx [45/90] LSM: Use lsm_context in security_inode_getsecctx [46/90] LSM: Use lsm_context in security_secctx_to_secid [47/90] LSM: Use lsm_context in release_secctx hooks [48/90] LSM: Use lsm_context in security_release_secctx [49/90] LSM: Use lsm_context in security_secid_to_secctx [50/90] fs: remove lsm_context scaffolding [51/90] LSM: Add the release function to the lsm_context [52/90] LSM: Use lsm_context in inode_setsecctx hooks [53/90] LSM: Use lsm_context in security_inode_setsecctx [54/90] kernfs: remove lsm_context scaffolding [55/90] LSM: Remove unused macro [56/90] LSM: Special handling for secctx lsm hooks [57/90] SELinux: Use blob offset in current_sid [58/90] LSM: Specify which LSM to display [59/90] AppArmor: Remove the exclusive flag [60/90] LSM: Add secmark_relabel_packet to the set of one call hooks [61/90] LSM: Make getting the secmark right cleaner [62/90] netfilter: Fix memory leak introduced with lsm_context [63/90] Smack: Consolidate secmark conversions [64/90] netfilter: Remove unnecessary NULL check in lsm_context [65/90] LSM: Add secmark refcounting to call_one list [66/90] LSM: refactor security_setprocattr [67/90] Smack: Detect if secmarks can be safely used [68/90] LSM: Support multiple LSMs using inode_init_security [69/90] LSM: Use full security context in security_inode_setsecctx [70/90] LSM: Correct handling of ENOSYS in inode_setxattr [71/90] LSM: Infrastructure security blobs for mount options [72/90] LSM: Fix for security_init_inode_security [73/90] Smack: Advertise the secid to netlabel [74/90] LSM: Change error detection for UDP peer security [75/90] Smack: Fix setting of the CIPSO MLS_CAT flags [76/90] Smack: Set netlabel flags properly on new label import [77/90] Netlabel: Add a secattr comparison API function [78/90] Smack: Let netlabel do the work on the ambient domain [79/90] Smack: Don't set the socket label on each send [80/90] Smack: Let netlabel do the work on connections [81/90] Netlabel: Return the labeling type on socket

Message ID

20190419004617.64627-20-casey@schaufler-ca.com (mailing list archive)

State

Not Applicable

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com
Subject: [PATCH 19/90] LSM: Use lsm_export in security_ipc_getsecid
Date: Thu, 18 Apr 2019 17:45:06 -0700
Message-Id: <20190419004617.64627-20-casey@schaufler-ca.com>
In-Reply-To: <20190419004617.64627-1-casey@schaufler-ca.com>
References: <20190419004617.64627-1-casey@schaufler-ca.com>
Sender: selinux-owner@vger.kernel.org
Precedence: bulk

Series

LSM: Module stacking for all | expand

Commit Message

Casey Schaufler April 19, 2019, 12:45 a.m. UTC

Convert security_ipc_getsecid to use the lsm_export structure
instead of a u32 secid. There is some scaffolding involved
that will be removed when the related data is updated.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 include/linux/security.h | 7 ++++---
 kernel/auditsc.c         | 4 +++-
 security/security.c      | 8 +++-----
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 5cea6260bbd9..6ac48c7c4a41 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -411,7 +411,7 @@  int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 			unsigned long arg4, unsigned long arg5);
 void security_task_to_inode(struct task_struct *p, struct inode *inode);
 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
-void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
+void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsm_export *l);
 int security_msg_msg_alloc(struct msg_msg *msg);
 void security_msg_msg_free(struct msg_msg *msg);
 int security_msg_queue_alloc(struct kern_ipc_perm *msq);
@@ -1096,9 +1096,10 @@  static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
 	return 0;
 }
 
-static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
+static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp,
+					 struct lsm_export *l)
 {
-	*secid = 0;
+	lsm_export_init(l);
 }
 
 static inline int security_msg_msg_alloc(struct msg_msg *msg)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 83aba0336eac..eabbf78fee96 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2266,11 +2266,13 @@  void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
 void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
 	struct audit_context *context = audit_context();
+	struct lsm_export le;
 	context->ipc.uid = ipcp->uid;
 	context->ipc.gid = ipcp->gid;
 	context->ipc.mode = ipcp->mode;
 	context->ipc.has_perm = 0;
-	security_ipc_getsecid(ipcp, &context->ipc.osid);
+	security_ipc_getsecid(ipcp, &le);
+	lsm_export_secid(&le, &context->ipc.osid);
 	context->type = AUDIT_IPC;
 }
 
diff --git a/security/security.c b/security/security.c
index b6a096be95ac..6ba1187c9655 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1775,12 +1775,10 @@  int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
 	return call_int_hook(ipc_permission, 0, ipcp, flag);
 }
 
-void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
+void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsm_export *l)
 {
-	struct lsm_export data = { .flags = LSM_EXPORT_NONE };
-
-	call_void_hook(ipc_getsecid, ipcp, &data);
-	lsm_export_secid(&data, secid);
+	lsm_export_init(l);
+	call_void_hook(ipc_getsecid, ipcp, l);
 }
 
 int security_msg_msg_alloc(struct msg_msg *msg)

[19/90] LSM: Use lsm_export in security_ipc_getsecid

Commit Message

Patch