Commit 8651d5c0 authored by Paul Moore's avatar Paul Moore Committed by James Morris
Browse files

lsm: Remove the socket_post_accept() hook 



The socket_post_accept() hook is not currently used by any in-tree modules
and its existence continues to cause problems by confusing people about
what can be safely accomplished using this hook.  If a legitimate need for
this hook arises in the future it can always be reintroduced.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 58bfbb51

include/linux/security.h

+0 −13
Original line number Diff line number Diff line
@@ -880,11 +880,6 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) 
 *	@sock contains the listening socket structure.

 *	@newsock contains the newly created server socket for connection.

 *	Return 0 if permission is granted.

 * @socket_post_accept:

 *	This hook allows a security module to copy security

 *	information into the newly created socket's inode.

 *	@sock contains the listening socket structure.

 *	@newsock contains the newly created server socket for connection.

 * @socket_sendmsg:

 *	Check permission before transmitting a message to another socket.

 *	@sock contains the socket structure.
@@ -1554,8 +1549,6 @@ struct security_operations { 
			       struct sockaddr *address, int addrlen);

	int (*socket_listen) (struct socket *sock, int backlog);

	int (*socket_accept) (struct socket *sock, struct socket *newsock);

	void (*socket_post_accept) (struct socket *sock,

				    struct socket *newsock);

	int (*socket_sendmsg) (struct socket *sock,

			       struct msghdr *msg, int size);

	int (*socket_recvmsg) (struct socket *sock,
@@ -2537,7 +2530,6 @@ int security_socket_bind(struct socket *sock, struct sockaddr *address, int addr 
int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);

int security_socket_listen(struct socket *sock, int backlog);

int security_socket_accept(struct socket *sock, struct socket *newsock);

void security_socket_post_accept(struct socket *sock, struct socket *newsock);

int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);

int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,

			    int size, int flags);
@@ -2616,11 +2608,6 @@ static inline int security_socket_accept(struct socket *sock, 
	return 0;

}



static inline void security_socket_post_accept(struct socket *sock,

					       struct socket *newsock)

{

}



static inline int security_socket_sendmsg(struct socket *sock,

					  struct msghdr *msg, int size)

{

net/socket.c

+0 −2
Original line number Diff line number Diff line
@@ -1536,8 +1536,6 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, 
	fd_install(newfd, newfile);

	err = newfd;



	security_socket_post_accept(sock, newsock);



out_put:

	fput_light(sock->file, fput_needed);

out:

security/capability.c

+0 −5
Original line number Diff line number Diff line
@@ -620,10 +620,6 @@ static int cap_socket_accept(struct socket *sock, struct socket *newsock) 
	return 0;

}



static void cap_socket_post_accept(struct socket *sock, struct socket *newsock)

{

}



static int cap_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)

{

	return 0;
@@ -1014,7 +1010,6 @@ void security_fixup_ops(struct security_operations *ops) 
	set_to_cap_if_null(ops, socket_connect);

	set_to_cap_if_null(ops, socket_listen);

	set_to_cap_if_null(ops, socket_accept);

	set_to_cap_if_null(ops, socket_post_accept);

	set_to_cap_if_null(ops, socket_sendmsg);

	set_to_cap_if_null(ops, socket_recvmsg);

	set_to_cap_if_null(ops, socket_getsockname);

security/security.c

+0 −5
Original line number Diff line number Diff line
@@ -1007,11 +1007,6 @@ int security_socket_accept(struct socket *sock, struct socket *newsock) 
	return security_ops->socket_accept(sock, newsock);

}



void security_socket_post_accept(struct socket *sock, struct socket *newsock)

{

	security_ops->socket_post_accept(sock, newsock);

}



int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)

{

	return security_ops->socket_sendmsg(sock, msg, size);

CRA Git | Maintained and supported by SUSTech CRA and CCSE