Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63cb3449 authored by David Howells's avatar David Howells Committed by James Morris
Browse files

security: add a secctx_to_secid() hook 



Add a secctx_to_secid() LSM hook to go along with the existing
secid_to_secctx() LSM hook.  This patch also includes the SELinux
implementation for this hook.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent c43e259c

include/linux/security.h

+13 −0
Original line number Diff line number Diff line
@@ -1202,6 +1202,10 @@ struct request_sock; 
 *	Convert secid to security context.

 *	@secid contains the security ID.

 *	@secdata contains the pointer that stores the converted security context.

 * @secctx_to_secid:

 *      Convert security context to secid.

 *      @secid contains the pointer to the generated security ID.

 *      @secdata contains the security context.

 *

 * @release_secctx:

 *	Release the security context.
@@ -1396,6 +1400,7 @@ struct security_operations { 
 	int (*getprocattr)(struct task_struct *p, char *name, char **value);

 	int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);

	int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);

	int (*secctx_to_secid)(char *secdata, u32 seclen, u32 *secid);

	void (*release_secctx)(char *secdata, u32 seclen);



#ifdef CONFIG_SECURITY_NETWORK
@@ -1634,6 +1639,7 @@ int security_setprocattr(struct task_struct *p, char *name, void *value, size_t 
int security_netlink_send(struct sock *sk, struct sk_buff *skb);

int security_netlink_recv(struct sk_buff *skb, int cap);

int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);

int security_secctx_to_secid(char *secdata, u32 seclen, u32 *secid);

void security_release_secctx(char *secdata, u32 seclen);



#else /* CONFIG_SECURITY */
@@ -2308,6 +2314,13 @@ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *secle 
	return -EOPNOTSUPP;

}



static inline int security_secctx_to_secid(char *secdata,

					   u32 seclen,

					   u32 *secid)

{

	return -EOPNOTSUPP;

}



static inline void security_release_secctx(char *secdata, u32 seclen)

{

}

security/dummy.c

+6 −0
Original line number Diff line number Diff line
@@ -946,6 +946,11 @@ static int dummy_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 
	return -EOPNOTSUPP;

}



static int dummy_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)

{

	return -EOPNOTSUPP;

}



static void dummy_release_secctx(char *secdata, u32 seclen)

{

}
@@ -1106,6 +1111,7 @@ void security_fixup_ops (struct security_operations *ops) 
 	set_to_dummy_if_null(ops, getprocattr);

 	set_to_dummy_if_null(ops, setprocattr);

 	set_to_dummy_if_null(ops, secid_to_secctx);

	set_to_dummy_if_null(ops, secctx_to_secid);

 	set_to_dummy_if_null(ops, release_secctx);

#ifdef CONFIG_SECURITY_NETWORK

	set_to_dummy_if_null(ops, unix_stream_connect);

security/security.c

+6 −0
Original line number Diff line number Diff line
@@ -831,6 +831,12 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 
}

EXPORT_SYMBOL(security_secid_to_secctx);



int security_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)

{

	return security_ops->secctx_to_secid(secdata, seclen, secid);

}

EXPORT_SYMBOL(security_secctx_to_secid);



void security_release_secctx(char *secdata, u32 seclen)

{

	return security_ops->release_secctx(secdata, seclen);

security/selinux/hooks.c

+6 −0
Original line number Diff line number Diff line
@@ -4947,6 +4947,11 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 
	return security_sid_to_context(secid, secdata, seclen);

}



static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)

{

	return security_context_to_sid(secdata, seclen, secid);

}



static void selinux_release_secctx(char *secdata, u32 seclen)

{

	kfree(secdata);
@@ -5138,6 +5143,7 @@ static struct security_operations selinux_ops = { 
	.setprocattr =                  selinux_setprocattr,



	.secid_to_secctx =		selinux_secid_to_secctx,

	.secctx_to_secid =		selinux_secctx_to_secid,

	.release_secctx =		selinux_release_secctx,



        .unix_stream_connect =		selinux_socket_unix_stream_connect,