--- v1
+++ v20
@@ -1,79 +1,57 @@
-Convert security_ipc_getsecid to use the lsm_export structure
-instead of a u32 secid. There is some scaffolding involved
-that will be removed when the related data is updated.
+Verify that the tasks on the ends of a binder transaction
+use the same "display" security module. This prevents confusion
+of security "contexts".
 
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
 Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
 ---
- include/linux/security.h | 7 ++++---
- kernel/auditsc.c         | 4 +++-
- security/security.c      | 8 +++-----
- 3 files changed, 10 insertions(+), 9 deletions(-)
+ security/security.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
 
-diff --git a/include/linux/security.h b/include/linux/security.h
-index 5cea6260bbd9..6ac48c7c4a41 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -411,7 +411,7 @@ int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
- 			unsigned long arg4, unsigned long arg5);
- void security_task_to_inode(struct task_struct *p, struct inode *inode);
- int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
--void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
-+void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsm_export *l);
- int security_msg_msg_alloc(struct msg_msg *msg);
- void security_msg_msg_free(struct msg_msg *msg);
- int security_msg_queue_alloc(struct kern_ipc_perm *msq);
-@@ -1096,9 +1096,10 @@ static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
- 	return 0;
+diff --git a/security/security.c b/security/security.c
+index ddbaf2073b02..95b48721fb17 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -788,9 +788,38 @@ int security_binder_set_context_mgr(struct task_struct *mgr)
+ 	return call_int_hook(binder_set_context_mgr, 0, mgr);
  }
  
--static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
-+static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp,
-+					 struct lsm_export *l)
++/**
++ * security_binder_transaction - Binder driver transaction check
++ * @from: source of the transaction
++ * @to: destination of the transaction
++ *
++ * Verify that the tasks have the same LSM "display", then
++ * call the security module hooks.
++ *
++ * Returns -EINVAL if the displays don't match, or the
++ * result of the security module checks.
++ */
+ int security_binder_transaction(struct task_struct *from,
+ 				struct task_struct *to)
  {
--	*secid = 0;
-+	lsm_export_init(l);
++	int from_display = lsm_task_display(from);
++	int to_display = lsm_task_display(to);
++
++	/*
++	 * If the display is LSMBLOB_INVALID the first module that has
++	 * an entry is used. This will be in the 0 slot.
++	 *
++	 * This is currently only required if the server has requested
++	 * peer contexts, but it would be unwieldly to have too much of
++	 * the binder driver detail here.
++	 */
++	if (from_display == LSMBLOB_INVALID)
++		from_display = 0;
++	if (to_display == LSMBLOB_INVALID)
++		to_display = 0;
++	if (from_display != to_display)
++		return -EINVAL;
++
+ 	return call_int_hook(binder_transaction, 0, from, to);
  }
  
- static inline int security_msg_msg_alloc(struct msg_msg *msg)
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 83aba0336eac..eabbf78fee96 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -2266,11 +2266,13 @@ void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
- void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
- {
- 	struct audit_context *context = audit_context();
-+	struct lsm_export le;
- 	context->ipc.uid = ipcp->uid;
- 	context->ipc.gid = ipcp->gid;
- 	context->ipc.mode = ipcp->mode;
- 	context->ipc.has_perm = 0;
--	security_ipc_getsecid(ipcp, &context->ipc.osid);
-+	security_ipc_getsecid(ipcp, &le);
-+	lsm_export_secid(&le, &context->ipc.osid);
- 	context->type = AUDIT_IPC;
- }
- 
-diff --git a/security/security.c b/security/security.c
-index b6a096be95ac..6ba1187c9655 100644
---- a/security/security.c
-+++ b/security/security.c
-@@ -1775,12 +1775,10 @@ int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
- 	return call_int_hook(ipc_permission, 0, ipcp, flag);
- }
- 
--void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
-+void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsm_export *l)
- {
--	struct lsm_export data = { .flags = LSM_EXPORT_NONE };
--
--	call_void_hook(ipc_getsecid, ipcp, &data);
--	lsm_export_secid(&data, secid);
-+	lsm_export_init(l);
-+	call_void_hook(ipc_getsecid, ipcp, l);
- }
- 
- int security_msg_msg_alloc(struct msg_msg *msg)
 -- 
-2.19.1
+2.24.1