mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-25 13:14:07 +08:00
4ebd7651bf
Of the three LSMs that implement the security_task_getsecid() LSM hook, all three LSMs provide the task's objective security credentials. This turns out to be unfortunate as most of the hook's callers seem to expect the task's subjective credentials, although a small handful of callers do correctly expect the objective credentials. This patch is the first step towards fixing the problem: it splits the existing security_task_getsecid() hook into two variants, one for the subjective creds, one for the objective creds. void security_task_getsecid_subj(struct task_struct *p, u32 *secid); void security_task_getsecid_obj(struct task_struct *p, u32 *secid); While this patch does fix all of the callers to use the correct variant, in order to keep this patch focused on the callers and to ease review, the LSMs continue to use the same implementation for both hooks. The net effect is that this patch should not change the behavior of the kernel in any way, it will be up to the latter LSM specific patches in this series to change the hook implementations and return the correct credentials. Acked-by: Mimi Zohar <zohar@linux.ibm.com> (IMA) Acked-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
52 lines
1.3 KiB
C
52 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* NetLabel NETLINK Interface
|
|
*
|
|
* This file defines the NETLINK interface for the NetLabel system. The
|
|
* NetLabel system manages static and dynamic label mappings for network
|
|
* protocols such as CIPSO and RIPSO.
|
|
*
|
|
* Author: Paul Moore <paul@paul-moore.com>
|
|
*/
|
|
|
|
/*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*/
|
|
|
|
#ifndef _NETLABEL_USER_H
|
|
#define _NETLABEL_USER_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/capability.h>
|
|
#include <linux/audit.h>
|
|
#include <net/netlink.h>
|
|
#include <net/genetlink.h>
|
|
#include <net/netlabel.h>
|
|
|
|
/* NetLabel NETLINK helper functions */
|
|
|
|
/**
|
|
* netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg
|
|
* @skb: the packet
|
|
* @audit_info: NetLabel audit information
|
|
*/
|
|
static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
|
|
struct netlbl_audit *audit_info)
|
|
{
|
|
security_task_getsecid_subj(current, &audit_info->secid);
|
|
audit_info->loginuid = audit_get_loginuid(current);
|
|
audit_info->sessionid = audit_get_sessionid(current);
|
|
}
|
|
|
|
/* NetLabel NETLINK I/O functions */
|
|
|
|
int netlbl_netlink_init(void);
|
|
|
|
/* NetLabel Audit Functions */
|
|
|
|
struct audit_buffer *netlbl_audit_start_common(int type,
|
|
struct netlbl_audit *audit_info);
|
|
|
|
#endif
|