lkml.org 
[lkml]   [2018]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v5 23/38] SELinux: Remove cred security blob poisoning
    Date
    The SELinux specific credential poisioning only makes sense
    if SELinux is managing the credentials. As the intent of this
    patch set is to move the blob management out of the modules
    and into the infrastructure, the SELinux specific code has
    to go. The poisioning could be introduced into the infrastructure
    at some later date.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    kernel/cred.c | 13 -------------
    security/selinux/hooks.c | 6 ------
    2 files changed, 19 deletions(-)

    diff --git a/kernel/cred.c b/kernel/cred.c
    index ecf03657e71c..fa2061ee4955 100644
    --- a/kernel/cred.c
    +++ b/kernel/cred.c
    @@ -704,19 +704,6 @@ bool creds_are_invalid(const struct cred *cred)
    {
    if (cred->magic != CRED_MAGIC)
    return true;
    -#ifdef CONFIG_SECURITY_SELINUX
    - /*
    - * cred->security == NULL if security_cred_alloc_blank() or
    - * security_prepare_creds() returned an error.
    - */
    - if (selinux_is_enabled() && cred->security) {
    - if ((unsigned long) cred->security < PAGE_SIZE)
    - return true;
    - if ((*(u32 *)cred->security & 0xffffff00) ==
    - (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))
    - return true;
    - }
    -#endif
    return false;
    }
    EXPORT_SYMBOL(creds_are_invalid);
    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index 24b6b459fa2a..41b230d459a6 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -3922,12 +3922,6 @@ static void selinux_cred_free(struct cred *cred)
    {
    struct task_security_struct *tsec = selinux_cred(cred);

    - /*
    - * cred->security == NULL if security_cred_alloc_blank() or
    - * security_prepare_creds() returned an error.
    - */
    - BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
    - cred->security = (void *) 0x7UL;
    kfree(tsec);
    }

    --
    2.14.5
    \
     
     \ /
      Last update: 2018-12-11 23:47    [W:2.319 / U:0.200 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site