diff options
| author | Casey Schaufler <casey@schaufler-ca.com> | 2018-11-12 12:02:49 -0800 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2019-01-08 13:18:44 -0800 |
| commit | 33bf60cabcc7687b194a689b068b65e9ecd556be (patch) | |
| tree | f8bbf4c27ce73e33ab5f1efa7e99448ab9755373 /security/smack | |
| parent | f28952ac900822a189fc383a5b73631e72c69356 (diff) | |
| download | linux-stable-33bf60cabcc7687b194a689b068b65e9ecd556be.tar.gz linux-stable-33bf60cabcc7687b194a689b068b65e9ecd556be.tar.bz2 linux-stable-33bf60cabcc7687b194a689b068b65e9ecd556be.zip | |
LSM: Infrastructure management of the file security
Move management of the file->f_security blob out of the
individual security modules and into the infrastructure.
The modules no longer allocate or free the data, instead
they tell the infrastructure how much space they require.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'security/smack')
| -rw-r--r-- | security/smack/smack.h | 3 | ||||
| -rw-r--r-- | security/smack/smack_lsm.c | 14 |
2 files changed, 3 insertions, 14 deletions
diff --git a/security/smack/smack.h b/security/smack/smack.h index 50854969a391..2007d38d0e46 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -364,7 +364,8 @@ static inline struct task_smack *smack_cred(const struct cred *cred) static inline struct smack_known **smack_file(const struct file *file) { - return (struct smack_known **)&file->f_security; + return (struct smack_known **)(file->f_security + + smack_blob_sizes.lbs_file); } /* diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8f72641f94ab..7c76668ea3a6 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1496,18 +1496,6 @@ static int smack_file_alloc_security(struct file *file) } /** - * smack_file_free_security - clear a file security blob - * @file: the object - * - * The security blob for a file is a pointer to the master - * label list, so no memory is freed. - */ -static void smack_file_free_security(struct file *file) -{ - file->f_security = NULL; -} - -/** * smack_file_ioctl - Smack check on ioctls * @file: the object * @cmd: what to do @@ -4559,6 +4547,7 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { .lbs_cred = sizeof(struct task_smack), + .lbs_file = sizeof(struct smack_known *), }; static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { @@ -4595,7 +4584,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid), LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security), - LSM_HOOK_INIT(file_free_security, smack_file_free_security), LSM_HOOK_INIT(file_ioctl, smack_file_ioctl), LSM_HOOK_INIT(file_lock, smack_file_lock), LSM_HOOK_INIT(file_fcntl, smack_file_fcntl), |