Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-10-23 05:30:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

lsm/stable-6.8 PR 20240131

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmW6ztkUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPPEw//XuPXZwehXAlZO4LqTz6TMnHbFX85
 I9ykns/Io6ku82xFooTF3WaOCcPpdhA0RAYnkCOn+/RfDkVCI12Hs29Ierpr6LUV
 QzIarsNBWXtNrub5YUM8N2WeTKS9XXDF+AimW9aqljdn1hwjqQHGaQzoY99cE/k/
 ZSpxUzBHDI8+VCaAQNlsabnN5zNpVh84SaJM1xs83KObbF4ropWUeBwRElyUhz3c
 IlDXseBcg4vxIBFc9u6cDrHMScxOMLMpJeDPFM5o/3gHgQ2hBtSeByzdQnZHL2DI
 W2B9dUFtduTHMN8LYwpbVLEmee2SpSvOr2GXhVNqaqGfVolKyll8UCTrwI6xxVrh
 Zr8QF4NuWfEsIz7uclUJBIu2UgZqUg+5ejfh3NQWqGqcBZOc6Ze/1AWfOJ9gJmym
 pNk46oxhlF/8oy/Cw1olsD47xc8khJGyq9RDkKYQAU/H5Y6WOAImtPUD21ttaDSl
 tUv8PiZS2KzpFCV2uSmKjKzbtIqHEuWPQw2h07WifSB6cPKCFBWu40CJfeoF/TQX
 k+kTm8yVid6c+E+IFJOyzeG3nvmFXXPjyIfFsTJB7gb7HT25GZSdYcWgPgTT4i0/
 /VZgVIuusjqOCCxmIckRhTvm31WLATTPgb5/FqzfjBOq3Nqg+0k9Ayi8M21R9vf+
 vIKngdt30x5viNg=
 =PjM6
 -----END PGP SIGNATURE-----

Merge tag 'lsm-pr-20240131' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull lsm fixes from Paul Moore:
 "Two small patches to fix some problems relating to LSM hook return
  values and how the individual LSMs interact"

* tag 'lsm-pr-20240131' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: fix default return value of the socket_getpeersec_*() hooks
  lsm: fix the logic in security_inode_getsecctx()
This commit is contained in:
Linus Torvalds 2024-02-01 10:00:28 -08:00
commit 6d805afaf0
2 changed files with 42 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/linux/lsm_hook_defs.h
View File

@ -315,9 +315,9 @@ LSM_HOOK(int, 0, socket_getsockopt, struct socket *sock, int level, int optname)
LSM_HOOK(int, 0, socket_setsockopt, struct socket *sock, int level, int optname)
LSM_HOOK(int, 0, socket_shutdown, struct socket *sock, int how)
LSM_HOOK(int, 0, socket_sock_rcv_skb, struct sock *sk, struct sk_buff *skb)
LSM_HOOK(int, 0, socket_getpeersec_stream, struct socket *sock,
LSM_HOOK(int, -ENOPROTOOPT, socket_getpeersec_stream, struct socket *sock,
sockptr_t optval, sockptr_t optlen, unsigned int len)
LSM_HOOK(int, 0, socket_getpeersec_dgram, struct socket *sock,
LSM_HOOK(int, -ENOPROTOOPT, socket_getpeersec_dgram, struct socket *sock,
struct sk_buff *skb, u32 *secid)
LSM_HOOK(int, 0, sk_alloc_security, struct sock *sk, int family, gfp_t priority)
LSM_HOOK(void, LSM_RET_VOID, sk_free_security, struct sock *sk)

45
security/security.c
View File

@ -4255,7 +4255,19 @@ EXPORT_SYMBOL(security_inode_setsecctx);
*/
int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
{
return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
struct security_hook_list *hp;
int rc;
/*
* Only one module will provide a security context.
*/
hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
rc = hp->hook.inode_getsecctx(inode, ctx, ctxlen);
if (rc != LSM_RET_DEFAULT(inode_getsecctx))
return rc;
}
return LSM_RET_DEFAULT(inode_getsecctx);
}
EXPORT_SYMBOL(security_inode_getsecctx);
@ -4612,8 +4624,20 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
sockptr_t optlen, unsigned int len)
{
return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
optval, optlen, len);
struct security_hook_list *hp;
int rc;
/*
* Only one module will provide a security context.
*/
hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
list) {
rc = hp->hook.socket_getpeersec_stream(sock, optval, optlen,
len);
if (rc != LSM_RET_DEFAULT(socket_getpeersec_stream))
return rc;
}
return LSM_RET_DEFAULT(socket_getpeersec_stream);
}
/**
@ -4633,8 +4657,19 @@ int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
int security_socket_getpeersec_dgram(struct socket *sock,
struct sk_buff *skb, u32 *secid)
{
return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
skb, secid);
struct security_hook_list *hp;
int rc;
/*
* Only one module will provide a security context.
*/
hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
list) {
rc = hp->hook.socket_getpeersec_dgram(sock, skb, secid);
if (rc != LSM_RET_DEFAULT(socket_getpeersec_dgram))
return rc;
}
return LSM_RET_DEFAULT(socket_getpeersec_dgram);
}
EXPORT_SYMBOL(security_socket_getpeersec_dgram);