lkml.org 
[lkml]   [2018]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH v4 16/19] SELinux: Abstract use of ipc security blobs
    From
    Date
    Don't use the ipc->security pointer directly.
    Don't use the msg_msg->security pointer directly.
    Provide helper functions that provides the security blob pointers.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    ---
    security/selinux/hooks.c | 18 +++++++++---------
    security/selinux/include/objsec.h | 13 +++++++++++++
    2 files changed, 22 insertions(+), 9 deletions(-)

    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index 389e51ef48a5..e6cb5fce5437 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -5884,7 +5884,7 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
    struct common_audit_data ad;
    u32 sid = current_sid();

    - isec = ipc_perms->security;
    + isec = selinux_ipc(ipc_perms);

    ad.type = LSM_AUDIT_DATA_IPC;
    ad.u.ipc_id = ipc_perms->key;
    @@ -5941,7 +5941,7 @@ static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
    struct common_audit_data ad;
    u32 sid = current_sid();

    - isec = msq->security;
    + isec = selinux_ipc(msq);

    ad.type = LSM_AUDIT_DATA_IPC;
    ad.u.ipc_id = msq->key;
    @@ -5990,8 +5990,8 @@ static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *m
    u32 sid = current_sid();
    int rc;

    - isec = msq->security;
    - msec = msg->security;
    + isec = selinux_ipc(msq);
    + msec = selinux_msg_msg(msg);

    /*
    * First time through, need to assign label to the message
    @@ -6038,8 +6038,8 @@ static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *m
    u32 sid = task_sid(target);
    int rc;

    - isec = msq->security;
    - msec = msg->security;
    + isec = selinux_ipc(msq);
    + msec = selinux_msg_msg(msg);

    ad.type = LSM_AUDIT_DATA_IPC;
    ad.u.ipc_id = msq->key;
    @@ -6092,7 +6092,7 @@ static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
    struct common_audit_data ad;
    u32 sid = current_sid();

    - isec = shp->security;
    + isec = selinux_ipc(shp);

    ad.type = LSM_AUDIT_DATA_IPC;
    ad.u.ipc_id = shp->key;
    @@ -6189,7 +6189,7 @@ static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
    struct common_audit_data ad;
    u32 sid = current_sid();

    - isec = sma->security;
    + isec = selinux_ipc(sma);

    ad.type = LSM_AUDIT_DATA_IPC;
    ad.u.ipc_id = sma->key;
    @@ -6275,7 +6275,7 @@ static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)

    static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
    {
    - struct ipc_security_struct *isec = ipcp->security;
    + struct ipc_security_struct *isec = selinux_ipc(ipcp);
    *secid = isec->sid;
    }

    diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
    index 591adb374d69..5bf9f280e9b2 100644
    --- a/security/selinux/include/objsec.h
    +++ b/security/selinux/include/objsec.h
    @@ -26,6 +26,7 @@
    #include <linux/in.h>
    #include <linux/spinlock.h>
    #include <linux/lsm_hooks.h>
    +#include <linux/msg.h>
    #include <net/net_namespace.h>
    #include "flask.h"
    #include "avc.h"
    @@ -173,4 +174,16 @@ static inline struct inode_security_struct *selinux_inode(
    return inode->i_security;
    }

    +static inline struct msg_security_struct *selinux_msg_msg(
    + const struct msg_msg *msg_msg)
    +{
    + return msg_msg->security;
    +}
    +
    +static inline struct ipc_security_struct *selinux_ipc(
    + const struct kern_ipc_perm *ipc)
    +{
    + return ipc->security;
    +}
    +
    #endif /* _SELINUX_OBJSEC_H_ */
    --
    2.17.1

    \
     
     \ /
      Last update: 2018-09-22 02:20    [W:4.029 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site