lsm: fix the logic in security_inode_getsecctx()

BugLink: https://bugs.launchpad.net/bugs/2061814

commit 99b817c upstream.

The inode_getsecctx LSM hook has previously been corrected to have
-EOPNOTSUPP instead of 0 as the default return value to fix BPF LSM
behavior. However, the call_int_hook()-generated loop in
security_inode_getsecctx() was left treating 0 as the neutral value, so
after an LSM returns 0, the loop continues to try other LSMs, and if one
of them returns a non-zero value, the function immediately returns with
said value. So in a situation where SELinux and the BPF LSMs registered
this hook, -EOPNOTSUPP would be incorrectly returned whenever SELinux
returned 0.

Fix this by open-coding the call_int_hook() loop and making it use the
correct LSM_RET_DEFAULT() value as the neutral one, similar to what
other hooks do.

Cc: [email protected]
Reported-by: Stephen Smalley <[email protected]>
Link: https://lore.kernel.org/selinux/CAEjxPJ4ev-pasUwGx48fDhnmjBnq_Wh90jYPwRQRAqXxmOKD4Q@mail.gmail.com/
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2257983
Fixes: b36995b ("lsm: fix default return value for inode_getsecctx")
Signed-off-by: Ondrej Mosnacek <[email protected]>
Reviewed-by: Casey Schaufler <[email protected]>
[PM: subject line tweak]
Signed-off-by: Paul Moore <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
[portias: most of this commit is already applied by commit 7da596e"UBUNTU:
SAUCE: apparmor4.0.0 [30/76]: Stacking v38: LSM: Use lsmcontext in
security_inode_getsecctx" slight variation in this patch which is applied]
Signed-off-by: Portia Stephens <[email protected]>
Signed-off-by: Roxana Nicolescu <[email protected]>

Author: WOnder93

security/security.c

@@ -4283,7 +4283,7 @@ int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
 		return hp->hook.inode_getsecctx(inode, (void **)&cp->context,
 						&cp->len);
 	}
-	return -EOPNOTSUPP;
+	return LSM_RET_DEFAULT(inode_getsecctx);
 }
 EXPORT_SYMBOL(security_inode_getsecctx);