lkml.org 
[lkml]   [2018]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v5 32/38] Smack: Abstract use of inode security blob
    Date
    Don't use the inode->i_security pointer directly.
    Provide a helper function that provides the security blob pointer.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    security/smack/smack.h | 9 +++++++--
    security/smack/smack_lsm.c | 32 ++++++++++++++++----------------
    2 files changed, 23 insertions(+), 18 deletions(-)

    diff --git a/security/smack/smack.h b/security/smack/smack.h
    index 2007d38d0e46..436231dfae33 100644
    --- a/security/smack/smack.h
    +++ b/security/smack/smack.h
    @@ -368,12 +368,17 @@ static inline struct smack_known **smack_file(const struct file *file)
    smack_blob_sizes.lbs_file);
    }

    +static inline struct inode_smack *smack_inode(const struct inode *inode)
    +{
    + return inode->i_security;
    +}
    +
    /*
    * Is the directory transmuting?
    */
    static inline int smk_inode_transmutable(const struct inode *isp)
    {
    - struct inode_smack *sip = isp->i_security;
    + struct inode_smack *sip = smack_inode(isp);
    return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
    }

    @@ -382,7 +387,7 @@ static inline int smk_inode_transmutable(const struct inode *isp)
    */
    static inline struct smack_known *smk_of_inode(const struct inode *isp)
    {
    - struct inode_smack *sip = isp->i_security;
    + struct inode_smack *sip = smack_inode(isp);
    return sip->smk_inode;
    }

    diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
    index c560cb8e155c..c086110cba80 100644
    --- a/security/smack/smack_lsm.c
    +++ b/security/smack/smack_lsm.c
    @@ -166,7 +166,7 @@ static int smk_bu_task(struct task_struct *otp, int mode, int rc)
    static int smk_bu_inode(struct inode *inode, int mode, int rc)
    {
    struct task_smack *tsp = smack_cred(current_cred());
    - struct inode_smack *isp = inode->i_security;
    + struct inode_smack *isp = smack_inode(inode);
    char acc[SMK_NUM_ACCESS_TYPE + 1];

    if (isp->smk_flags & SMK_INODE_IMPURE)
    @@ -198,7 +198,7 @@ static int smk_bu_file(struct file *file, int mode, int rc)
    struct task_smack *tsp = smack_cred(current_cred());
    struct smack_known *sskp = tsp->smk_task;
    struct inode *inode = file_inode(file);
    - struct inode_smack *isp = inode->i_security;
    + struct inode_smack *isp = smack_inode(inode);
    char acc[SMK_NUM_ACCESS_TYPE + 1];

    if (isp->smk_flags & SMK_INODE_IMPURE)
    @@ -228,7 +228,7 @@ static int smk_bu_credfile(const struct cred *cred, struct file *file,
    struct task_smack *tsp = smack_cred(cred);
    struct smack_known *sskp = tsp->smk_task;
    struct inode *inode = file_inode(file);
    - struct inode_smack *isp = inode->i_security;
    + struct inode_smack *isp = smack_inode(inode);
    char acc[SMK_NUM_ACCESS_TYPE + 1];

    if (isp->smk_flags & SMK_INODE_IMPURE)
    @@ -826,7 +826,7 @@ static int smack_set_mnt_opts(struct super_block *sb,
    /*
    * Initialize the root inode.
    */
    - isp = inode->i_security;
    + isp = smack_inode(inode);
    if (isp == NULL) {
    isp = new_inode_smack(sp->smk_root);
    if (isp == NULL)
    @@ -914,7 +914,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
    if (bprm->called_set_creds)
    return 0;

    - isp = inode->i_security;
    + isp = smack_inode(inode);
    if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
    return 0;

    @@ -994,7 +994,7 @@ static void smack_inode_free_rcu(struct rcu_head *head)
    */
    static void smack_inode_free_security(struct inode *inode)
    {
    - struct inode_smack *issp = inode->i_security;
    + struct inode_smack *issp = smack_inode(inode);

    /*
    * The inode may still be referenced in a path walk and
    @@ -1022,7 +1022,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
    const struct qstr *qstr, const char **name,
    void **value, size_t *len)
    {
    - struct inode_smack *issp = inode->i_security;
    + struct inode_smack *issp = smack_inode(inode);
    struct smack_known *skp = smk_of_current();
    struct smack_known *isp = smk_of_inode(inode);
    struct smack_known *dsp = smk_of_inode(dir);
    @@ -1360,7 +1360,7 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
    const void *value, size_t size, int flags)
    {
    struct smack_known *skp;
    - struct inode_smack *isp = d_backing_inode(dentry)->i_security;
    + struct inode_smack *isp = smack_inode(d_backing_inode(dentry));

    if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
    isp->smk_flags |= SMK_INODE_TRANSMUTE;
    @@ -1441,7 +1441,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
    if (rc != 0)
    return rc;

    - isp = d_backing_inode(dentry)->i_security;
    + isp = smack_inode(d_backing_inode(dentry));
    /*
    * Don't do anything special for these.
    * XATTR_NAME_SMACKIPIN
    @@ -1716,7 +1716,7 @@ static int smack_mmap_file(struct file *file,
    if (unlikely(IS_PRIVATE(file_inode(file))))
    return 0;

    - isp = file_inode(file)->i_security;
    + isp = smack_inode(file_inode(file));
    if (isp->smk_mmap == NULL)
    return 0;
    sbsp = file_inode(file)->i_sb->s_security;
    @@ -2063,7 +2063,7 @@ static int smack_kernel_act_as(struct cred *new, u32 secid)
    static int smack_kernel_create_files_as(struct cred *new,
    struct inode *inode)
    {
    - struct inode_smack *isp = inode->i_security;
    + struct inode_smack *isp = smack_inode(inode);
    struct task_smack *tsp = smack_cred(new);

    tsp->smk_forked = isp->smk_inode;
    @@ -2263,7 +2263,7 @@ static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info,
    */
    static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
    {
    - struct inode_smack *isp = inode->i_security;
    + struct inode_smack *isp = smack_inode(inode);
    struct smack_known *skp = smk_of_task_struct(p);

    isp->smk_inode = skp;
    @@ -2726,7 +2726,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
    const void *value, size_t size, int flags)
    {
    struct smack_known *skp;
    - struct inode_smack *nsp = inode->i_security;
    + struct inode_smack *nsp = smack_inode(inode);
    struct socket_smack *ssp;
    struct socket *sock;
    int rc = 0;
    @@ -3334,7 +3334,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
    if (inode == NULL)
    return;

    - isp = inode->i_security;
    + isp = smack_inode(inode);

    mutex_lock(&isp->smk_lock);
    /*
    @@ -4566,7 +4566,7 @@ static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
    /*
    * Get label from overlay inode and set it in create_sid
    */
    - isp = d_inode(dentry->d_parent)->i_security;
    + isp = smack_inode(d_inode(dentry->d_parent));
    skp = isp->smk_inode;
    tsp->smk_task = skp;
    *new = new_creds;
    @@ -4603,7 +4603,7 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
    /*
    * the attribute of the containing directory
    */
    - isp = d_inode(dentry->d_parent)->i_security;
    + isp = smack_inode(d_inode(dentry->d_parent));

    if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
    rcu_read_lock();
    --
    2.14.5
    \
     
     \ /
      Last update: 2018-12-11 23:45    [W:4.194 / U:0.360 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site