Commit 019bcca4 authored by Casey Schaufler's avatar Casey Schaufler Committed by Kees Cook
Browse files

Smack: Abstract use of ipc security blobs 



Don't use the ipc->security pointer directly.
Don't use the msg_msg->security pointer directly.
Provide helper functions that provides the security blob pointers.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 7c653828

security/smack/smack.h

+11 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/list.h>

#include <linux/rculist.h>

#include <linux/lsm_audit.h>

#include <linux/msg.h>



/*

 * Use IPv6 port labeling if IPv6 is enabled and secmarks
@@ -373,6 +374,16 @@ static inline struct inode_smack *smack_inode(const struct inode *inode) 
	return inode->i_security + smack_blob_sizes.lbs_inode;

}



static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)

{

	return (struct smack_known **)&msg->security;

}



static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)

{

	return (struct smack_known **)&ipc->security;

}



/*

 * Is the directory transmuting?

 */

security/smack/smack_lsm.c

+9 −5
Original line number Diff line number Diff line
@@ -2834,7 +2834,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg) 
 */

static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)

{

	return (struct smack_known *)isp->security;

	struct smack_known **blob = smack_ipc(isp);



	return *blob;

}



/**
@@ -2845,9 +2847,9 @@ static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) 
 */

static int smack_ipc_alloc_security(struct kern_ipc_perm *isp)

{

	struct smack_known *skp = smk_of_current();

	struct smack_known **blob = smack_ipc(isp);



	isp->security = skp;

	*blob = smk_of_current();

	return 0;

}
@@ -3159,7 +3161,8 @@ static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg 
 */

static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)

{

	struct smack_known *iskp = ipp->security;

	struct smack_known **blob = smack_ipc(ipp);

	struct smack_known *iskp = *blob;

	int may = smack_flags_to_may(flag);

	struct smk_audit_info ad;

	int rc;
@@ -3180,7 +3183,8 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 
 */

static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)

{

	struct smack_known *iskp = ipp->security;

	struct smack_known **blob = smack_ipc(ipp);

	struct smack_known *iskp = *blob;



	*secid = iskp->smk_secid;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE