--- v14
+++ v26
@@ -1,108 +1,146 @@
-Change netlink netfilter interfaces to use lsmcontext
-pointers, and remove scaffolding.
+Change the security_inode_getsecctx() interface to fill
+a lsmcontext structure instead of data and length pointers.
+This provides the information about which LSM created the
+context so that security_release_secctx() can use the
+correct hook.
-Reviewed-by: Kees Cook <keescook@chromium.org>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Acked-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
-Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
-cc: netdev@vger.kernel.org
+Cc: linux-nfs@vger.kernel.org
---
- net/netfilter/nfnetlink_queue.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
+ fs/nfsd/nfs4xdr.c | 23 +++++++++--------------
+ include/linux/security.h | 5 +++--
+ security/security.c | 13 +++++++++++--
+ 3 files changed, 23 insertions(+), 18 deletions(-)
-diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
-index 2d6668fd026c..a1296453d8f2 100644
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -301,12 +301,10 @@ static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk)
- return -1;
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 089ec4b61ef1..fc7ba114c298 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2727,11 +2727,11 @@ nfsd4_encode_layout_types(struct xdr_stream *xdr, u32 layout_types)
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ static inline __be32
+ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
+- void *context, int len)
++ struct lsmcontext *context)
+ {
+ __be32 *p;
+
+- p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
++ p = xdr_reserve_space(xdr, context->len + 4 + 4 + 4);
+ if (!p)
+ return nfserr_resource;
+
+@@ -2741,13 +2741,13 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
+ */
+ *p++ = cpu_to_be32(0); /* lfs */
+ *p++ = cpu_to_be32(0); /* pi */
+- p = xdr_encode_opaque(p, context, len);
++ p = xdr_encode_opaque(p, context->context, context->len);
+ return 0;
}
+ #else
+ static inline __be32
+ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
+- void *context, int len)
++ struct lsmcontext *context)
+ { return 0; }
+ #endif
--static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
-+static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsmcontext *context)
- {
-- u32 seclen = 0;
- #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
- struct lsmblob blob;
-- struct lsmcontext context = { };
+@@ -2844,9 +2844,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
+ int err;
+ struct nfs4_acl *acl = NULL;
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+- struct lsmcontext scaff; /* scaffolding */
+- void *context = NULL;
+- int contextlen;
++ struct lsmcontext context = { };
+ #endif
+ bool contextsupport = false;
+ struct nfsd4_compoundres *resp = rqstp->rq_resp;
+@@ -2904,7 +2902,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
+ bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
+ if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
+ err = security_inode_getsecctx(d_inode(dentry),
+- &context, &contextlen);
++ &context);
+ else
+ err = -EOPNOTSUPP;
+ contextsupport = (err == 0);
+@@ -3324,8 +3322,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
- if (!skb || !sk_fullsock(skb->sk))
- return 0;
-@@ -314,15 +312,16 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
- read_lock_bh(&skb->sk->sk_callback_lock);
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
+- status = nfsd4_encode_security_label(xdr, rqstp, context,
+- contextlen);
++ status = nfsd4_encode_security_label(xdr, rqstp, &context);
+ if (status)
+ goto out;
+ }
+@@ -3346,10 +3343,8 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
- if (skb->secmark) {
-+ /* Any LSM might be looking for the secmark */
- lsmblob_init(&blob, skb->secmark);
-- security_secid_to_secctx(&blob, &context);
-- *secdata = context.context;
-+ security_secid_to_secctx(&blob, context);
- }
-
- read_unlock_bh(&skb->sk->sk_callback_lock);
-- seclen = context.len;
-+ return context->len;
-+#else
-+ return 0;
- #endif
-- return seclen;
- }
-
- static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
-@@ -398,8 +397,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
- enum ip_conntrack_info uninitialized_var(ctinfo);
- struct nfnl_ct_hook *nfnl_ct;
- bool csum_verify;
-- struct lsmcontext scaff; /* scaffolding */
-- char *secdata = NULL;
-+ struct lsmcontext context = { };
- u32 seclen = 0;
-
- size = nlmsg_total_size(sizeof(struct nfgenmsg))
-@@ -466,7 +464,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
- }
-
- if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
-- seclen = nfqnl_get_sk_secctx(entskb, &secdata);
-+ seclen = nfqnl_get_sk_secctx(entskb, &context);
- if (seclen)
- size += nla_total_size(seclen);
- }
-@@ -601,7 +599,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
- nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
- goto nla_put_failure;
-
-- if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
-+ if (seclen && nla_put(skb, NFQA_SECCTX, context.len, context.context))
- goto nla_put_failure;
-
- if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
-@@ -629,10 +627,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
- }
-
- nlh->nlmsg_len = skb->len;
-- if (seclen) {
-- lsmcontext_init(&scaff, secdata, seclen, 0);
+ out:
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+- if (context) {
+- lsmcontext_init(&scaff, context, contextlen, 0); /*scaffolding*/
- security_release_secctx(&scaff);
- }
-+ if (seclen)
++ if (context.context)
+ security_release_secctx(&context);
- return skb;
+ #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
+ kfree(acl);
+ if (tempfh) {
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 666bd85e142b..0129400ff6e9 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -585,7 +585,7 @@ void security_release_secctx(struct lsmcontext *cp);
+ void security_inode_invalidate_secctx(struct inode *inode);
+ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
+ int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
+-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
++int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp);
+ int security_locked_down(enum lockdown_reason what);
+ #else /* CONFIG_SECURITY */
- nla_put_failure:
-@@ -640,10 +636,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
- kfree_skb(skb);
- net_err_ratelimited("nf_queue: error creating packet message\n");
- nlmsg_failure:
-- if (seclen) {
-- lsmcontext_init(&scaff, secdata, seclen, 0);
-- security_release_secctx(&scaff);
-- }
-+ if (seclen)
-+ security_release_secctx(&context);
- return NULL;
+@@ -1461,7 +1461,8 @@ static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32
+ {
+ return -EOPNOTSUPP;
}
+-static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
++static inline int security_inode_getsecctx(struct inode *inode,
++ struct lsmcontext *cp)
+ {
+ return -EOPNOTSUPP;
+ }
+diff --git a/security/security.c b/security/security.c
+index 5bb41ca1fa9f..1e441c3491b5 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -2395,9 +2395,18 @@ int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
+ }
+ EXPORT_SYMBOL(security_inode_setsecctx);
+
+-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
++int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
+ {
+- return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
++ struct security_hook_list *hp;
++
++ memset(cp, 0, sizeof(*cp));
++
++ hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
++ cp->slot = hp->lsmid->slot;
++ return hp->hook.inode_getsecctx(inode, (void **)&cp->context,
++ &cp->len);
++ }
++ return -EOPNOTSUPP;
+ }
+ EXPORT_SYMBOL(security_inode_getsecctx);
--
-2.24.1
+2.29.2