selinux: fix residual uses of current_security() for the SELinux blob (169ce0c0) · Commits · 戴 / test

We need to use selinux_cred() to fetch the SELinux cred blob instead of directly using current->security or current_security(). There were a couple of lingering uses of current_security() in the SELinux code that were apparently missed during the earlier conversions. IIUC, this would only manifest as a bug if multiple security modules including SELinux are enabled and SELinux is not first in the lsm order. After this change, there appear to be no other users of current_security() in-tree; perhaps we should remove it altogether. Fixes: ("Infrastructure management of the cred security blob") Signed-off-by:

Stephen Smalley <sds@tycho.nsa.gov> Acked-by:

Casey Schaufler <casey@schaufler-ca.com> Reviewed-by:

James Morris <jamorris@linux.microsoft.com> Signed-off-by:

Paul Moore <paul@paul-moore.com>

security/selinux/hooks.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3435,7 +3435,7 @@ static int selinux_inode_copy_up_xattr(const char *name)
		static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
		struct kernfs_node *kn)
		{
		const struct task_security_struct *tsec = current_security();
		const struct task_security_struct *tsec = selinux_cred(current_cred());
		u32 parent_sid, newsid, clen;
		int rc;
		char *context;

security/selinux/include/objsec.h

+10 −10

Original line number	Diff line number	Diff line
		@@ -40,16 +40,6 @@ struct task_security_struct {
		u32 sockcreate_sid; /* fscreate SID */
		};

		/*
		* get the subjective security ID of the current task
		*/
		static inline u32 current_sid(void)
		{
		const struct task_security_struct *tsec = current_security();

		return tsec->sid;
		}

		enum label_initialized {
		LABEL_INVALID, /* invalid or not initialized */
		LABEL_INITIALIZED, /* initialized */
		@@ -188,4 +178,14 @@ static inline struct ipc_security_struct *selinux_ipc(
		return ipc->security + selinux_blob_sizes.lbs_ipc;
		}

		/*
		* get the subjective security ID of the current task
		*/
		static inline u32 current_sid(void)
		{
		const struct task_security_struct *tsec = selinux_cred(current_cred());

		return tsec->sid;
		}

		#endif /* _SELINUX_OBJSEC_H_ */

Admin message