AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-21 17:09:44 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

shm/security: Pass kern_ipc_perm not shmid_kernel into the shm security hooks

Browse Source 
All of the implementations of security hooks that take shmid_kernel only
access shm_perm the struct kern_ipc_perm member.  This means the
dependencies of the shm security hooks can be simplified by passing
the kern_ipc_perm member of shmid_kernel..

Making this change will allow struct shmid_kernel to become private to ipc/shm.c.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2018-03-22 21:08:27 -05:00
parent aefad9593e
commit 7191adff2a
6 changed files with 52 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/linux/lsm_hooks.h
View File

@ -1585,11 +1585,11 @@ union security_list_options {
struct task_struct *target, long type, struct task_struct *target, long type,
int mode); int mode);
int (*shm_alloc_security)(struct shmid_kernel *shp); int (*shm_alloc_security)(struct kern_ipc_perm *shp);
void (*shm_free_security)(struct shmid_kernel *shp); void (*shm_free_security)(struct kern_ipc_perm *shp);
int (*shm_associate)(struct shmid_kernel *shp, int shmflg); int (*shm_associate)(struct kern_ipc_perm *shp, int shmflg);
int (*shm_shmctl)(struct shmid_kernel *shp, int cmd); int (*shm_shmctl)(struct kern_ipc_perm *shp, int cmd);
int (*shm_shmat)(struct shmid_kernel *shp, char __user *shmaddr, int (*shm_shmat)(struct kern_ipc_perm *shp, char __user *shmaddr,
int shmflg); int shmflg);
int (*sem_alloc_security)(struct kern_ipc_perm *sma); int (*sem_alloc_security)(struct kern_ipc_perm *sma);

21
include/linux/security.h
View File

@ -49,7 +49,6 @@ struct qstr;
struct iattr; struct iattr;
struct fown_struct; struct fown_struct;
struct file_operations; struct file_operations;
struct shmid_kernel;
struct msg_msg; struct msg_msg;
struct msg_queue; struct msg_queue;
struct xattr; struct xattr;
@ -362,11 +361,11 @@ int security_msg_queue_msgsnd(struct msg_queue *msq,
struct msg_msg *msg, int msqflg); struct msg_msg *msg, int msqflg);
int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
struct task_struct *target, long type, int mode); struct task_struct *target, long type, int mode);
int security_shm_alloc(struct shmid_kernel *shp); int security_shm_alloc(struct kern_ipc_perm *shp);
void security_shm_free(struct shmid_kernel *shp); void security_shm_free(struct kern_ipc_perm *shp);
int security_shm_associate(struct shmid_kernel *shp, int shmflg); int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
int security_shm_shmctl(struct shmid_kernel *shp, int cmd); int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg); int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
int security_sem_alloc(struct kern_ipc_perm *sma); int security_sem_alloc(struct kern_ipc_perm *sma);
void security_sem_free(struct kern_ipc_perm *sma); void security_sem_free(struct kern_ipc_perm *sma);
int security_sem_associate(struct kern_ipc_perm *sma, int semflg); int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
@ -1077,26 +1076,26 @@ static inline int security_msg_queue_msgrcv(struct msg_queue *msq,
return 0; return 0;
} }
static inline int security_shm_alloc(struct shmid_kernel *shp) static inline int security_shm_alloc(struct kern_ipc_perm *shp)
{ {
return 0; return 0;
} }
static inline void security_shm_free(struct shmid_kernel *shp) static inline void security_shm_free(struct kern_ipc_perm *shp)
{ } { }
static inline int security_shm_associate(struct shmid_kernel *shp, static inline int security_shm_associate(struct kern_ipc_perm *shp,
int shmflg) int shmflg)
{ {
return 0; return 0;
} }
static inline int security_shm_shmctl(struct shmid_kernel *shp, int cmd) static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
{ {
return 0; return 0;
} }
static inline int security_shm_shmat(struct shmid_kernel *shp, static inline int security_shm_shmat(struct kern_ipc_perm *shp,
char __user *shmaddr, int shmflg) char __user *shmaddr, int shmflg)
{ {
return 0; return 0;

17
ipc/shm.c
View File

@ -181,7 +181,7 @@ static void shm_rcu_free(struct rcu_head *head)
rcu); rcu);
struct shmid_kernel *shp = container_of(ptr, struct shmid_kernel, struct shmid_kernel *shp = container_of(ptr, struct shmid_kernel,
shm_perm); shm_perm);
security_shm_free(shp); security_shm_free(&shp->shm_perm);
kvfree(shp); kvfree(shp);
} }
@ -554,7 +554,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
shp->mlock_user = NULL; shp->mlock_user = NULL;
shp->shm_perm.security = NULL; shp->shm_perm.security = NULL;
error = security_shm_alloc(shp); error = security_shm_alloc(&shp->shm_perm);
if (error) { if (error) {
kvfree(shp); kvfree(shp);
return error; return error;
@ -635,10 +635,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
*/ */
static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg) static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
{ {
struct shmid_kernel *shp; return security_shm_associate(ipcp, shmflg);
shp = container_of(ipcp, struct shmid_kernel, shm_perm);
return security_shm_associate(shp, shmflg);
} }
/* /*
@ -835,7 +832,7 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
shp = container_of(ipcp, struct shmid_kernel, shm_perm); shp = container_of(ipcp, struct shmid_kernel, shm_perm);
err = security_shm_shmctl(shp, cmd); err = security_shm_shmctl(&shp->shm_perm, cmd);
if (err) if (err)
goto out_unlock1; goto out_unlock1;
@ -934,7 +931,7 @@ static int shmctl_stat(struct ipc_namespace *ns, int shmid,
if (ipcperms(ns, &shp->shm_perm, S_IRUGO)) if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
goto out_unlock; goto out_unlock;
err = security_shm_shmctl(shp, cmd); err = security_shm_shmctl(&shp->shm_perm, cmd);
if (err) if (err)
goto out_unlock; goto out_unlock;
@ -978,7 +975,7 @@ static int shmctl_do_lock(struct ipc_namespace *ns, int shmid, int cmd)
} }
audit_ipc_obj(&(shp->shm_perm)); audit_ipc_obj(&(shp->shm_perm));
err = security_shm_shmctl(shp, cmd); err = security_shm_shmctl(&shp->shm_perm, cmd);
if (err) if (err)
goto out_unlock1; goto out_unlock1;
@ -1348,7 +1345,7 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
if (ipcperms(ns, &shp->shm_perm, acc_mode)) if (ipcperms(ns, &shp->shm_perm, acc_mode))
goto out_unlock; goto out_unlock;
err = security_shm_shmat(shp, shmaddr, shmflg); err = security_shm_shmat(&shp->shm_perm, shmaddr, shmflg);
if (err) if (err)
goto out_unlock; goto out_unlock;

10
security/security.c
View File

@ -1195,27 +1195,27 @@ int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode); return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
} }
int security_shm_alloc(struct shmid_kernel *shp) int security_shm_alloc(struct kern_ipc_perm *shp)
{ {
return call_int_hook(shm_alloc_security, 0, shp); return call_int_hook(shm_alloc_security, 0, shp);
} }
void security_shm_free(struct shmid_kernel *shp) void security_shm_free(struct kern_ipc_perm *shp)
{ {
call_void_hook(shm_free_security, shp); call_void_hook(shm_free_security, shp);
} }
int security_shm_associate(struct shmid_kernel *shp, int shmflg) int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
{ {
return call_int_hook(shm_associate, 0, shp, shmflg); return call_int_hook(shm_associate, 0, shp, shmflg);
} }
int security_shm_shmctl(struct shmid_kernel *shp, int cmd) int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
{ {
return call_int_hook(shm_shmctl, 0, shp, cmd); return call_int_hook(shm_shmctl, 0, shp, cmd);
} }
int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg) int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg)
{ {
return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg); return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
} }

28
security/selinux/hooks.c
View File

@ -5674,53 +5674,53 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
} }
/* Shared Memory security operations */ /* Shared Memory security operations */
static int selinux_shm_alloc_security(struct shmid_kernel *shp) static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
{ {
struct ipc_security_struct *isec; struct ipc_security_struct *isec;
struct common_audit_data ad; struct common_audit_data ad;
u32 sid = current_sid(); u32 sid = current_sid();
int rc; int rc;
rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM); rc = ipc_alloc_security(shp, SECCLASS_SHM);
if (rc) if (rc)
return rc; return rc;
isec = shp->shm_perm.security; isec = shp->security;
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = shp->shm_perm.key; ad.u.ipc_id = shp->key;
rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM, rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
SHM__CREATE, &ad); SHM__CREATE, &ad);
if (rc) { if (rc) {
ipc_free_security(&shp->shm_perm); ipc_free_security(shp);
return rc; return rc;
} }
return 0; return 0;
} }
static void selinux_shm_free_security(struct shmid_kernel *shp) static void selinux_shm_free_security(struct kern_ipc_perm *shp)
{ {
ipc_free_security(&shp->shm_perm); ipc_free_security(shp);
} }
static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg) static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
{ {
struct ipc_security_struct *isec; struct ipc_security_struct *isec;
struct common_audit_data ad; struct common_audit_data ad;
u32 sid = current_sid(); u32 sid = current_sid();
isec = shp->shm_perm.security; isec = shp->security;
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = shp->shm_perm.key; ad.u.ipc_id = shp->key;
return avc_has_perm(sid, isec->sid, SECCLASS_SHM, return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
SHM__ASSOCIATE, &ad); SHM__ASSOCIATE, &ad);
} }
/* Note, at this point, shp is locked down */ /* Note, at this point, shp is locked down */
static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd) static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
{ {
int perms; int perms;
int err; int err;
@ -5749,11 +5749,11 @@ static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
return 0; return 0;
} }
err = ipc_has_perm(&shp->shm_perm, perms); err = ipc_has_perm(shp, perms);
return err; return err;
} }
static int selinux_shm_shmat(struct shmid_kernel *shp, static int selinux_shm_shmat(struct kern_ipc_perm *shp,
char __user *shmaddr, int shmflg) char __user *shmaddr, int shmflg)
{ {
u32 perms; u32 perms;
@ -5763,7 +5763,7 @@ static int selinux_shm_shmat(struct shmid_kernel *shp,
else else
perms = SHM__READ | SHM__WRITE; perms = SHM__READ | SHM__WRITE;
return ipc_has_perm(&shp->shm_perm, perms); return ipc_has_perm(shp, perms);
} }
/* Semaphore security operations */ /* Semaphore security operations */

22
security/smack/smack_lsm.c
View File

@ -2950,9 +2950,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg)
* *
* Returns a pointer to the smack value * Returns a pointer to the smack value
*/ */
static struct smack_known *smack_of_shm(struct shmid_kernel *shp) static struct smack_known *smack_of_shm(struct kern_ipc_perm *shp)
{ {
return (struct smack_known *)shp->shm_perm.security; return (struct smack_known *)shp->security;
} }
/** /**
@ -2961,9 +2961,9 @@ static struct smack_known *smack_of_shm(struct shmid_kernel *shp)
* *
* Returns 0 * Returns 0
*/ */
static int smack_shm_alloc_security(struct shmid_kernel *shp) static int smack_shm_alloc_security(struct kern_ipc_perm *shp)
{ {
struct kern_ipc_perm *isp = &shp->shm_perm; struct kern_ipc_perm *isp = shp;
struct smack_known *skp = smk_of_current(); struct smack_known *skp = smk_of_current();
isp->security = skp; isp->security = skp;
@ -2976,9 +2976,9 @@ static int smack_shm_alloc_security(struct shmid_kernel *shp)
* *
* Clears the blob pointer * Clears the blob pointer
*/ */
static void smack_shm_free_security(struct shmid_kernel *shp) static void smack_shm_free_security(struct kern_ipc_perm *shp)
{ {
struct kern_ipc_perm *isp = &shp->shm_perm; struct kern_ipc_perm *isp = shp;
isp->security = NULL; isp->security = NULL;
} }
@ -2990,7 +2990,7 @@ static void smack_shm_free_security(struct shmid_kernel *shp)
* *
* Returns 0 if current has the requested access, error code otherwise * Returns 0 if current has the requested access, error code otherwise
*/ */
static int smk_curacc_shm(struct shmid_kernel *shp, int access) static int smk_curacc_shm(struct kern_ipc_perm *shp, int access)
{ {
struct smack_known *ssp = smack_of_shm(shp); struct smack_known *ssp = smack_of_shm(shp);
struct smk_audit_info ad; struct smk_audit_info ad;
@ -2998,7 +2998,7 @@ static int smk_curacc_shm(struct shmid_kernel *shp, int access)
#ifdef CONFIG_AUDIT #ifdef CONFIG_AUDIT
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
ad.a.u.ipc_id = shp->shm_perm.id; ad.a.u.ipc_id = shp->id;
#endif #endif
rc = smk_curacc(ssp, access, &ad); rc = smk_curacc(ssp, access, &ad);
rc = smk_bu_current("shm", ssp, access, rc); rc = smk_bu_current("shm", ssp, access, rc);
@ -3012,7 +3012,7 @@ static int smk_curacc_shm(struct shmid_kernel *shp, int access)
* *
* Returns 0 if current has the requested access, error code otherwise * Returns 0 if current has the requested access, error code otherwise
*/ */
static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) static int smack_shm_associate(struct kern_ipc_perm *shp, int shmflg)
{ {
int may; int may;
@ -3027,7 +3027,7 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
* *
* Returns 0 if current has the requested access, error code otherwise * Returns 0 if current has the requested access, error code otherwise
*/ */
static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) static int smack_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
{ {
int may; int may;
@ -3062,7 +3062,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
* *
* Returns 0 if current has the requested access, error code otherwise * Returns 0 if current has the requested access, error code otherwise
*/ */
static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, static int smack_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr,
int shmflg) int shmflg)
{ {
int may; int may;