Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2024-12-29 09:12:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lsm: secctx provider check on release

Browse Source 
Verify that the LSM releasing the secctx is the LSM that
allocated it. This was not necessary when only one LSM could
create a secctx, but once there can be more than one it is.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2024-10-23 14:21:58 -07:00 committed by Paul Moore
parent b530104f50
commit a4626e9786
2 changed files with 10 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/apparmor/secid.c
View File

@ -108,14 +108,11 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
void apparmor_release_secctx(struct lsm_context *cp)
{
/*
* stacking scaffolding:
* When it is possible for more than one LSM to provide a
* release hook, do this check:
* if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF)
*/
if (cp->id == LSM_ID_APPARMOR) {
kfree(cp->context);
cp->context = NULL;
cp->id = LSM_ID_UNDEF;
}
}
/**

11
security/selinux/hooks.c
View File

@ -6672,14 +6672,11 @@ static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
static void selinux_release_secctx(struct lsm_context *cp)
{
/*
* stacking scaffolding:
* When it is possible for more than one LSM to provide a
* release hook, do this check:
* if (cp->id == LSM_ID_SELINUX || cp->id == LSM_ID_UNDEF)
*/
if (cp->id == LSM_ID_SELINUX) {
kfree(cp->context);
cp->context = NULL;
cp->id = LSM_ID_UNDEF;
}
}
static void selinux_inode_invalidate_secctx(struct inode *inode)