Commit 6f2b76a4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'Smack-for-5.16' of https://github.com/cschaufler/smack-next 

Pull smack updates from Casey Schaufler:
 "Multiple corrections to smackfs:

   - a change for overlayfs support that corrects the initial attributes
     on created files

   - code clean-up for netlabel processing

   - several fixes in smackfs for a variety of reasons

   - Errors reported by W=1 have been addressed

  All told, nothing challenging"

* tag 'Smack-for-5.16' of https://github.com/cschaufler/smack-next:
  smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
  smackfs: use __GFP_NOFAIL for smk_cipso_doi()
  Smack: fix W=1 build warnings
  smack: remove duplicated hook function
  Smack:- Use overlay inode label in smack_inode_copy_up()
  smack: Guard smack_ipv6_lock definition within a SMACK_IPV6_PORT_LABELING block
  smackfs: Fix use-after-free in netlbl_catmap_walk()
parents f2786f43 0934ad42

security/smack/smack_lsm.c

+25 −16
Original line number Diff line number Diff line
@@ -51,8 +51,10 @@ 
#define SMK_RECEIVING	1

#define SMK_SENDING	2



#ifdef SMACK_IPV6_PORT_LABELING

static DEFINE_MUTEX(smack_ipv6_lock);

static LIST_HEAD(smk_ipv6_port_list);

#endif

struct kmem_cache *smack_rule_cache;

int smack_enabled __initdata;
@@ -389,7 +391,7 @@ static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead, 


/**

 * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_*

 * @mode - input mode in form of PTRACE_MODE_*

 * @mode: input mode in form of PTRACE_MODE_*

 *

 * Returns a converted MAY_* mode usable by smack rules

 */
@@ -1213,6 +1215,7 @@ static int smack_inode_getattr(const struct path *path) 


/**

 * smack_inode_setxattr - Smack check for setting xattrs

 * @mnt_userns: active user namespace

 * @dentry: the object

 * @name: name of the attribute

 * @value: value of the attribute
@@ -1339,6 +1342,7 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name) 


/**

 * smack_inode_removexattr - Smack check on removexattr

 * @mnt_userns: active user namespace

 * @dentry: the object

 * @name: name of the attribute

 *
@@ -1398,6 +1402,7 @@ static int smack_inode_removexattr(struct user_namespace *mnt_userns, 


/**

 * smack_inode_getsecurity - get smack xattrs

 * @mnt_userns: active user namespace

 * @inode: the object

 * @name: attribute name

 * @buffer: where to put the result
@@ -1619,13 +1624,14 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd, 
}



/**

 * smack_mmap_file :

 * Check permissions for a mmap operation.  The @file may be NULL, e.g.

 * if mapping anonymous memory.

 * @file contains the file structure for file to map (may be NULL).

 * @reqprot contains the protection requested by the application.

 * @prot contains the protection that will be applied by the kernel.

 * @flags contains the operational flags.

 * smack_mmap_file - Check permissions for a mmap operation.

 * @file: contains the file structure for file to map (may be NULL).

 * @reqprot: contains the protection requested by the application.

 * @prot: contains the protection that will be applied by the kernel.

 * @flags: contains the operational flags.

 *

 * The @file may be NULL, e.g. if mapping anonymous memory.

 *

 * Return 0 if permission is granted.

 */

static int smack_mmap_file(struct file *file,
@@ -2603,7 +2609,6 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) 
	mutex_unlock(&smack_ipv6_lock);

	return;

}

#endif



/**

 * smk_ipv6_port_check - check Smack port access
@@ -2666,6 +2671,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, 


	return smk_ipv6_check(skp, object, address, act);

}

#endif



/**

 * smack_inode_setsecurity - set smack xattrs
@@ -2852,8 +2858,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 
			rc = smk_ipv6_check(ssp->smk_out, rsp, sip,

					    SMK_CONNECTING);

		}

		if (__is_defined(SMACK_IPV6_PORT_LABELING))

#ifdef SMACK_IPV6_PORT_LABELING

		rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);

#endif



		return rc;

	}
@@ -3051,7 +3058,7 @@ static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg) 
}



/**

 * smack_sem_shmctl - Smack access check for sem

 * smack_sem_semctl - Smack access check for sem

 * @isp: the object

 * @cmd: what it wants to do

 *
@@ -3197,7 +3204,7 @@ static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg 
}



/**

 * smack_msg_queue_msgsnd - Smack access check for msg_queue

 * smack_msg_queue_msgrcv - Smack access check for msg_queue

 * @isp: the object

 * @msg: unused

 * @target: unused
@@ -3206,8 +3213,10 @@ static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg 
 *

 * Returns 0 if current has read and write access, error code otherwise

 */

static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg,

			struct task_struct *target, long type, int mode)

static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp,

				  struct msg_msg *msg,

				  struct task_struct *target, long type,

				  int mode)

{

	return smk_curacc_msq(isp, MAY_READWRITE);

}
@@ -4634,7 +4643,7 @@ static int smack_inode_copy_up(struct dentry *dentry, struct cred **new) 
	/*

	 * Get label from overlay inode and set it in create_sid

	 */

	isp = smack_inode(d_inode(dentry->d_parent));

	isp = smack_inode(d_inode(dentry));

	skp = isp->smk_inode;

	tsp->smk_task = skp;

	*new = new_creds;

security/smack/smack_netfilter.c

+3 −23
Original line number Diff line number Diff line
@@ -18,27 +18,7 @@ 
#include <net/net_namespace.h>

#include "smack.h"



#if IS_ENABLED(CONFIG_IPV6)



static unsigned int smack_ipv6_output(void *priv,

					struct sk_buff *skb,

					const struct nf_hook_state *state)

{

	struct sock *sk = skb_to_full_sk(skb);

	struct socket_smack *ssp;

	struct smack_known *skp;



	if (sk && sk->sk_security) {

		ssp = sk->sk_security;

		skp = ssp->smk_out;

		skb->secmark = skp->smk_secid;

	}



	return NF_ACCEPT;

}

#endif	/* IPV6 */



static unsigned int smack_ipv4_output(void *priv,

static unsigned int smack_ip_output(void *priv,

					struct sk_buff *skb,

					const struct nf_hook_state *state)

{
@@ -57,14 +37,14 @@ static unsigned int smack_ipv4_output(void *priv, 


static const struct nf_hook_ops smack_nf_ops[] = {

	{

		.hook =		smack_ipv4_output,

		.hook =		smack_ip_output,

		.pf =		NFPROTO_IPV4,

		.hooknum =	NF_INET_LOCAL_OUT,

		.priority =	NF_IP_PRI_SELINUX_FIRST,

	},

#if IS_ENABLED(CONFIG_IPV6)

	{

		.hook =		smack_ipv6_output,

		.hook =		smack_ip_output,

		.pf =		NFPROTO_IPV6,

		.hooknum =	NF_INET_LOCAL_OUT,

		.priority =	NF_IP6_PRI_SELINUX_FIRST,

security/smack/smackfs.c

+6 −5
Original line number Diff line number Diff line
@@ -693,9 +693,7 @@ static void smk_cipso_doi(void) 
		printk(KERN_WARNING "%s:%d remove rc = %d\n",

		       __func__, __LINE__, rc);



	doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);

	if (doip == NULL)

		panic("smack:  Failed to initialize cipso DOI.\n");

	doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL);

	doip->map.std = NULL;

	doip->doi = smk_cipso_doi_value;

	doip->type = CIPSO_V4_MAP_PASS;
@@ -714,7 +712,7 @@ static void smk_cipso_doi(void) 
	if (rc != 0) {

		printk(KERN_WARNING "%s:%d map add rc = %d\n",

		       __func__, __LINE__, rc);

		kfree(doip);

		netlbl_cfg_cipsov4_del(doip->doi, &nai);

		return;

	}

}
@@ -831,6 +829,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file) 
static ssize_t smk_set_cipso(struct file *file, const char __user *buf,

				size_t count, loff_t *ppos, int format)

{

	struct netlbl_lsm_catmap *old_cat;

	struct smack_known *skp;

	struct netlbl_lsm_secattr ncats;

	char mapcatset[SMK_CIPSOLEN];
@@ -920,9 +919,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, 


	rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);

	if (rc >= 0) {

		netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);

		old_cat = skp->smk_netlabel.attr.mls.cat;

		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;

		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;

		synchronize_rcu();

		netlbl_catmap_free(old_cat);

		rc = count;

		/*

		 * This mapping may have been cached, so clear the cache.