lkml.org 
[lkml]   [2018]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v5 31/38] SELinux: Abstract use of inode security blob
    Date
    Don't use the inode->i_security pointer directly.
    Provide a helper function that provides the security blob pointer.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    security/selinux/hooks.c | 26 +++++++++++++-------------
    security/selinux/include/objsec.h | 6 ++++++
    security/selinux/selinuxfs.c | 4 ++--
    3 files changed, 21 insertions(+), 15 deletions(-)

    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index 9669a059ce0f..3069e95d86e6 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -272,7 +272,7 @@ static int __inode_security_revalidate(struct inode *inode,
    struct dentry *dentry,
    bool may_sleep)
    {
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);

    might_sleep_if(may_sleep);

    @@ -293,7 +293,7 @@ static int __inode_security_revalidate(struct inode *inode,

    static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
    {
    - return inode->i_security;
    + return selinux_inode(inode);
    }

    static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
    @@ -303,7 +303,7 @@ static struct inode_security_struct *inode_security_rcu(struct inode *inode, boo
    error = __inode_security_revalidate(inode, NULL, !rcu);
    if (error)
    return ERR_PTR(error);
    - return inode->i_security;
    + return selinux_inode(inode);
    }

    /*
    @@ -312,14 +312,14 @@ static struct inode_security_struct *inode_security_rcu(struct inode *inode, boo
    static struct inode_security_struct *inode_security(struct inode *inode)
    {
    __inode_security_revalidate(inode, NULL, true);
    - return inode->i_security;
    + return selinux_inode(inode);
    }

    static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
    {
    struct inode *inode = d_backing_inode(dentry);

    - return inode->i_security;
    + return selinux_inode(inode);
    }

    /*
    @@ -330,7 +330,7 @@ static struct inode_security_struct *backing_inode_security(struct dentry *dentr
    struct inode *inode = d_backing_inode(dentry);

    __inode_security_revalidate(inode, dentry, true);
    - return inode->i_security;
    + return selinux_inode(inode);
    }

    static void inode_free_rcu(struct rcu_head *head)
    @@ -343,7 +343,7 @@ static void inode_free_rcu(struct rcu_head *head)

    static void inode_free_security(struct inode *inode)
    {
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);
    struct superblock_security_struct *sbsec = inode->i_sb->s_security;

    /*
    @@ -1502,7 +1502,7 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
    static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
    {
    struct superblock_security_struct *sbsec = NULL;
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);
    u32 task_sid, sid = 0;
    u16 sclass;
    struct dentry *dentry;
    @@ -1802,7 +1802,7 @@ static int inode_has_perm(const struct cred *cred,
    return 0;

    sid = cred_sid(cred);
    - isec = inode->i_security;
    + isec = selinux_inode(inode);

    return avc_has_perm(&selinux_state,
    sid, isec->sid, isec->sclass, perms, adp);
    @@ -3030,7 +3030,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,

    /* Possibly defer initialization to selinux_complete_init. */
    if (sbsec->flags & SE_SBINITIALIZED) {
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);
    isec->sclass = inode_mode_to_security_class(inode->i_mode);
    isec->sid = newsid;
    isec->initialized = LABEL_INITIALIZED;
    @@ -3130,7 +3130,7 @@ static noinline int audit_inode_permission(struct inode *inode,
    unsigned flags)
    {
    struct common_audit_data ad;
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);
    int rc;

    ad.type = LSM_AUDIT_DATA_INODE;
    @@ -4150,7 +4150,7 @@ static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
    static void selinux_task_to_inode(struct task_struct *p,
    struct inode *inode)
    {
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);
    u32 sid = task_sid(p);

    spin_lock(&isec->lock);
    @@ -6529,7 +6529,7 @@ static void selinux_release_secctx(char *secdata, u32 seclen)

    static void selinux_inode_invalidate_secctx(struct inode *inode)
    {
    - struct inode_security_struct *isec = inode->i_security;
    + struct inode_security_struct *isec = selinux_inode(inode);

    spin_lock(&isec->lock);
    isec->initialized = LABEL_INVALID;
    diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
    index 96374dbf4ace..26b4ff6b4d81 100644
    --- a/security/selinux/include/objsec.h
    +++ b/security/selinux/include/objsec.h
    @@ -170,4 +170,10 @@ static inline struct file_security_struct *selinux_file(const struct file *file)
    return file->f_security + selinux_blob_sizes.lbs_file;
    }

    +static inline struct inode_security_struct *selinux_inode(
    + const struct inode *inode)
    +{
    + return inode->i_security;
    +}
    +
    #endif /* _SELINUX_OBJSEC_H_ */
    diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
    index f3a5a138a096..145ee62f205a 100644
    --- a/security/selinux/selinuxfs.c
    +++ b/security/selinux/selinuxfs.c
    @@ -1378,7 +1378,7 @@ static int sel_make_bools(struct selinux_fs_info *fsi)
    goto out;
    }

    - isec = (struct inode_security_struct *)inode->i_security;
    + isec = selinux_inode(inode);
    ret = security_genfs_sid(fsi->state, "selinuxfs", page,
    SECCLASS_FILE, &sid);
    if (ret) {
    @@ -1953,7 +1953,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
    }

    inode->i_ino = ++fsi->last_ino;
    - isec = (struct inode_security_struct *)inode->i_security;
    + isec = selinux_inode(inode);
    isec->sid = SECINITSID_DEVNULL;
    isec->sclass = SECCLASS_CHR_FILE;
    isec->initialized = LABEL_INITIALIZED;
    --
    2.14.5
    \
     
     \ /
      Last update: 2018-12-11 23:46    [W:4.105 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site