UBUNTU: SAUCE: LSM: Infrastructure management of the sock security

[mirror_ubuntu-jammy-kernel.git] / security / security.c

diff --git a/security/security.c b/security/security.c
index 6990e009ecabaebbc7f802c887f2ddf7a9562dbb..2be86f7214c34d0a15ed09d84139daec7fecd150 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -29,6 +29,7 @@
 #include <linux/string.h>
 #include <linux/msg.h>
 #include <net/flow.h>
+#include <net/sock.h>
 
 #define MAX_LSM_EVM_XATTR      2
 
@@ -205,6 +206,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
        lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
        lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
        lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
+       lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock);
        lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
 }
 
@@ -341,6 +343,7 @@ static void __init ordered_lsm_init(void)
        init_debug("ipc blob size        = %d\n", blob_sizes.lbs_ipc);
        init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
        init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
+       init_debug("sock blob size       = %d\n", blob_sizes.lbs_sock);
        init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
 
        /*
@@ -659,6 +662,28 @@ static int lsm_msg_msg_alloc(struct msg_msg *mp)
        return 0;
 }
 
+/**
+ * lsm_sock_alloc - allocate a composite sock blob
+ * @sock: the sock that needs a blob
+ * @priority: allocation mode
+ *
+ * Allocate the sock blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_sock_alloc(struct sock *sock, gfp_t priority)
+{
+       if (blob_sizes.lbs_sock == 0) {
+               sock->sk_security = NULL;
+               return 0;
+       }
+
+       sock->sk_security = kzalloc(blob_sizes.lbs_sock, priority);
+       if (sock->sk_security == NULL)
+               return -ENOMEM;
+       return 0;
+}
+
 /**
  * lsm_early_task - during initialization allocate a composite task blob
  * @task: the task that needs a blob
@@ -2263,12 +2288,21 @@ EXPORT_SYMBOL(security_socket_getpeersec_dgram);
 
 int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
 {
-       return call_int_hook(sk_alloc_security, 0, sk, family, priority);
+       int rc = lsm_sock_alloc(sk, priority);
+
+       if (unlikely(rc))
+               return rc;
+       rc = call_int_hook(sk_alloc_security, 0, sk, family, priority);
+       if (unlikely(rc))
+               security_sk_free(sk);
+       return rc;
 }
 
 void security_sk_free(struct sock *sk)
 {
        call_void_hook(sk_free_security, sk);
+       kfree(sk->sk_security);
+       sk->sk_security = NULL;
 }
 
 void security_sk_clone(const struct sock *sk, struct sock *newsk)