|
| 1 | +selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code |
| 2 | + |
| 3 | +jira LE-1907 |
| 4 | +Rebuild_History Non-Buildable kernel-3.10.0-1160.118.1.el7 |
| 5 | +commit-author Paul Moore <pmoore@redhat.com> |
| 6 | +commit ccf17cc4b81537c29f0d5950b38b5548b6cb5858 |
| 7 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 8 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 9 | +ciq/ciq_backports/kernel-3.10.0-1160.118.1.el7/ccf17cc4.failed |
| 10 | + |
| 11 | +The SELinux labeled IPsec code state management functions have been |
| 12 | +long neglected and could use some cleanup and consolidation. |
| 13 | + |
| 14 | + Signed-off-by: Paul Moore <pmoore@redhat.com> |
| 15 | + Signed-off-by: Eric Paris <eparis@redhat.com> |
| 16 | +(cherry picked from commit ccf17cc4b81537c29f0d5950b38b5548b6cb5858) |
| 17 | + Signed-off-by: Jonathan Maple <jmaple@ciq.com> |
| 18 | + |
| 19 | +# Conflicts: |
| 20 | +# security/selinux/xfrm.c |
| 21 | +diff --cc security/selinux/xfrm.c |
| 22 | +index 78504a18958a,f8d71262b45d..000000000000 |
| 23 | +--- a/security/selinux/xfrm.c |
| 24 | ++++ b/security/selinux/xfrm.c |
| 25 | +@@@ -74,6 -74,81 +74,84 @@@ static inline int selinux_authorizable_ |
| 26 | + } |
| 27 | + |
| 28 | + /* |
| 29 | +++<<<<<<< HEAD |
| 30 | +++======= |
| 31 | ++ * Allocates a xfrm_sec_state and populates it using the supplied security |
| 32 | ++ * xfrm_user_sec_ctx context. |
| 33 | ++ */ |
| 34 | ++ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, |
| 35 | ++ struct xfrm_user_sec_ctx *uctx) |
| 36 | ++ { |
| 37 | ++ int rc; |
| 38 | ++ const struct task_security_struct *tsec = current_security(); |
| 39 | ++ struct xfrm_sec_ctx *ctx = NULL; |
| 40 | ++ u32 str_len; |
| 41 | ++ |
| 42 | ++ if (ctxp == NULL || uctx == NULL || |
| 43 | ++ uctx->ctx_doi != XFRM_SC_DOI_LSM || |
| 44 | ++ uctx->ctx_alg != XFRM_SC_ALG_SELINUX) |
| 45 | ++ return -EINVAL; |
| 46 | ++ |
| 47 | ++ str_len = uctx->ctx_len; |
| 48 | ++ if (str_len >= PAGE_SIZE) |
| 49 | ++ return -ENOMEM; |
| 50 | ++ |
| 51 | ++ ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL); |
| 52 | ++ if (!ctx) |
| 53 | ++ return -ENOMEM; |
| 54 | ++ |
| 55 | ++ ctx->ctx_doi = XFRM_SC_DOI_LSM; |
| 56 | ++ ctx->ctx_alg = XFRM_SC_ALG_SELINUX; |
| 57 | ++ ctx->ctx_len = str_len; |
| 58 | ++ memcpy(ctx->ctx_str, &uctx[1], str_len); |
| 59 | ++ ctx->ctx_str[str_len] = '\0'; |
| 60 | ++ rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid); |
| 61 | ++ if (rc) |
| 62 | ++ goto err; |
| 63 | ++ |
| 64 | ++ rc = avc_has_perm(tsec->sid, ctx->ctx_sid, |
| 65 | ++ SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL); |
| 66 | ++ if (rc) |
| 67 | ++ goto err; |
| 68 | ++ |
| 69 | ++ *ctxp = ctx; |
| 70 | ++ atomic_inc(&selinux_xfrm_refcount); |
| 71 | ++ return 0; |
| 72 | ++ |
| 73 | ++ err: |
| 74 | ++ kfree(ctx); |
| 75 | ++ return rc; |
| 76 | ++ } |
| 77 | ++ |
| 78 | ++ /* |
| 79 | ++ * Free the xfrm_sec_ctx structure. |
| 80 | ++ */ |
| 81 | ++ static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx) |
| 82 | ++ { |
| 83 | ++ if (!ctx) |
| 84 | ++ return; |
| 85 | ++ |
| 86 | ++ atomic_dec(&selinux_xfrm_refcount); |
| 87 | ++ kfree(ctx); |
| 88 | ++ } |
| 89 | ++ |
| 90 | ++ /* |
| 91 | ++ * Authorize the deletion of a labeled SA or policy rule. |
| 92 | ++ */ |
| 93 | ++ static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx) |
| 94 | ++ { |
| 95 | ++ const struct task_security_struct *tsec = current_security(); |
| 96 | ++ |
| 97 | ++ if (!ctx) |
| 98 | ++ return 0; |
| 99 | ++ |
| 100 | ++ return avc_has_perm(tsec->sid, ctx->ctx_sid, |
| 101 | ++ SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, |
| 102 | ++ NULL); |
| 103 | ++ } |
| 104 | ++ |
| 105 | ++ /* |
| 106 | +++>>>>>>> ccf17cc4b815 (selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code) |
| 107 | + * LSM hook implementation that authorizes that a flow can use |
| 108 | + * a xfrm policy rule. |
| 109 | + */ |
| 110 | +* Unmerged path security/selinux/xfrm.c |
0 commit comments