Commit efd1df19 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull selinux updates from Paul Moore:
 "We've got twelve patches queued for v5.19, with most being fairly
  minor. The highlights are below:

   - The checkreqprot and runtime disable knobs have been deprecated for
     some time with no active users that we can find. In an effort to
     move things along we are adding a pause when the knobs are used to
     help make the deprecation more noticeable in case anyone is still
     using these hacks in the shadows.

   - We've added the anonymous inode class name to the AVC audit records
     when anonymous inodes are involved. This should make writing policy
     easier when anonymous inodes are involved.

   - More constification work. This is fairly straightforward and the
     source of most of the diffstat.

   - The usual minor cleanups: remove unnecessary assignments, assorted
     style/checkpatch fixes, kdoc fixes, macro while-loop
     encapsulations, #include tweaks, etc"

* tag 'selinux-pr-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  security: declare member holding string literal const
  selinux: log anon inode class name
  selinux: declare data arrays const
  selinux: fix indentation level of mls_ops block
  selinux: include necessary headers in headers
  selinux: avoid extra semicolon
  selinux: update parameter documentation
  selinux: resolve checkpatch errors
  selinux: don't sleep when CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is true
  selinux: checkreqprot is deprecated, add some ssleep() discomfort
  selinux: runtime disable is deprecated, add some ssleep() discomfort
  selinux: Remove redundant assignments
parents a6b45057 1af0e4a0

include/linux/lsm_audit.h

+2 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ struct common_audit_data { 
#define LSM_AUDIT_DATA_IBENDPORT 14

#define LSM_AUDIT_DATA_LOCKDOWN 15

#define LSM_AUDIT_DATA_NOTIFICATION 16

#define LSM_AUDIT_DATA_ANONINODE	17

	union 	{

		struct path path;

		struct dentry *dentry;
@@ -96,6 +97,7 @@ struct common_audit_data { 
		struct lsm_ibpkey_audit *ibpkey;

		struct lsm_ibendport_audit *ibendport;

		int reason;

		const char *anonclass;

	} u;

	/* this union contains LSM specific data */

	union {

include/linux/lsm_hooks.h

+2 −2
Original line number Diff line number Diff line
@@ -1595,7 +1595,7 @@ struct security_hook_list { 
	struct hlist_node		list;

	struct hlist_head		*head;

	union security_list_options	hook;

	char				*lsm;

	const char			*lsm;

} __randomize_layout;



/*
@@ -1630,7 +1630,7 @@ extern struct security_hook_heads security_hook_heads; 
extern char *lsm_names;



extern void security_add_hooks(struct security_hook_list *hooks, int count,

				char *lsm);

				const char *lsm);



#define LSM_FLAG_LEGACY_MAJOR	BIT(0)

#define LSM_FLAG_EXCLUSIVE	BIT(1)

scripts/selinux/genheaders/genheaders.c

+45 −30
Original line number Diff line number Diff line
@@ -59,35 +59,27 @@ int main(int argc, char *argv[]) 
		exit(2);

	}



	for (i = 0; secclass_map[i].name; i++) {

		struct security_class_mapping *map = &secclass_map[i];

		map->name = stoupperx(map->name);

		for (j = 0; map->perms[j]; j++)

			map->perms[j] = stoupperx(map->perms[j]);

	}



	isids_len = sizeof(initial_sid_to_string) / sizeof (char *);

	for (i = 1; i < isids_len; i++) {

		const char *s = initial_sid_to_string[i];



		if (s)

			initial_sid_to_string[i] = stoupperx(s);

	}



	fprintf(fout, "/* This file is automatically generated.  Do not edit. */\n");

	fprintf(fout, "#ifndef _SELINUX_FLASK_H_\n#define _SELINUX_FLASK_H_\n\n");



	for (i = 0; secclass_map[i].name; i++) {

		struct security_class_mapping *map = &secclass_map[i];

		fprintf(fout, "#define SECCLASS_%-39s %2d\n", map->name, i+1);

		char *name = stoupperx(secclass_map[i].name);



		fprintf(fout, "#define SECCLASS_%-39s %2d\n", name, i+1);

		free(name);

	}



	fprintf(fout, "\n");



	isids_len = sizeof(initial_sid_to_string) / sizeof(char *);

	for (i = 1; i < isids_len; i++) {

		const char *s = initial_sid_to_string[i];

		if (s)

			fprintf(fout, "#define SECINITSID_%-39s %2d\n", s, i);

		if (s) {

			char *sidname = stoupperx(s);



			fprintf(fout, "#define SECINITSID_%-39s %2d\n", sidname, i);

			free(sidname);

		}

	}

	fprintf(fout, "\n#define SECINITSID_NUM %d\n", i-1);

	fprintf(fout, "\nstatic inline bool security_is_socket_class(u16 kern_tclass)\n");
@@ -96,10 +88,14 @@ int main(int argc, char *argv[]) 
	fprintf(fout, "\tswitch (kern_tclass) {\n");

	for (i = 0; secclass_map[i].name; i++) {

		static char s[] = "SOCKET";

		struct security_class_mapping *map = &secclass_map[i];

		int len = strlen(map->name), l = sizeof(s) - 1;

		if (len >= l && memcmp(map->name + len - l, s, l) == 0)

			fprintf(fout, "\tcase SECCLASS_%s:\n", map->name);

		int len, l;

		char *name = stoupperx(secclass_map[i].name);



		len = strlen(name);

		l = sizeof(s) - 1;

		if (len >= l && memcmp(name + len - l, s, l) == 0)

			fprintf(fout, "\tcase SECCLASS_%s:\n", name);

		free(name);

	}

	fprintf(fout, "\t\tsock = true;\n");

	fprintf(fout, "\t\tbreak;\n");
@@ -110,33 +106,52 @@ int main(int argc, char *argv[]) 
	fprintf(fout, "}\n");



	fprintf(fout, "\n#endif\n");

	fclose(fout);



	if (fclose(fout) != 0) {

		fprintf(stderr, "Could not successfully close %s:  %s\n",

			argv[1], strerror(errno));

		exit(4);

	}



	fout = fopen(argv[2], "w");

	if (!fout) {

		fprintf(stderr, "Could not open %s for writing:  %s\n",

			argv[2], strerror(errno));

		exit(4);

		exit(5);

	}



	fprintf(fout, "/* This file is automatically generated.  Do not edit. */\n");

	fprintf(fout, "#ifndef _SELINUX_AV_PERMISSIONS_H_\n#define _SELINUX_AV_PERMISSIONS_H_\n\n");



	for (i = 0; secclass_map[i].name; i++) {

		struct security_class_mapping *map = &secclass_map[i];

		int len = strlen(map->name);

		const struct security_class_mapping *map = &secclass_map[i];

		int len;

		char *name = stoupperx(map->name);



		len = strlen(name);

		for (j = 0; map->perms[j]; j++) {

			char *permname;



			if (j >= 32) {

				fprintf(stderr, "Too many permissions to fit into an access vector at (%s, %s).\n",

					map->name, map->perms[j]);

				exit(5);

			}

			fprintf(fout, "#define %s__%-*s 0x%08xU\n", map->name,

				39-len, map->perms[j], 1U<<j);

			permname = stoupperx(map->perms[j]);

			fprintf(fout, "#define %s__%-*s 0x%08xU\n", name,

				39-len, permname, 1U<<j);

			free(permname);

		}

		free(name);

	}



	fprintf(fout, "\n#endif\n");

	fclose(fout);



	if (fclose(fout) != 0) {

		fprintf(stderr, "Could not successfully close %s:  %s\n",

			argv[2], strerror(errno));

		exit(6);

	}



	exit(0);

}

scripts/selinux/mdp/mdp.c

+2 −2
Original line number Diff line number Diff line
@@ -82,7 +82,7 @@ int main(int argc, char *argv[]) 


	/* print out the class permissions */

	for (i = 0; secclass_map[i].name; i++) {

		struct security_class_mapping *map = &secclass_map[i];

		const struct security_class_mapping *map = &secclass_map[i];

		fprintf(fout, "class %s\n", map->name);

		fprintf(fout, "{\n");

		for (j = 0; map->perms[j]; j++)
@@ -103,7 +103,7 @@ int main(int argc, char *argv[]) 
#define SYSTEMLOW "s0"

#define SYSTEMHIGH "s1:c0.c1"

		for (i = 0; secclass_map[i].name; i++) {

			struct security_class_mapping *map = &secclass_map[i];

			const struct security_class_mapping *map = &secclass_map[i];



			fprintf(fout, "mlsconstrain %s {\n", map->name);

			for (j = 0; map->perms[j]; j++)

security/lsm_audit.c

+3 −0
Original line number Diff line number Diff line
@@ -433,6 +433,9 @@ static void dump_common_audit_data(struct audit_buffer *ab, 
		audit_log_format(ab, " lockdown_reason=\"%s\"",

				 lockdown_reasons[a->u.reason]);

		break;

	case LSM_AUDIT_DATA_ANONINODE:

		audit_log_format(ab, " anonclass=%s", a->u.anonclass);

		break;

	} /* switch (a->type) */

}