lkml.org 
[lkml]   [2018]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v5 25/38] AppArmor: Abstract use of cred security blob
    Date
    Don't use the cred->security pointer directly.
    Provide a helper function that provides the security blob pointer.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    [kees: adjusted for ordered init series]
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    security/apparmor/domain.c | 2 +-
    security/apparmor/include/cred.h | 16 +++++++++++++++-
    security/apparmor/lsm.c | 10 +++++-----
    security/apparmor/task.c | 6 +++---
    4 files changed, 24 insertions(+), 10 deletions(-)

    diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
    index 08c88de0ffda..726910bba84b 100644
    --- a/security/apparmor/domain.c
    +++ b/security/apparmor/domain.c
    @@ -975,7 +975,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
    }
    aa_put_label(cred_label(bprm->cred));
    /* transfer reference, released when cred is freed */
    - cred_label(bprm->cred) = new;
    + set_cred_label(bprm->cred, new);

    done:
    aa_put_label(label);
    diff --git a/security/apparmor/include/cred.h b/security/apparmor/include/cred.h
    index 265ae6641a06..a757370f2a0c 100644
    --- a/security/apparmor/include/cred.h
    +++ b/security/apparmor/include/cred.h
    @@ -23,8 +23,22 @@
    #include "policy_ns.h"
    #include "task.h"

    -#define cred_label(X) ((X)->security)
    +static inline struct aa_label *cred_label(const struct cred *cred)
    +{
    + struct aa_label **blob = cred->security;
    +
    + AA_BUG(!blob);
    + return *blob;
    +}

    +static inline void set_cred_label(const struct cred *cred,
    + struct aa_label *label)
    +{
    + struct aa_label **blob = cred->security;
    +
    + AA_BUG(!blob);
    + *blob = label;
    +}

    /**
    * aa_cred_raw_label - obtain cred's label
    diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
    index e8b40008d58c..803ec0a63d87 100644
    --- a/security/apparmor/lsm.c
    +++ b/security/apparmor/lsm.c
    @@ -59,7 +59,7 @@ DEFINE_PER_CPU(struct aa_buffers, aa_buffers);
    static void apparmor_cred_free(struct cred *cred)
    {
    aa_put_label(cred_label(cred));
    - cred_label(cred) = NULL;
    + set_cred_label(cred, NULL);
    }

    /*
    @@ -67,7 +67,7 @@ static void apparmor_cred_free(struct cred *cred)
    */
    static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
    {
    - cred_label(cred) = NULL;
    + set_cred_label(cred, NULL);
    return 0;
    }

    @@ -77,7 +77,7 @@ static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
    static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
    gfp_t gfp)
    {
    - cred_label(new) = aa_get_newest_label(cred_label(old));
    + set_cred_label(new, aa_get_newest_label(cred_label(old)));
    return 0;
    }

    @@ -86,7 +86,7 @@ static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
    */
    static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
    {
    - cred_label(new) = aa_get_newest_label(cred_label(old));
    + set_cred_label(new, aa_get_newest_label(cred_label(old)));
    }

    static void apparmor_task_free(struct task_struct *task)
    @@ -1484,7 +1484,7 @@ static int __init set_init_ctx(void)
    if (!ctx)
    return -ENOMEM;

    - cred_label(cred) = aa_get_label(ns_unconfined(root_ns));
    + set_cred_label(cred, aa_get_label(ns_unconfined(root_ns)));
    task_ctx(current) = ctx;

    return 0;
    diff --git a/security/apparmor/task.c b/security/apparmor/task.c
    index c6b78a14da91..4551110f0496 100644
    --- a/security/apparmor/task.c
    +++ b/security/apparmor/task.c
    @@ -81,7 +81,7 @@ int aa_replace_current_label(struct aa_label *label)
    */
    aa_get_label(label);
    aa_put_label(cred_label(new));
    - cred_label(new) = label;
    + set_cred_label(new, label);

    commit_creds(new);
    return 0;
    @@ -138,7 +138,7 @@ int aa_set_current_hat(struct aa_label *label, u64 token)
    return -EACCES;
    }

    - cred_label(new) = aa_get_newest_label(label);
    + set_cred_label(new, aa_get_newest_label(label));
    /* clear exec on switching context */
    aa_put_label(ctx->onexec);
    ctx->onexec = NULL;
    @@ -172,7 +172,7 @@ int aa_restore_previous_label(u64 token)
    return -ENOMEM;

    aa_put_label(cred_label(new));
    - cred_label(new) = aa_get_newest_label(ctx->previous);
    + set_cred_label(new, aa_get_newest_label(ctx->previous));
    AA_BUG(!cred_label(new));
    /* clear exec && prev information when restoring to previous context */
    aa_clear_task_ctx_trans(ctx);
    --
    2.14.5
    \
     
     \ /
      Last update: 2018-12-11 23:46    [W:2.276 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site