Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_audit_rule_match"

BugLink: https://bugs.launchpad.net/bugs/2012136
Prepare for new LSM stacking and apparmor prompting by reverting patches
needed to get to a clean 6.2

This reverts commit 1ffccee20197438b509ed7f97ef50dd47d777a16.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

diff --git a/include/linux/security.h b/include/linux/security.h
index dc148292b620896c90f812456a65f4e56e076b78..b59f2c4704717276ab3ab6a815c30684ef500602 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2010,8 +2010,7 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer)
 #ifdef CONFIG_SECURITY
 int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
 int security_audit_rule_known(struct audit_krule *krule);
-int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
-                             void **lsmrule);
+int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule);
 void security_audit_rule_free(void **lsmrule);
 
 #else
@@ -2027,8 +2026,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule)
        return 0;
 }
 
-static inline int security_audit_rule_match(struct lsmblob *blob, u32 field,
-                                           u32 op, void **lsmrule)
+static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
+                                           void **lsmrule)
 {
        return 0;
 }

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index c8745814975ae3ba8f546f90edcb5777fcc8dbcc..7039187886248d344e5ec52ad771c4888e6902f4 100644 (file)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1340,7 +1340,6 @@ int audit_filter(int msgtype, unsigned int listtype)
                        struct audit_field *f = &e->rule.fields[i];
                        pid_t pid;
                        u32 sid;
-                       struct lsmblob blob;
 
                        switch (f->type) {
                        case AUDIT_PID:
@@ -1371,9 +1370,8 @@ int audit_filter(int msgtype, unsigned int listtype)
                        case AUDIT_SUBJ_CLR:
                                if (f->lsm_isset) {
                                        security_current_getsecid_subj(&sid);
-                                       lsmblob_init(&blob, sid);
-                                       result = security_audit_rule_match(
-                                                  &blob, f->type, f->op,
+                                       result = security_audit_rule_match(sid,
+                                                  f->type, f->op,
                                                   f->lsm_rules);
                                }
                                break;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index fac58b25342c66e4a9983d458795cd7e312e7167..7ff561df108f2cf797e528bc30a5d779b7d466ee 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -468,7 +468,6 @@ static int audit_filter_rules(struct task_struct *tsk,
        const struct cred *cred;
        int i, need_sid = 1;
        u32 sid;
-       struct lsmblob blob;
        unsigned int sessionid;
 
        if (ctx && rule->prio <= ctx->prio)
@@ -679,9 +678,7 @@ static int audit_filter_rules(struct task_struct *tsk,
                                        security_current_getsecid_subj(&sid);
                                        need_sid = 0;
                                }
-                               lsmblob_init(&blob, sid);
-                               result = security_audit_rule_match(&blob,
-                                                                  f->type,
+                               result = security_audit_rule_match(sid, f->type,
                                                                   f->op,
                                                                   f->lsm_rules);
                        }
@@ -696,17 +693,15 @@ static int audit_filter_rules(struct task_struct *tsk,
                        if (f->lsm_isset) {
                                /* Find files that match */
                                if (name) {
-                                       lsmblob_init(&blob, name->osid);
                                        result = security_audit_rule_match(
-                                                               &blob,
+                                                               name->osid,
                                                                f->type,
                                                                f->op,
                                                                f->lsm_rules);
                                } else if (ctx) {
                                        list_for_each_entry(n, &ctx->names_list, list) {
-                                               lsmblob_init(&blob, name->osid);
                                                if (security_audit_rule_match(
-                                                               &blob,
+                                                               n->osid,
                                                                f->type,
                                                                f->op,
                                                                f->lsm_rules)) {
@@ -718,8 +713,7 @@ static int audit_filter_rules(struct task_struct *tsk,
                                /* Find ipc objects that match */
                                if (!ctx || ctx->type != AUDIT_IPC)
                                        break;
-                               lsmblob_init(&blob, ctx->ipc.osid);
-                               if (security_audit_rule_match(&blob,
+                               if (security_audit_rule_match(ctx->ipc.osid,
                                                              f->type, f->op,
                                                              f->lsm_rules))
                                        ++result;

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 6aade6c099e2f92eb3538aa858958291dca337a1..03b440921e61505f0829fad1b600a4c15578610b 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -438,7 +438,7 @@ static inline void ima_filter_rule_free(void *lsmrule)
 {
 }
 
-static inline int ima_filter_rule_match(strcut lsmblob *blob, u32 field, u32 op,
+static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
                                        void *lsmrule)
 {
        return -EINVAL;

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 08cba8601e0f6eb305cd1eb3125f73b7fa9d8cb5..6df497b87567963045d596c41b2e75cbc9e02c67 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -652,7 +652,6 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
        for (i = 0; i < MAX_LSM_RULES; i++) {
                int rc = 0;
                u32 osid;
-               struct lsmblob lsmdata;
 
                if (!ima_lsm_isset(lsm_rule->lsm[i].rules)) {
                        if (!lsm_rule->lsm[i].args_p)
@@ -667,16 +666,14 @@ retry:
                case LSM_OBJ_ROLE:
                case LSM_OBJ_TYPE:
                        security_inode_getsecid(inode, &osid);
-                       lsmblob_init(&lsmdata, osid);
-                       rc = ima_filter_rule_match(&lsmdata, lsm_rule->lsm[i].type,
+                       rc = ima_filter_rule_match(osid, lsm_rule->lsm[i].type,
                                                   Audit_equal,
                                                   lsm_rule->lsm[i].rules);
                        break;
                case LSM_SUBJ_USER:
                case LSM_SUBJ_ROLE:
                case LSM_SUBJ_TYPE:
-                       lsmblob_init(&lsmdata, secid);
-                       rc = ima_filter_rule_match(&lsmdata, lsm_rule->lsm[i].type,
+                       rc = ima_filter_rule_match(secid, lsm_rule->lsm[i].type,
                                                   Audit_equal,
                                                   lsm_rule->lsm[i].rules);
                        break;

diff --git a/security/security.c b/security/security.c
index caec0564abdf5fe2640e716072d4265bbe92cb19..daf6674a8fb25612e1a0cd2ead4de27f9357d02f 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -2736,14 +2736,11 @@ void security_audit_rule_free(void **lsmrule)
        hlist_for_each_entry(hp, &security_hook_heads.audit_rule_free, list) {
                if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
                        continue;
-               if (lsmrule[hp->lsmid->slot] == NULL)
-                       continue;
                hp->hook.audit_rule_free(lsmrule[hp->lsmid->slot]);
        }
 }
 
-int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
-                             void **lsmrule)
+int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule)
 {
        struct security_hook_list *hp;
        int rc;
@@ -2751,10 +2748,7 @@ int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
        hlist_for_each_entry(hp, &security_hook_heads.audit_rule_match, list) {
                if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
                        continue;
-               if (lsmrule[hp->lsmid->slot] == NULL)
-                       continue;
-               rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
-                                              field, op,
+               rc = hp->hook.audit_rule_match(secid, field, op,
                                               &lsmrule[hp->lsmid->slot]);
                if (rc)
                        return rc;