UBUNTU: SAUCE: LSM: Use lsmcontext in security_inode_getsecctx

Change the security_inode_getsecctx() interface to fill
a lsmcontext structure instead of data and length pointers.
This provides the information about which LSM created the
context so that security_release_secctx() can use the
correct hook.

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 99629e70dd0e232fa5ced4d5d8a65826aadd4317..be64d3f5e411ee4f114539f8a2a3a24ef12cf1c9 100644 (file)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2727,11 +2727,11 @@ nfsd4_encode_layout_types(struct xdr_stream *xdr, u32 layout_types)
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
 static inline __be32
 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
-                           void *context, int len)
+                           struct lsmcontext *context)
 {
        __be32 *p;
 
-       p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
+       p = xdr_reserve_space(xdr, context->len + 4 + 4 + 4);
        if (!p)
                return nfserr_resource;
 
@@ -2741,13 +2741,13 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
         */
        *p++ = cpu_to_be32(0); /* lfs */
        *p++ = cpu_to_be32(0); /* pi */
-       p = xdr_encode_opaque(p, context, len);
+       p = xdr_encode_opaque(p, context->context, context->len);
        return 0;
 }
 #else
 static inline __be32
 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
-                           void *context, int len)
+                           struct lsmcontext *context)
 { return 0; }
 #endif
 
@@ -2844,9 +2844,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
        int err;
        struct nfs4_acl *acl = NULL;
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-       struct lsmcontext scaff; /* scaffolding */
-       void *context = NULL;
-       int contextlen;
+       struct lsmcontext context = { };
 #endif
        bool contextsupport = false;
        struct nfsd4_compoundres *resp = rqstp->rq_resp;
@@ -2904,7 +2902,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
             bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
                if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
                        err = security_inode_getsecctx(d_inode(dentry),
-                                               &context, &contextlen);
+                                                      &context);
                else
                        err = -EOPNOTSUPP;
                contextsupport = (err == 0);
@@ -3324,8 +3322,7 @@ out_acl:
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
        if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
-               status = nfsd4_encode_security_label(xdr, rqstp, context,
-                                                               contextlen);
+               status = nfsd4_encode_security_label(xdr, rqstp, &context);
                if (status)
                        goto out;
        }
@@ -3346,10 +3343,8 @@ out_acl:
 
 out:
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-       if (context) {
-               lsmcontext_init(&scaff, context, contextlen, 0); /*scaffolding*/
-               security_release_secctx(&scaff);
-       }
+       if (context.context)
+               security_release_secctx(&context);
 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
        kfree(acl);
        if (tempfh) {

diff --git a/include/linux/security.h b/include/linux/security.h
index 38d8a57bf58f58e083e84b6cc0a1cb6284707095..5dee3bf46f1a6197775bdd1c66945d57bbaccd2c 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -582,7 +582,7 @@ void security_release_secctx(struct lsmcontext *cp);
 void security_inode_invalidate_secctx(struct inode *inode);
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
+int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp);
 int security_locked_down(enum lockdown_reason what);
 #else /* CONFIG_SECURITY */
 
@@ -1458,7 +1458,8 @@ static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32
 {
        return -EOPNOTSUPP;
 }
-static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+static inline int security_inode_getsecctx(struct inode *inode,
+                                          struct lsmcontext *cp)
 {
        return -EOPNOTSUPP;
 }

diff --git a/security/security.c b/security/security.c
index 6e62a45e9e985571c79b401eb1f9d86908209750..24f28cfc0a31fcf20ce1bbe0daf9336d881f3701 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -2355,9 +2355,18 @@ int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
 }
 EXPORT_SYMBOL(security_inode_setsecctx);
 
-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
 {
-       return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
+       struct security_hook_list *hp;
+
+       memset(cp, 0, sizeof(*cp));
+
+       hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
+               cp->slot = hp->lsmid->slot;
+               return hp->hook.inode_getsecctx(inode, (void **)&cp->context,
+                                               &cp->len);
+       }
+       return -EOPNOTSUPP;
 }
 EXPORT_SYMBOL(security_inode_getsecctx);