[PATCH 36/97] NET: Remove netfilter scaffolding for lsm_export
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-02-28 22:20:41
Also in:
selinux
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Remove scaffolding functions from the netfilter code. Replace with direct access to lsm_export fields so as to be explicit about how the secmarks are being handled. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- net/netfilter/nf_conntrack_netlink.c | 12 ++++++++++-- net/netfilter/nf_conntrack_standalone.c | 9 +++++++-- net/netfilter/nfnetlink_queue.c | 8 ++++++-- 3 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d19092fc6580..65741838985f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c@@ -332,7 +332,11 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) char *secctx; struct lsm_export le; - lsm_export_to_all(&le, ct->secmark); + lsm_export_init(&le); + le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; + le.selinux = ct->secmark; + le.smack = ct->secmark; + ret = security_secid_to_secctx(&le, &secctx, &len); if (ret) return 0;
@@ -619,7 +623,11 @@ static inline int ctnetlink_secctx_size(const struct nf_conn *ct) int len, ret; struct lsm_export le; - lsm_export_to_all(&le, ct->secmark); + lsm_export_init(&le); + le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; + le.selinux = ct->secmark; + le.smack = ct->secmark; + ret = security_secid_to_secctx(&le, NULL, &len); if (ret) return 0;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 51dc1e390d84..b47ca79b8e14 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c@@ -173,8 +173,13 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) char *secctx; struct lsm_export le; - lsm_export_to_all(&le, ct->secmark); - ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + /* Whichever LSM may be using the secmark */ + lsm_export_init(&le); + le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; + le.selinux = ct->secmark; + le.smack = ct->secmark; + + ret = security_secid_to_secctx(&le, &secctx, &len); if (ret) return;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 537effb6e5be..a0670137477b 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c@@ -317,8 +317,12 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata) read_lock_bh(&skb->sk->sk_callback_lock); if (skb->secmark) { - lsm_export_to_all(&le, skb->secmark); - security_secid_to_secctx(skb->secmark, secdata, &seclen); + /* Whichever LSM may be using the secmark */ + lsm_export_init(&le); + le.flags = LSM_EXPORT_SELINUX | LSM_EXPORT_SMACK; + le.selinux = skb->secmark; + le.smack = skb->secmark; + security_secid_to_secctx(&le, secdata, &seclen); } read_unlock_bh(&skb->sk->sk_callback_lock);
--
2.17.0