Re: [PATCH v4 2/4] LSM: security_lsmblob_to_secctx module selection
From: Paul Moore <paul@paul-moore.com>
Date: 2025-06-16 20:54:52
Also in:
lkml, selinux
On Jun 6, 2025 Casey Schaufler [off-list ref] wrote:
Add a parameter lsmid to security_lsmblob_to_secctx() to identify which of the security modules that may be active should provide the security context. If the value of lsmid is LSM_ID_UNDEF the first LSM providing a hook is used. security_secid_to_secctx() is unchanged, and will always report the first LSM providing a hook. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- include/linux/security.h | 6 ++++-- kernel/audit.c | 4 ++-- kernel/auditsc.c | 8 +++++--- net/netlabel/netlabel_user.c | 3 ++- security/security.c | 13 +++++++++++-- 5 files changed, 24 insertions(+), 10 deletions(-)
...
quoted hunk ↗ jump to hunk
diff --git a/security/security.c b/security/security.c index 2b9dde02f4de..306860434200 100644 --- a/security/security.c +++ b/security/security.c@@ -3774,6 +3774,7 @@ EXPORT_SYMBOL(security_ismaclabel); * security_secid_to_secctx() - Convert a secid to a secctx * @secid: secid * @cp: the LSM context + * @lsmid: which security module to report * * Convert secid to security context. If @cp is NULL the length of the * result will be returned, but no data will be returned. This
You're updating the comment block for the wrong function.
quoted hunk ↗ jump to hunk
@@ -3800,9 +3801,17 @@ EXPORT_SYMBOL(security_secid_to_secctx); * * Return: Return length of data on success, error on failure. */
Since you need to update the patch to fix the problem above, it would probably be a good thing to explain the LSM_ID_UNDEF handling in the function's comment block as you did in the commit description.
-int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp)
+int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp,
+ int lsmid)
{
- return call_int_hook(lsmprop_to_secctx, prop, cp);
+ struct lsm_static_call *scall;
+
+ lsm_for_each_hook(scall, lsmprop_to_secctx) {
+ if (lsmid != LSM_ID_UNDEF && lsmid != scall->hl->lsmid->id)
+ continue;
+ return scall->hl->hook.lsmprop_to_secctx(prop, cp);
+ }
+ return LSM_RET_DEFAULT(lsmprop_to_secctx);
}
EXPORT_SYMBOL(security_lsmprop_to_secctx);
--
2.47.0-- paul-moore.com