On 3/25/2025 4:44 PM, Fan Wu wrote:

On Wed, Mar 19, 2025 at 7:50 PM Casey Schaufler [off-list ref] wrote:

quoted

Add a parameter lsmid to security_lsmblob_to_secctx() to identify which
of the security modules that may be active should provide the security
context. If the value of lsmid is LSM_ID_UNDEF the first LSM providing
a hook is used. security_secid_to_secctx() is unchanged, and will
always report the first LSM providing a hook.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>

..

quoted

diff --git a/security/security.c b/security/security.c
index 143561ebc3e8..55f9c7ad3f89 100644
--- a/security/security.c
+++ b/security/security.c

@@ -4312,6 +4312,7 @@ EXPORT_SYMBOL(security_ismaclabel);
  * security_secid_to_secctx() - Convert a secid to a secctx
  * @secid: secid
  * @cp: the LSM context
+ * @lsmid: which security module to report
  *
  * Convert secid to security context.  If @cp is NULL the length of the
  * result will be returned, but no data will be returned.  This

@@ -4338,9 +4339,17 @@ EXPORT_SYMBOL(security_secid_to_secctx);
  *
  * Return: Return length of data on success, error on failure.
  */
-int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp)
+int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp,
+                              int lsmid)
 {
-       return call_int_hook(lsmprop_to_secctx, prop, cp);
+       struct lsm_static_call *scall;
+
+       lsm_for_each_hook(scall, lsmprop_to_secctx) {
+               if (lsmid != 0 && lsmid != scall->hl->lsmid->id)

It took me some time to figure out why if LSM_ID_UNDEF is passed the
first LSM providing a hook is used, might be better to change it to:

               if (lsmid != LSM_ID_UNDEF && lsmid != scall->hl->lsmid->id)

Thank you. That change will be in v4.

Otherwise, it works as described. I'm working on adding a new IPE
property based on SELinux file labels, and this just came up as I
needed it. Thank you.

Tested-by: Fan Wu <wufan@kernel.org>

quoted

+                       continue;
+               return scall->hl->hook.lsmprop_to_secctx(prop, cp);
+       }
+       return LSM_RET_DEFAULT(lsmprop_to_secctx);
 }
 EXPORT_SYMBOL(security_lsmprop_to_secctx);

--
2.47.0