summaryrefslogtreecommitdiffstats
path: root/include/linux/security.h
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2010-10-13 16:24:48 -0400
committerJames Morris <jmorris@namei.org>2010-10-21 10:12:50 +1100
commitd5630b9d276bd389299ffea620b7c340ab19bcf5 (patch)
tree4e97cadf12518fb107f9e7140fa94343bd6643f5 /include/linux/security.h
parent2606fd1fa5710205b23ee859563502aa18362447 (diff)
downloadlinux-d5630b9d276bd389299ffea620b7c340ab19bcf5.tar.gz
linux-d5630b9d276bd389299ffea620b7c340ab19bcf5.tar.bz2
linux-d5630b9d276bd389299ffea620b7c340ab19bcf5.zip
security: secid_to_secctx returns len when data is NULL
With the (long ago) interface change to have the secid_to_secctx functions do the string allocation instead of having the caller do the allocation we lost the ability to query the security server for the length of the upcoming string. The SECMARK code would like to allocate a netlink skb with enough length to hold the string but it is just too unclean to do the string allocation twice or to do the allocation the first time and hold onto the string and slen. This patch adds the ability to call security_secid_to_secctx() with a NULL data pointer and it will just set the slen pointer. Signed-off-by: Eric Paris <eparis@redhat.com> Reviewed-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'include/linux/security.h')
-rw-r--r--include/linux/security.h6
1 files changed, 5 insertions, 1 deletions
diff --git a/include/linux/security.h b/include/linux/security.h
index d70adc394f62..b8246a8df7d2 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1285,9 +1285,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* Return 0 if permission is granted.
*
* @secid_to_secctx:
- * Convert secid to security context.
+ * Convert secid to security context. If secdata is NULL the length of
+ * the result will be returned in seclen, but no secdata will be returned.
+ * This does mean that the length could change between calls to check the
+ * length and the next call which actually allocates and returns the secdata.
* @secid contains the security ID.
* @secdata contains the pointer that stores the converted security context.
+ * @seclen pointer which contains the length of the data
* @secctx_to_secid:
* Convert security context to secid.
* @secid contains the pointer to the generated security ID.