Commit 80788c22 authored by Casey Schaufler's avatar Casey Schaufler Committed by Kees Cook
Browse files

SELinux: Abstract use of inode security blob 



Don't use the inode->i_security pointer directly.
Provide a helper function that provides the security blob pointer.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 33bf60ca

security/selinux/hooks.c

+13 −13
Original line number Diff line number Diff line
@@ -273,7 +273,7 @@ static int __inode_security_revalidate(struct inode *inode, 
				       struct dentry *dentry,

				       bool may_sleep)

{

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);



	might_sleep_if(may_sleep);
@@ -294,7 +294,7 @@ static int __inode_security_revalidate(struct inode *inode, 


static struct inode_security_struct *inode_security_novalidate(struct inode *inode)

{

	return inode->i_security;

	return selinux_inode(inode);

}



static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
@@ -304,7 +304,7 @@ static struct inode_security_struct *inode_security_rcu(struct inode *inode, boo 
	error = __inode_security_revalidate(inode, NULL, !rcu);

	if (error)

		return ERR_PTR(error);

	return inode->i_security;

	return selinux_inode(inode);

}



/*
@@ -313,14 +313,14 @@ static struct inode_security_struct *inode_security_rcu(struct inode *inode, boo 
static struct inode_security_struct *inode_security(struct inode *inode)

{

	__inode_security_revalidate(inode, NULL, true);

	return inode->i_security;

	return selinux_inode(inode);

}



static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)

{

	struct inode *inode = d_backing_inode(dentry);



	return inode->i_security;

	return selinux_inode(inode);

}



/*
@@ -331,7 +331,7 @@ static struct inode_security_struct *backing_inode_security(struct dentry *dentr 
	struct inode *inode = d_backing_inode(dentry);



	__inode_security_revalidate(inode, dentry, true);

	return inode->i_security;

	return selinux_inode(inode);

}



static void inode_free_rcu(struct rcu_head *head)
@@ -344,7 +344,7 @@ static void inode_free_rcu(struct rcu_head *head) 


static void inode_free_security(struct inode *inode)

{

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);

	struct superblock_security_struct *sbsec = inode->i_sb->s_security;



	/*
@@ -1354,7 +1354,7 @@ static int selinux_genfs_get_sid(struct dentry *dentry, 
static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)

{

	struct superblock_security_struct *sbsec = NULL;

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);

	u32 task_sid, sid = 0;

	u16 sclass;

	struct dentry *dentry;
@@ -1654,7 +1654,7 @@ static int inode_has_perm(const struct cred *cred, 
		return 0;



	sid = cred_sid(cred);

	isec = inode->i_security;

	isec = selinux_inode(inode);



	return avc_has_perm(&selinux_state,

			    sid, isec->sid, isec->sclass, perms, adp);
@@ -2816,7 +2816,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, 


	/* Possibly defer initialization to selinux_complete_init. */

	if (sbsec->flags & SE_SBINITIALIZED) {

		struct inode_security_struct *isec = inode->i_security;

		struct inode_security_struct *isec = selinux_inode(inode);

		isec->sclass = inode_mode_to_security_class(inode->i_mode);

		isec->sid = newsid;

		isec->initialized = LABEL_INITIALIZED;
@@ -2916,7 +2916,7 @@ static noinline int audit_inode_permission(struct inode *inode, 
					   unsigned flags)

{

	struct common_audit_data ad;

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);

	int rc;



	ad.type = LSM_AUDIT_DATA_INODE;
@@ -3936,7 +3936,7 @@ static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info, 
static void selinux_task_to_inode(struct task_struct *p,

				  struct inode *inode)

{

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);

	u32 sid = task_sid(p);



	spin_lock(&isec->lock);
@@ -6318,7 +6318,7 @@ static void selinux_release_secctx(char *secdata, u32 seclen) 


static void selinux_inode_invalidate_secctx(struct inode *inode)

{

	struct inode_security_struct *isec = inode->i_security;

	struct inode_security_struct *isec = selinux_inode(inode);



	spin_lock(&isec->lock);

	isec->initialized = LABEL_INVALID;

security/selinux/include/objsec.h

+6 −0
Original line number Diff line number Diff line
@@ -170,4 +170,10 @@ static inline struct file_security_struct *selinux_file(const struct file *file) 
	return file->f_security + selinux_blob_sizes.lbs_file;

}



static inline struct inode_security_struct *selinux_inode(

						const struct inode *inode)

{

	return inode->i_security;

}



#endif /* _SELINUX_OBJSEC_H_ */

security/selinux/selinuxfs.c

+2 −2
Original line number Diff line number Diff line
@@ -1378,7 +1378,7 @@ static int sel_make_bools(struct selinux_fs_info *fsi) 
			goto out;

		}



		isec = (struct inode_security_struct *)inode->i_security;

		isec = selinux_inode(inode);

		ret = security_genfs_sid(fsi->state, "selinuxfs", page,

					 SECCLASS_FILE, &sid);

		if (ret) {
@@ -1953,7 +1953,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) 
	}



	inode->i_ino = ++fsi->last_ino;

	isec = (struct inode_security_struct *)inode->i_security;

	isec = selinux_inode(inode);

	isec->sid = SECINITSID_DEVNULL;

	isec->sclass = SECCLASS_CHR_FILE;

	isec->initialized = LABEL_INITIALIZED;

CRA Git | Maintained and supported by SUSTech CRA and CCSE