On 6/7/2023 3:32 PM, Paul Moore wrote:

On Apr 28, 2023 Casey Schaufler [off-list ref] wrote:

quoted

Add hooks for setselfattr and getselfattr. These hooks are not very
different from their setprocattr and getprocattr equivalents, and
much of the code is shared.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: selinux@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>
---
 security/selinux/hooks.c | 154 +++++++++++++++++++++++++++++++--------
 1 file changed, 124 insertions(+), 30 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2ee92d3fb79d..e78b955e04f8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c

@@ -6542,6 +6559,81 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
 	return error;
 }
 
+static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
+			       size_t *size, u32 flags)
+{
+	char *value;
+	size_t total_len;
+	int len;
+	int rc;
+
+	len = selinux_lsm_getattr(attr, current, &value);
+	if (len < 0)
+		return len;
+
+	total_len = ALIGN(struct_size(ctx, ctx, len), 8);
+
+	if (total_len > *size)
+		rc = -E2BIG;

Hmm.  Since we need to calculate the aligned @total_len value in the
LSM specific code, perhaps it doesn't make sense to also do the
alignment in lsm_fill_user_ctx().  My apologies, I know I was the one
who suggested doing the alignment in a common place previously.

Some future user of lsm_fill_user_ctx() may not need to do the
calculation, so I would be inclined to leave it here. I'm thinking
SO_PEERCONTEXT, or the like. But I'll go with whatever gets the
patchset moving forward.

quoted

+	else if (ctx)
+		rc = lsm_fill_user_ctx(ctx, value, len, LSM_ID_SELINUX, 0);
+	else
+		rc = 1;
+
+	*size = total_len;
+	if (rc < 0)
+		return rc;
+	return 1;
+}

--
paul-moore.com