--- v20
+++ v28
@@ -1,453 +1,281 @@
-Change security_secid_to_secctx() to take a lsmblob as input
-instead of a u32 secid. It will then call the LSM hooks
-using the lsmblob element allocated for that module. The
-callers have been updated as well. This allows for the
-possibility that more than one module may be called upon
-to translate a secid to a string, as can occur in the
-audit code.
-
+Change the security_secctx_to_secid interface to use a lsmblob
+structure in place of the single u32 secid in support of
+module stacking. Change its callers to do the same.
+
+The security module hook is unchanged, still passing back a secid.
+The infrastructure passes the correct entry from the lsmblob.
+
+Acked-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
-Reviewed-by: John Johansen <john.johansen@canonical.com>
-Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Cc: netdev@vger.kernel.org
+Cc: netfilter-devel@vger.kernel.org
+To: Pablo Neira Ayuso <pablo@netfilter.org>
---
- drivers/android/binder.c | 12 +++++++++-
- include/linux/security.h | 5 +++--
- include/net/scm.h | 8 ++-----
- kernel/audit.c | 20 +++++++++++++++--
- kernel/auditsc.c | 28 +++++++++++++++++++----
- net/ipv4/ip_sockglue.c | 5 +----
- net/netfilter/nf_conntrack_netlink.c | 14 ++++++++++--
- net/netfilter/nf_conntrack_standalone.c | 4 +++-
- net/netfilter/nfnetlink_queue.c | 11 +++++++--
- net/netlabel/netlabel_unlabeled.c | 30 +++++++++++++++++++++----
- net/netlabel/netlabel_user.c | 6 ++---
- security/security.c | 11 +++++----
- 12 files changed, 117 insertions(+), 37 deletions(-)
-
-diff --git a/drivers/android/binder.c b/drivers/android/binder.c
-index f936530a19b0..40e5e2f5b516 100644
---- a/drivers/android/binder.c
-+++ b/drivers/android/binder.c
-@@ -3111,10 +3111,20 @@ static void binder_transaction(struct binder_proc *proc,
-
- if (target_node && target_node->txn_security_ctx) {
- u32 secid;
-+ struct lsmblob blob;
- size_t added_size;
-
- security_task_getsecid(proc->tsk, &secid);
-- ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
-+ /*
-+ * Later in this patch set security_task_getsecid() will
-+ * provide a lsmblob instead of a secid. lsmblob_init
-+ * is used to ensure that all the secids in the lsmblob
-+ * get the value returned from security_task_getsecid(),
-+ * which means that the one expected by
-+ * security_secid_to_secctx() will be set.
-+ */
-+ lsmblob_init(&blob, secid);
-+ ret = security_secid_to_secctx(&blob, &secctx, &secctx_sz);
- if (ret) {
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
+ include/linux/security.h | 26 ++++++++++++++++++--
+ kernel/cred.c | 4 +---
+ net/netfilter/nft_meta.c | 10 ++++----
+ net/netfilter/xt_SECMARK.c | 7 +++++-
+ net/netlabel/netlabel_unlabeled.c | 23 +++++++++++-------
+ security/security.c | 40 ++++++++++++++++++++++++++-----
+ 6 files changed, 85 insertions(+), 25 deletions(-)
+
diff --git a/include/linux/security.h b/include/linux/security.h
-index f8770c228356..5c66348d9ab0 100644
+index 332df8a1cd4d..986a8f4bcd54 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
-@@ -523,7 +523,7 @@ int security_setprocattr(const char *lsm, const char *name, void *value,
- size_t size);
+@@ -196,6 +196,27 @@ static inline bool lsmblob_equal(struct lsmblob *bloba, struct lsmblob *blobb)
+ extern int lsm_name_to_slot(char *name);
+ extern const char *lsm_slot_to_name(int slot);
+
++/**
++ * lsmblob_value - find the first non-zero value in an lsmblob structure.
++ * @blob: Pointer to the data
++ *
++ * This needs to be used with extreme caution, as the cases where
++ * it is appropriate are rare.
++ *
++ * Return the first secid value set in the lsmblob.
++ * There should only be one.
++ */
++static inline u32 lsmblob_value(const struct lsmblob *blob)
++{
++ int i;
++
++ for (i = 0; i < LSMBLOB_ENTRIES; i++)
++ if (blob->secid[i])
++ return blob->secid[i];
++
++ return 0;
++}
++
+ /* These functions are in security/commoncap.c */
+ extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
+ int cap, unsigned int opts);
+@@ -527,7 +548,8 @@ int security_setprocattr(const char *lsm, const char *name, void *value,
int security_netlink_send(struct sock *sk, struct sk_buff *skb);
int security_ismaclabel(const char *name);
--int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
-+int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen);
- int security_secctx_to_secid(const char *secdata, u32 seclen,
- struct lsmblob *blob);
+ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
+-int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
++int security_secctx_to_secid(const char *secdata, u32 seclen,
++ struct lsmblob *blob);
void security_release_secctx(char *secdata, u32 seclen);
-@@ -1337,7 +1337,8 @@ static inline int security_ismaclabel(const char *name)
+ void security_inode_invalidate_secctx(struct inode *inode);
+ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
+@@ -1382,7 +1404,7 @@ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *secle
+
+ static inline int security_secctx_to_secid(const char *secdata,
+ u32 seclen,
+- u32 *secid)
++ struct lsmblob *blob)
+ {
+ return -EOPNOTSUPP;
+ }
+diff --git a/kernel/cred.c b/kernel/cred.c
+index ea36ec6e1ad8..38b00a1390f4 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -798,14 +798,12 @@ EXPORT_SYMBOL(set_security_override);
+ int set_security_override_from_ctx(struct cred *new, const char *secctx)
+ {
+ struct lsmblob blob;
+- u32 secid;
+ int ret;
+
+- ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
++ ret = security_secctx_to_secid(secctx, strlen(secctx), &blob);
+ if (ret < 0)
+ return ret;
+
+- lsmblob_init(&blob, secid);
+ return set_security_override(new, &blob);
+ }
+ EXPORT_SYMBOL(set_security_override_from_ctx);
+diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
+index a7e01e9952f1..f9448e81798e 100644
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -809,21 +809,21 @@ static const struct nla_policy nft_secmark_policy[NFTA_SECMARK_MAX + 1] = {
+
+ static int nft_secmark_compute_secid(struct nft_secmark *priv)
+ {
+- u32 tmp_secid = 0;
++ struct lsmblob blob;
+ int err;
+
+- err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid);
++ err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &blob);
+ if (err)
+ return err;
+
+- if (!tmp_secid)
++ if (!lsmblob_is_set(&blob))
+ return -ENOENT;
+
+- err = security_secmark_relabel_packet(tmp_secid);
++ err = security_secmark_relabel_packet(lsmblob_value(&blob));
+ if (err)
+ return err;
+
+- priv->secid = tmp_secid;
++ priv->secid = lsmblob_value(&blob);
return 0;
}
--static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
-+static inline int security_secid_to_secctx(struct lsmblob *blob,
-+ char **secdata, u32 *seclen)
- {
- return -EOPNOTSUPP;
- }
-diff --git a/include/net/scm.h b/include/net/scm.h
-index c09f2dfeec88..31ae605fcc0a 100644
---- a/include/net/scm.h
-+++ b/include/net/scm.h
-@@ -97,12 +97,8 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
+index 498a0bf6f044..87ca3a537d1c 100644
+--- a/net/netfilter/xt_SECMARK.c
++++ b/net/netfilter/xt_SECMARK.c
+@@ -42,13 +42,14 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info)
+
+ static int checkentry_lsm(struct xt_secmark_target_info_v1 *info)
+ {
++ struct lsmblob blob;
int err;
- if (test_bit(SOCK_PASSSEC, &sock->flags)) {
-- /* There can currently be only one value in the lsmblob,
-- * so getting it from lsmblob_value is appropriate until
-- * security_secid_to_secctx() is converted to taking a
-- * lsmblob directly. */
-- err = security_secid_to_secctx(lsmblob_value(&scm->lsmblob),
-- &secdata, &seclen);
-+ err = security_secid_to_secctx(&scm->lsmblob, &secdata,
-+ &seclen);
-
- if (!err) {
- put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata);
-diff --git a/kernel/audit.c b/kernel/audit.c
-index 7efaece534a9..605f5125c844 100644
---- a/kernel/audit.c
-+++ b/kernel/audit.c
-@@ -1443,7 +1443,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- case AUDIT_SIGNAL_INFO:
- len = 0;
- if (audit_sig_sid) {
-- err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
-+ struct lsmblob blob;
-+
-+ /*
-+ * lsmblob_init sets all values in the lsmblob
-+ * to audit_sig_sid. This is temporary until
-+ * audit_sig_sid is converted to a lsmblob, which
-+ * happens later in this patch set.
-+ */
-+ lsmblob_init(&blob, audit_sig_sid);
-+ err = security_secid_to_secctx(&blob, &ctx, &len);
- if (err)
- return err;
- }
-@@ -2129,12 +2138,19 @@ int audit_log_task_context(struct audit_buffer *ab)
- unsigned len;
- int error;
- u32 sid;
-+ struct lsmblob blob;
-
- security_task_getsecid(current, &sid);
- if (!sid)
- return 0;
-
-- error = security_secid_to_secctx(sid, &ctx, &len);
-+ /*
-+ * lsmblob_init sets all values in the lsmblob to sid.
-+ * This is temporary until security_task_getsecid is converted
-+ * to use a lsmblob, which happens later in this patch set.
-+ */
-+ lsmblob_init(&blob, sid);
-+ error = security_secid_to_secctx(&blob, &ctx, &len);
- if (error) {
- if (error != -EINVAL)
- goto error_path;
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 7dd6b815a9eb..5f9bdd62f78d 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -673,6 +673,13 @@ static int audit_filter_rules(struct task_struct *tsk,
- security_task_getsecid(tsk, &sid);
- need_sid = 0;
- }
-+ /*
-+ * lsmblob_init sets all values in the lsmblob
-+ * to sid. This is temporary until
-+ * security_task_getsecid() is converted to
-+ * provide a lsmblob, which happens later in
-+ * this patch set.
-+ */
- lsmblob_init(&blob, sid);
- result = security_audit_rule_match(&blob,
- f->type,
-@@ -690,6 +697,13 @@ static int audit_filter_rules(struct task_struct *tsk,
- if (f->lsm_isset) {
- /* Find files that match */
- if (name) {
-+ /*
-+ * lsmblob_init sets all values in the
-+ * lsmblob to sid. This is temporary
-+ * until name->osid is converted to a
-+ * lsmblob, which happens later in
-+ * this patch set.
-+ */
- lsmblob_init(&blob, name->osid);
- result = security_audit_rule_match(
- &blob,
-@@ -995,6 +1009,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
- char *ctx = NULL;
- u32 len;
- int rc = 0;
-+ struct lsmblob blob;
-
- ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
- if (!ab)
-@@ -1004,7 +1019,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
- from_kuid(&init_user_ns, auid),
- from_kuid(&init_user_ns, uid), sessionid);
- if (sid) {
-- if (security_secid_to_secctx(sid, &ctx, &len)) {
-+ lsmblob_init(&blob, sid);
-+ if (security_secid_to_secctx(&blob, &ctx, &len)) {
- audit_log_format(ab, " obj=(none)");
- rc = 1;
- } else {
-@@ -1247,7 +1263,10 @@ static void show_special(struct audit_context *context, int *call_panic)
- if (osid) {
- char *ctx = NULL;
- u32 len;
-- if (security_secid_to_secctx(osid, &ctx, &len)) {
-+ struct lsmblob blob;
-+
-+ lsmblob_init(&blob, osid);
-+ if (security_secid_to_secctx(&blob, &ctx, &len)) {
- audit_log_format(ab, " osid=%u", osid);
- *call_panic = 1;
- } else {
-@@ -1397,9 +1416,10 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
- if (n->osid != 0) {
- char *ctx = NULL;
- u32 len;
-+ struct lsmblob blob;
-
-- if (security_secid_to_secctx(
-- n->osid, &ctx, &len)) {
-+ lsmblob_init(&blob, n->osid);
-+ if (security_secid_to_secctx(&blob, &ctx, &len)) {
- audit_log_format(ab, " osid=%u", n->osid);
- if (call_panic)
- *call_panic = 2;
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index c568574abfae..c235c57d7469 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -139,10 +139,7 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
- if (err)
- return;
-
-- /* There can only be one secid in the lsmblob at this point,
-- * so getting it using lsmblob_value() is sufficient until
-- * security_secid_to_secctx() is changed to use a lsmblob */
-- err = security_secid_to_secctx(lsmblob_value(&lb), &secdata, &seclen);
-+ err = security_secid_to_secctx(&lb, &secdata, &seclen);
- if (err)
- return;
-
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index 832eabecfbdd..380b660d0d39 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -333,8 +333,13 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
- struct nlattr *nest_secctx;
- int len, ret;
- char *secctx;
-+ struct lsmblob blob;
-
-- ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
-+ /* lsmblob_init() puts ct->secmark into all of the secids in blob.
-+ * security_secid_to_secctx() will know which security module
-+ * to use to create the secctx. */
-+ lsmblob_init(&blob, ct->secmark);
-+ ret = security_secid_to_secctx(&blob, &secctx, &len);
- if (ret)
- return 0;
-
-@@ -647,8 +652,13 @@ static inline int ctnetlink_secctx_size(const struct nf_conn *ct)
- {
- #ifdef CONFIG_NF_CONNTRACK_SECMARK
- int len, ret;
-+ struct lsmblob blob;
-
-- ret = security_secid_to_secctx(ct->secmark, NULL, &len);
-+ /* lsmblob_init() puts ct->secmark into all of the secids in blob.
-+ * security_secid_to_secctx() will know which security module
-+ * to use to create the secctx. */
-+ lsmblob_init(&blob, ct->secmark);
-+ ret = security_secid_to_secctx(&blob, NULL, &len);
- if (ret)
- return 0;
-
-diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
-index a604f43e3e6b..18376e68fea6 100644
---- a/net/netfilter/nf_conntrack_standalone.c
-+++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -175,8 +175,10 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
- int ret;
- u32 len;
- char *secctx;
-+ struct lsmblob blob;
-
-- ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
-+ lsmblob_init(&blob, ct->secmark);
-+ ret = security_secid_to_secctx(&blob, &secctx, &len);
- if (ret)
- return;
-
-diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
-index dadfc06245a3..7b00dc833a31 100644
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -305,13 +305,20 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
- {
- u32 seclen = 0;
- #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
-+ struct lsmblob blob;
-+
- if (!skb || !sk_fullsock(skb->sk))
- return 0;
-
- read_lock_bh(&skb->sk->sk_callback_lock);
-
-- if (skb->secmark)
-- security_secid_to_secctx(skb->secmark, secdata, &seclen);
-+ if (skb->secmark) {
-+ /* lsmblob_init() puts ct->secmark into all of the secids in
-+ * blob. security_secid_to_secctx() will know which security
-+ * module to use to create the secctx. */
-+ lsmblob_init(&blob, skb->secmark);
-+ security_secid_to_secctx(&blob, secdata, &seclen);
-+ }
-
- read_unlock_bh(&skb->sk->sk_callback_lock);
- #endif
+ info->secctx[SECMARK_SECCTX_MAX - 1] = '\0';
+ info->secid = 0;
+
+ err = security_secctx_to_secid(info->secctx, strlen(info->secctx),
+- &info->secid);
++ &blob);
+ if (err) {
+ if (err == -EINVAL)
+ pr_info_ratelimited("invalid security context \'%s\'\n",
+@@ -56,6 +57,10 @@ static int checkentry_lsm(struct xt_secmark_target_info_v1 *info)
+ return err;
+ }
+
++ /* xt_secmark_target_info can't be changed to use lsmblobs because
++ * it is exposed as an API. Use lsmblob_value() to get the one
++ * value that got set by security_secctx_to_secid(). */
++ info->secid = lsmblob_value(&blob);
+ if (!info->secid) {
+ pr_info_ratelimited("unable to map security context \'%s\'\n",
+ info->secctx);
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
-index 8948557eaebb..2ebe29ddf05e 100644
+index 2483df0bbd7c..c29a8d7a7070 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
-@@ -376,6 +376,7 @@ int netlbl_unlhsh_add(struct net *net,
- struct audit_buffer *audit_buf = NULL;
- char *secctx = NULL;
- u32 secctx_len;
-+ struct lsmblob blob;
-
- if (addr_len != sizeof(struct in_addr) &&
- addr_len != sizeof(struct in6_addr))
-@@ -438,7 +439,11 @@ int netlbl_unlhsh_add(struct net *net,
- unlhsh_add_return:
- rcu_read_unlock();
- if (audit_buf != NULL) {
-- if (security_secid_to_secctx(secid,
-+ /* lsmblob_init() puts secid into all of the secids in blob.
-+ * security_secid_to_secctx() will know which security module
-+ * to use to create the secctx. */
-+ lsmblob_init(&blob, secid);
-+ if (security_secid_to_secctx(&blob,
- &secctx,
- &secctx_len) == 0) {
- audit_log_format(audit_buf, " sec_obj=%s", secctx);
-@@ -475,6 +480,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
- struct net_device *dev;
- char *secctx;
- u32 secctx_len;
-+ struct lsmblob blob;
-
- spin_lock(&netlbl_unlhsh_lock);
- list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-@@ -494,8 +500,13 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
- addr->s_addr, mask->s_addr);
- if (dev != NULL)
- dev_put(dev);
-+ /* lsmblob_init() puts entry->secid into all of the secids
-+ * in blob. security_secid_to_secctx() will know which
-+ * security module to use to create the secctx. */
-+ if (entry != NULL)
-+ lsmblob_init(&blob, entry->secid);
- if (entry != NULL &&
-- security_secid_to_secctx(entry->secid,
-+ security_secid_to_secctx(&blob,
- &secctx, &secctx_len) == 0) {
- audit_log_format(audit_buf, " sec_obj=%s", secctx);
- security_release_secctx(secctx, secctx_len);
-@@ -537,6 +548,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
- struct net_device *dev;
- char *secctx;
- u32 secctx_len;
-+ struct lsmblob blob;
-
- spin_lock(&netlbl_unlhsh_lock);
- list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
-@@ -555,8 +567,13 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
- addr, mask);
- if (dev != NULL)
- dev_put(dev);
-+ /* lsmblob_init() puts entry->secid into all of the secids
-+ * in blob. security_secid_to_secctx() will know which
-+ * security module to use to create the secctx. */
-+ if (entry != NULL)
-+ lsmblob_init(&blob, entry->secid);
- if (entry != NULL &&
-- security_secid_to_secctx(entry->secid,
-+ security_secid_to_secctx(&blob,
- &secctx, &secctx_len) == 0) {
- audit_log_format(audit_buf, " sec_obj=%s", secctx);
- security_release_secctx(secctx, secctx_len);
-@@ -1082,6 +1099,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
- u32 secid;
- char *secctx;
- u32 secctx_len;
-+ struct lsmblob blob;
-
- data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
- cb_arg->seq, &netlbl_unlabel_gnl_family,
-@@ -1136,7 +1154,11 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
- secid = addr6->secid;
- }
-
-- ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
-+ /* lsmblob_init() secid into all of the secids in blob.
-+ * security_secid_to_secctx() will know which security module
-+ * to use to create the secctx. */
-+ lsmblob_init(&blob, secid);
-+ ret_val = security_secid_to_secctx(&blob, &secctx, &secctx_len);
+@@ -882,7 +882,7 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
+ void *addr;
+ void *mask;
+ u32 addr_len;
+- u32 secid;
++ struct lsmblob blob;
+ struct netlbl_audit audit_info;
+
+ /* Don't allow users to add both IPv4 and IPv6 addresses for a
+@@ -906,13 +906,18 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
+ ret_val = security_secctx_to_secid(
+ nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
+ nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
+- &secid);
++ &blob);
if (ret_val != 0)
- goto list_cb_failure;
- ret_val = nla_put(cb_arg->skb,
-diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
-index 3ed4fea2a2de..893301ae0131 100644
---- a/net/netlabel/netlabel_user.c
-+++ b/net/netlabel/netlabel_user.c
-@@ -86,6 +86,7 @@ struct audit_buffer *netlbl_audit_start_common(int type,
- struct audit_buffer *audit_buf;
- char *secctx;
- u32 secctx_len;
-+ struct lsmblob blob;
-
- if (audit_enabled == AUDIT_OFF)
- return NULL;
-@@ -98,10 +99,9 @@ struct audit_buffer *netlbl_audit_start_common(int type,
- from_kuid(&init_user_ns, audit_info->loginuid),
- audit_info->sessionid);
-
-+ lsmblob_init(&blob, audit_info->secid);
- if (audit_info->secid != 0 &&
-- security_secid_to_secctx(audit_info->secid,
-- &secctx,
-- &secctx_len) == 0) {
-+ security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) {
- audit_log_format(audit_buf, " subj=%s", secctx);
- security_release_secctx(secctx, secctx_len);
- }
+ return ret_val;
+
++ /* netlbl_unlhsh_add will be changed to pass a struct lsmblob *
++ * instead of a u32 later in this patch set. security_secctx_to_secid()
++ * will only be setting one entry in the lsmblob struct, so it is
++ * safe to use lsmblob_value() to get that one value. */
++
+ return netlbl_unlhsh_add(&init_net,
+- dev_name, addr, mask, addr_len, secid,
+- &audit_info);
++ dev_name, addr, mask, addr_len,
++ lsmblob_value(&blob), &audit_info);
+ }
+
+ /**
+@@ -933,7 +938,7 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
+ void *addr;
+ void *mask;
+ u32 addr_len;
+- u32 secid;
++ struct lsmblob blob;
+ struct netlbl_audit audit_info;
+
+ /* Don't allow users to add both IPv4 and IPv6 addresses for a
+@@ -955,13 +960,15 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
+ ret_val = security_secctx_to_secid(
+ nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
+ nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
+- &secid);
++ &blob);
+ if (ret_val != 0)
+ return ret_val;
+
++ /* security_secctx_to_secid() will only put one secid into the lsmblob
++ * so it's safe to use lsmblob_value() to get the secid. */
+ return netlbl_unlhsh_add(&init_net,
+- NULL, addr, mask, addr_len, secid,
+- &audit_info);
++ NULL, addr, mask, addr_len,
++ lsmblob_value(&blob), &audit_info);
+ }
+
+ /**
diff --git a/security/security.c b/security/security.c
-index 5c2ed1db0658..ce0934395c53 100644
+index 69474918be8b..1621a28bf9c4 100644
--- a/security/security.c
+++ b/security/security.c
-@@ -2046,17 +2046,16 @@ int security_ismaclabel(const char *name)
- }
- EXPORT_SYMBOL(security_ismaclabel);
-
--int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
-+int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen)
- {
- struct security_hook_list *hp;
- int rc;
-
-- /*
-- * Currently, only one LSM can implement secid_to_secctx (i.e this
-- * LSM hook is not "stackable").
-- */
- hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
-- rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
+@@ -2193,10 +2193,22 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ }
+ EXPORT_SYMBOL(security_secid_to_secctx);
+
+-int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
++int security_secctx_to_secid(const char *secdata, u32 seclen,
++ struct lsmblob *blob)
+ {
+- *secid = 0;
+- return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
++ struct security_hook_list *hp;
++ int rc;
++
++ lsmblob_init(blob, 0);
++ hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, list) {
+ if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
+ continue;
-+ rc = hp->hook.secid_to_secctx(blob->secid[hp->lsmid->slot],
-+ secdata, seclen);
- if (rc != LSM_RET_DEFAULT(secid_to_secctx))
- return rc;
- }
++ rc = hp->hook.secctx_to_secid(secdata, seclen,
++ &blob->secid[hp->lsmid->slot]);
++ if (rc != 0)
++ return rc;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL(security_secctx_to_secid);
+
+@@ -2347,10 +2359,26 @@ int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
+ optval, optlen, len);
+ }
+
+-int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
++int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb,
++ u32 *secid)
+ {
+- return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
+- skb, secid);
++ struct security_hook_list *hp;
++ int rc = -ENOPROTOOPT;
++
++ /*
++ * Only one security module should provide a real hook for
++ * this. A stub or bypass like is used in BPF should either
++ * (somehow) leave rc unaltered or return -ENOPROTOOPT.
++ */
++ hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
++ list) {
++ if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
++ continue;
++ rc = hp->hook.socket_getpeersec_dgram(sock, skb, secid);
++ if (rc != -ENOPROTOOPT)
++ break;
++ }
++ return rc;
+ }
+ EXPORT_SYMBOL(security_socket_getpeersec_dgram);
+
--
-2.24.1
-
+2.31.1
+