Skip to content

Commit 313ddd1

Browse files
cschauflerAndrea Righi
cschaufler
authored and
Andrea Righi
committed
UBUNTU: SAUCE: apparmor4.0.0 [29/76]: Stacking v38: LSM: Use lsmcontext in security_secid_to_secctx
BugLink: https://bugs.launchpad.net/bugs/2028253 Replace the (secctx,seclen) pointer pair with a single lsmcontext pointer to allow return of the LSM identifier along with the context and context length. This allows security_release_secctx() to know how to release the context. Callers have been modified to use or save the returned data from the new structure. security_secid_to_secctx() will now return the length value if the passed lsmcontext pointer is NULL. Signed-off-by: Casey Schaufler <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Signed-off-by: John Johansen <[email protected]> (cherry picked from https://gitlab.com/jjohansen/apparmor-kernel) Signed-off-by: Andrea Righi <[email protected]>
1 parent de6f87b commit 313ddd1

File tree

12 files changed

+96
-137
lines changed

12 files changed

+96
-137
lines changed

‎drivers/android/binder.c

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2920,9 +2920,7 @@ static void binder_transaction(struct binder_proc *proc,
29202920
struct binder_context *context = proc->context;
29212921
int t_debug_id = atomic_inc_return(&binder_last_id);
29222922
ktime_t t_start_time = ktime_get();
2923-
char *secctx = NULL;
2924-
u32 secctx_sz = 0;
2925-
struct lsmcontext scaff; /* scaffolding */
2923+
struct lsmcontext lsmctx = { };
29262924
struct list_head sgc_head;
29272925
struct list_head pf_head;
29282926
const void __user *user_buffer = (const void __user *)
@@ -3201,7 +3199,7 @@ static void binder_transaction(struct binder_proc *proc,
32013199
size_t added_size;
32023200

32033201
security_cred_getsecid(proc->cred, &blob);
3204-
ret = security_secid_to_secctx(&blob, &secctx, &secctx_sz);
3202+
ret = security_secid_to_secctx(&blob, &lsmctx);
32053203
if (ret) {
32063204
binder_txn_error("%d:%d failed to get security context\n",
32073205
thread->pid, proc->pid);
@@ -3210,7 +3208,7 @@ static void binder_transaction(struct binder_proc *proc,
32103208
return_error_line = __LINE__;
32113209
goto err_get_secctx_failed;
32123210
}
3213-
added_size = ALIGN(secctx_sz, sizeof(u64));
3211+
added_size = ALIGN(lsmctx.len, sizeof(u64));
32143212
extra_buffers_size += added_size;
32153213
if (extra_buffers_size < added_size) {
32163214
binder_txn_error("%d:%d integer overflow of extra_buffers_size\n",
@@ -3244,24 +3242,22 @@ static void binder_transaction(struct binder_proc *proc,
32443242
t->buffer = NULL;
32453243
goto err_binder_alloc_buf_failed;
32463244
}
3247-
if (secctx) {
3245+
if (lsmctx.context) {
32483246
int err;
32493247
size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
32503248
ALIGN(tr->offsets_size, sizeof(void *)) +
32513249
ALIGN(extra_buffers_size, sizeof(void *)) -
3252-
ALIGN(secctx_sz, sizeof(u64));
3250+
ALIGN(lsmctx.len, sizeof(u64));
32533251

32543252
t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset;
32553253
err = binder_alloc_copy_to_buffer(&target_proc->alloc,
32563254
t->buffer, buf_offset,
3257-
secctx, secctx_sz);
3255+
lsmctx.context, lsmctx.len);
32583256
if (err) {
32593257
t->security_ctx = 0;
32603258
WARN_ON(1);
32613259
}
3262-
lsmcontext_init(&scaff, secctx, secctx_sz, 0);
3263-
security_release_secctx(&scaff);
3264-
secctx = NULL;
3260+
security_release_secctx(&lsmctx);
32653261
}
32663262
t->buffer->debug_id = t->debug_id;
32673263
t->buffer->transaction = t;
@@ -3305,7 +3301,7 @@ static void binder_transaction(struct binder_proc *proc,
33053301
off_end_offset = off_start_offset + tr->offsets_size;
33063302
sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
33073303
sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
3308-
ALIGN(secctx_sz, sizeof(u64));
3304+
ALIGN(lsmctx.len, sizeof(u64));
33093305
off_min = 0;
33103306
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
33113307
buffer_offset += sizeof(binder_size_t)) {
@@ -3684,10 +3680,8 @@ static void binder_transaction(struct binder_proc *proc,
36843680
binder_alloc_free_buf(&target_proc->alloc, t->buffer);
36853681
err_binder_alloc_buf_failed:
36863682
err_bad_extra_size:
3687-
if (secctx) {
3688-
lsmcontext_init(&scaff, secctx, secctx_sz, 0);
3689-
security_release_secctx(&scaff);
3690-
}
3683+
if (lsmctx.context)
3684+
security_release_secctx(&lsmctx);
36913685
err_get_secctx_failed:
36923686
kfree(tcomplete);
36933687
binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);

‎include/linux/security.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -642,7 +642,7 @@ int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
642642
int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
643643
int security_netlink_send(struct sock *sk, struct sk_buff *skb);
644644
int security_ismaclabel(const char *name);
645-
int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen);
645+
int security_secid_to_secctx(struct lsmblob *blob, struct lsmcontext *cp);
646646
int security_secctx_to_secid(const char *secdata, u32 seclen,
647647
struct lsmblob *blob);
648648
void security_release_secctx(struct lsmcontext *cp);
@@ -1528,7 +1528,7 @@ static inline int security_ismaclabel(const char *name)
15281528
}
15291529

15301530
static inline int security_secid_to_secctx(struct lsmblob *blob,
1531-
char **secdata, u32 *seclen)
1531+
struct lsmcontext *cp)
15321532
{
15331533
return -EOPNOTSUPP;
15341534
}

‎include/net/scm.h

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,21 +94,18 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
9494
{
9595
struct lsmcontext context;
9696
struct lsmblob lb;
97-
char *secdata;
98-
u32 seclen;
9997
int err;
10098

10199
if (test_bit(SOCK_PASSSEC, &sock->flags)) {
102100
/* There can only be one security module using the secid,
103101
* and the infrastructure will know which it is.
104102
*/
105103
lsmblob_init(&lb, scm->secid);
106-
err = security_secid_to_secctx(&lb, &secdata, &seclen);
104+
err = security_secid_to_secctx(&lb, &context);
107105

108106
if (!err) {
109-
put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata);
110-
/*scaffolding*/
111-
lsmcontext_init(&context, secdata, seclen, 0);
107+
put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, context.len,
108+
context.context);
112109
security_release_secctx(&context);
113110
}
114111
}

‎kernel/audit.c

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1210,9 +1210,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
12101210
struct audit_buffer *ab;
12111211
u16 msg_type = nlh->nlmsg_type;
12121212
struct audit_sig_info *sig_data;
1213-
char *ctx = NULL;
1214-
u32 len;
1215-
struct lsmcontext scaff; /* scaffolding */
12161213

12171214
err = audit_netlink_ok(skb, msg_type);
12181215
if (err)
@@ -1460,33 +1457,33 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
14601457
kfree(new);
14611458
break;
14621459
}
1463-
case AUDIT_SIGNAL_INFO:
1464-
len = 0;
1460+
case AUDIT_SIGNAL_INFO: {
1461+
struct lsmcontext context = { };
1462+
14651463
if (lsmblob_is_set(&audit_sig_lsm)) {
1466-
err = security_secid_to_secctx(&audit_sig_lsm, &ctx,
1467-
&len);
1464+
err = security_secid_to_secctx(&audit_sig_lsm,
1465+
&context);
14681466
if (err)
14691467
return err;
14701468
}
1471-
sig_data = kmalloc(struct_size(sig_data, ctx, len), GFP_KERNEL);
1469+
sig_data = kmalloc(struct_size(sig_data, ctx, context.len),
1470+
GFP_KERNEL);
14721471
if (!sig_data) {
1473-
if (lsmblob_is_set(&audit_sig_lsm)) {
1474-
lsmcontext_init(&scaff, ctx, len, 0);
1475-
security_release_secctx(&scaff);
1476-
}
1472+
if (lsmblob_is_set(&audit_sig_lsm))
1473+
security_release_secctx(&context);
14771474
return -ENOMEM;
14781475
}
14791476
sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
14801477
sig_data->pid = audit_sig_pid;
14811478
if (lsmblob_is_set(&audit_sig_lsm)) {
1482-
memcpy(sig_data->ctx, ctx, len);
1483-
lsmcontext_init(&scaff, ctx, len, 0);
1484-
security_release_secctx(&scaff);
1479+
memcpy(sig_data->ctx, context.context, context.len);
1480+
security_release_secctx(&context);
14851481
}
1486-
audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
1487-
sig_data, struct_size(sig_data, ctx, len));
1482+
audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, sig_data,
1483+
struct_size(sig_data, ctx, context.len));
14881484
kfree(sig_data);
14891485
break;
1486+
}
14901487
case AUDIT_TTY_GET: {
14911488
struct audit_tty_status s;
14921489
unsigned int t;
@@ -2169,27 +2166,24 @@ void audit_log_key(struct audit_buffer *ab, char *key)
21692166

21702167
int audit_log_task_context(struct audit_buffer *ab)
21712168
{
2172-
char *ctx = NULL;
2173-
unsigned len;
21742169
int error;
21752170
struct lsmblob blob;
2176-
struct lsmcontext scaff; /* scaffolding */
2171+
struct lsmcontext context;
21772172

21782173
security_current_getsecid_subj(&blob);
21792174
if (!lsmblob_is_set(&blob))
21802175
return 0;
21812176

2182-
error = security_secid_to_secctx(&blob, &ctx, &len);
2177+
error = security_secid_to_secctx(&blob, &context);
21832178

21842179
if (error) {
21852180
if (error != -EINVAL)
21862181
goto error_path;
21872182
return 0;
21882183
}
21892184

2190-
audit_log_format(ab, " subj=%s", ctx);
2191-
lsmcontext_init(&scaff, ctx, len, 0);
2192-
security_release_secctx(&scaff);
2185+
audit_log_format(ab, " subj=%s", context.context);
2186+
security_release_secctx(&context);
21932187
return 0;
21942188

21952189
error_path:

‎kernel/auditsc.c

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1100,9 +1100,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
11001100
struct lsmblob *blob, char *comm)
11011101
{
11021102
struct audit_buffer *ab;
1103-
struct lsmcontext lsmcxt;
1104-
char *ctx = NULL;
1105-
u32 len;
1103+
struct lsmcontext lsmctx;
11061104
int rc = 0;
11071105

11081106
ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
@@ -1113,13 +1111,12 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
11131111
from_kuid(&init_user_ns, auid),
11141112
from_kuid(&init_user_ns, uid), sessionid);
11151113
if (lsmblob_is_set(blob)) {
1116-
if (security_secid_to_secctx(blob, &ctx, &len)) {
1114+
if (security_secid_to_secctx(blob, &lsmctx)) {
11171115
audit_log_format(ab, " obj=(none)");
11181116
rc = 1;
11191117
} else {
1120-
audit_log_format(ab, " obj=%s", ctx);
1121-
lsmcontext_init(&lsmcxt, ctx, len, 0); /*scaffolding*/
1122-
security_release_secctx(&lsmcxt);
1118+
audit_log_format(ab, " obj=%s", lsmctx.context);
1119+
security_release_secctx(&lsmctx);
11231120
}
11241121
}
11251122
audit_log_format(ab, " ocomm=");
@@ -1375,7 +1372,6 @@ static void audit_log_time(struct audit_context *context, struct audit_buffer **
13751372

13761373
static void show_special(struct audit_context *context, int *call_panic)
13771374
{
1378-
struct lsmcontext lsmcxt;
13791375
struct audit_buffer *ab;
13801376
int i;
13811377

@@ -1400,17 +1396,15 @@ static void show_special(struct audit_context *context, int *call_panic)
14001396
from_kgid(&init_user_ns, context->ipc.gid),
14011397
context->ipc.mode);
14021398
if (osid) {
1403-
char *ctx = NULL;
1404-
u32 len;
1399+
struct lsmcontext lsmcxt;
14051400
struct lsmblob blob;
14061401

14071402
lsmblob_init(&blob, osid);
1408-
if (security_secid_to_secctx(&blob, &ctx, &len)) {
1403+
if (security_secid_to_secctx(&blob, &lsmcxt)) {
14091404
audit_log_format(ab, " osid=%u", osid);
14101405
*call_panic = 1;
14111406
} else {
1412-
audit_log_format(ab, " obj=%s", ctx);
1413-
lsmcontext_init(&lsmcxt, ctx, len, 0);
1407+
audit_log_format(ab, " obj=%s", lsmcxt.context);
14141408
security_release_secctx(&lsmcxt);
14151409
}
14161410
}
@@ -1570,20 +1564,17 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
15701564
MAJOR(n->rdev),
15711565
MINOR(n->rdev));
15721566
if (n->osid != 0) {
1573-
char *ctx = NULL;
1574-
u32 len;
15751567
struct lsmblob blob;
1576-
struct lsmcontext lsmcxt;
1568+
struct lsmcontext lsmctx;
15771569

15781570
lsmblob_init(&blob, n->osid);
1579-
if (security_secid_to_secctx(&blob, &ctx, &len)) {
1571+
if (security_secid_to_secctx(&blob, &lsmctx)) {
15801572
audit_log_format(ab, " osid=%u", n->osid);
15811573
if (call_panic)
15821574
*call_panic = 2;
15831575
} else {
1584-
audit_log_format(ab, " obj=%s", ctx);
1585-
lsmcontext_init(&lsmcxt, ctx, len, 0); /* scaffolding */
1586-
security_release_secctx(&lsmcxt);
1576+
audit_log_format(ab, " obj=%s", lsmctx.context);
1577+
security_release_secctx(&lsmctx);
15871578
}
15881579
}
15891580

‎net/ipv4/ip_sockglue.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -132,21 +132,19 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
132132
{
133133
struct lsmcontext context;
134134
struct lsmblob lb;
135-
char *secdata;
136-
u32 seclen, secid;
135+
u32 secid;
137136
int err;
138137

139138
err = security_socket_getpeersec_dgram(NULL, skb, &secid);
140139
if (err)
141140
return;
142141

143142
lsmblob_init(&lb, secid);
144-
err = security_secid_to_secctx(&lb, &secdata, &seclen);
143+
err = security_secid_to_secctx(&lb, &context);
145144
if (err)
146145
return;
147146

148-
put_cmsg(msg, SOL_IP, SCM_SECURITY, seclen, secdata);
149-
lsmcontext_init(&context, secdata, seclen, 0); /* scaffolding */
147+
put_cmsg(msg, SOL_IP, SCM_SECURITY, context.len, context.context);
150148
security_release_secctx(&context);
151149
}
152150

‎net/netfilter/nf_conntrack_netlink.c

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -356,16 +356,15 @@ static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct,
356356
static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
357357
{
358358
struct nlattr *nest_secctx;
359-
int len, ret;
360-
char *secctx;
359+
int ret;
361360
struct lsmblob blob;
362361
struct lsmcontext context;
363362

364363
/* lsmblob_init() puts ct->secmark into all of the secids in blob.
365364
* security_secid_to_secctx() will know which security module
366365
* to use to create the secctx. */
367366
lsmblob_init(&blob, ct->secmark);
368-
ret = security_secid_to_secctx(&blob, &secctx, &len);
367+
ret = security_secid_to_secctx(&blob, &context);
369368
if (ret)
370369
return 0;
371370

@@ -374,13 +373,12 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
374373
if (!nest_secctx)
375374
goto nla_put_failure;
376375

377-
if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
376+
if (nla_put_string(skb, CTA_SECCTX_NAME, context.context))
378377
goto nla_put_failure;
379378
nla_nest_end(skb, nest_secctx);
380379

381380
ret = 0;
382381
nla_put_failure:
383-
lsmcontext_init(&context, secctx, len, 0); /* scaffolding */
384382
security_release_secctx(&context);
385383
return ret;
386384
}
@@ -673,15 +671,11 @@ static inline size_t ctnetlink_acct_size(const struct nf_conn *ct)
673671
static inline int ctnetlink_secctx_size(const struct nf_conn *ct)
674672
{
675673
#ifdef CONFIG_NF_CONNTRACK_SECMARK
676-
int len, ret;
674+
int len;
677675
struct lsmblob blob;
678676

679-
/* lsmblob_init() puts ct->secmark into all of the secids in blob.
680-
* security_secid_to_secctx() will know which security module
681-
* to use to create the secctx. */
682-
lsmblob_init(&blob, ct->secmark);
683-
ret = security_secid_to_secctx(&blob, NULL, &len);
684-
if (ret)
677+
len = security_secid_to_secctx(&blob, NULL);
678+
if (len <= 0)
685679
return 0;
686680

687681
return nla_total_size(0) /* CTA_SECCTX */

‎net/netfilter/nf_conntrack_standalone.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -176,19 +176,16 @@ static void ct_seq_stop(struct seq_file *s, void *v)
176176
static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
177177
{
178178
int ret;
179-
u32 len;
180-
char *secctx;
181179
struct lsmblob blob;
182180
struct lsmcontext context;
183181

184182
lsmblob_init(&blob, ct->secmark);
185-
ret = security_secid_to_secctx(&blob, &secctx, &len);
183+
ret = security_secid_to_secctx(&blob, &context);
186184
if (ret)
187185
return;
188186

189-
seq_printf(s, "secctx=%s ", secctx);
187+
seq_printf(s, "secctx=%s ", context.context);
190188

191-
lsmcontext_init(&context, secctx, len, 0); /* scaffolding */
192189
security_release_secctx(&context);
193190
}
194191
#else

0 commit comments

Comments
 (0)