--- v5
+++ v1
@@ -1,62 +1,61 @@
-With the inclusion of the "display" process attribute
-mechanism AppArmor no longer needs to be treated as an
-"exclusive" security module. Remove the flag that indicates
-it is exclusive. Remove the stub getpeersec_dgram AppArmor
-hook as it has no effect in the single LSM case and
-interferes in the multiple LSM case.
+Convert security_cred_getsecid to use the lsm_export structure
+instead of a u32 secid. There is some scaffolding involved
+that will be removed when the related data is updated.
-Reviewed-by: Kees Cook <keescook@chromium.org>
-Reviewed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
- security/apparmor/lsm.c | 20 +-------------------
- 1 file changed, 1 insertion(+), 19 deletions(-)
+ include/linux/security.h | 2 +-
+ security/integrity/ima/ima_main.c | 3 ++-
+ security/security.c | 8 +++-----
+ 3 files changed, 6 insertions(+), 7 deletions(-)
-diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index ec2e39aa9a84..08d9867123a9 100644
---- a/security/apparmor/lsm.c
-+++ b/security/apparmor/lsm.c
-@@ -1079,22 +1079,6 @@ static int apparmor_socket_getpeersec_stream(struct socket *sock,
- return error;
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 2d04687c3fa9..40aa7b9f3c83 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -381,7 +381,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
+ void security_cred_free(struct cred *cred);
+ int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
+ void security_transfer_creds(struct cred *new, const struct cred *old);
+-void security_cred_getsecid(const struct cred *c, u32 *secid);
++void security_cred_getsecid(const struct cred *c, struct lsm_export *l);
+ int security_kernel_act_as(struct cred *new, struct lsm_export *l);
+ int security_kernel_create_files_as(struct cred *new, struct inode *inode);
+ int security_kernel_module_request(char *kmod_name);
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index 1e3cfaf0ee5c..f5efa9ef270d 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -374,7 +374,8 @@ int ima_bprm_check(struct linux_binprm *bprm)
+ if (ret)
+ return ret;
+
+- security_cred_getsecid(bprm->cred, &secid);
++ security_cred_getsecid(bprm->cred, &le);
++ lsm_export_secid(&le, &secid);
+ return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
+ MAY_EXEC, CREDS_CHECK);
+ }
+diff --git a/security/security.c b/security/security.c
+index e12ce930dfd9..69983ad68233 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -1604,12 +1604,10 @@ void security_transfer_creds(struct cred *new, const struct cred *old)
+ call_void_hook(cred_transfer, new, old);
}
--/**
-- * apparmor_socket_getpeersec_dgram - get security label of packet
-- * @sock: the peer socket
-- * @skb: packet data
-- * @secid: pointer to where to put the secid of the packet
-- *
-- * Sets the netlabel socket state on sk from parent
-- */
--static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-- struct sk_buff *skb, u32 *secid)
+-void security_cred_getsecid(const struct cred *c, u32 *secid)
++void security_cred_getsecid(const struct cred *c, struct lsm_export *l)
+ {
+- struct lsm_export data = { .flags = LSM_EXPORT_NONE };
-
--{
-- /* TODO: requires secid support */
-- return -ENOPROTOOPT;
--}
--
- /**
- * apparmor_sock_graft - Initialize newly created socket
- * @sk: child sock
-@@ -1198,8 +1182,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
- #endif
- LSM_HOOK_INIT(socket_getpeersec_stream,
- apparmor_socket_getpeersec_stream),
-- LSM_HOOK_INIT(socket_getpeersec_dgram,
-- apparmor_socket_getpeersec_dgram),
- LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
- #ifdef CONFIG_NETWORK_SECMARK
- LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
-@@ -1710,7 +1692,7 @@ static int __init apparmor_init(void)
+- call_void_hook(cred_getsecid, c, &data);
+- lsm_export_secid(&data, secid);
++ lsm_export_init(l);
++ call_void_hook(cred_getsecid, c, l);
+ }
+ EXPORT_SYMBOL(security_cred_getsecid);
- DEFINE_LSM(apparmor) = {
- .name = "apparmor",
-- .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
-+ .flags = LSM_FLAG_LEGACY_MAJOR,
- .enabled = &apparmor_enabled,
- .blobs = &apparmor_blob_sizes,
- .init = apparmor_init,
--
-2.20.1
+2.19.1