stuartl/linux-stable
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable.git synced 2025-09-14 11:19:08 +10:00
Code Issues Releases Wiki Activity

lsm: secctx provider check on release

Browse Source 
Verify that the LSM releasing the secctx is the LSM that
allocated it. This was not necessary when only one LSM could
create a secctx, but once there can be more than one it is.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2024-10-23 14:21:58 -07:00 committed by Paul Moore
parent b530104f50
commit a4626e9786
2 changed files with 10 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/apparmor/secid.c
View File

@ -108,14 +108,11 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
void apparmor_release_secctx(struct lsm_context *cp) void apparmor_release_secctx(struct lsm_context *cp)
{ {
/* if (cp->id == LSM_ID_APPARMOR) {
* stacking scaffolding:
* When it is possible for more than one LSM to provide a
* release hook, do this check:
* if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF)
*/
kfree(cp->context); kfree(cp->context);
cp->context = NULL;
cp->id = LSM_ID_UNDEF;
}
} }
/** /**

11
security/selinux/hooks.c
View File

@ -6672,14 +6672,11 @@ static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
static void selinux_release_secctx(struct lsm_context *cp) static void selinux_release_secctx(struct lsm_context *cp)
{ {
/* if (cp->id == LSM_ID_SELINUX) {
* stacking scaffolding:
* When it is possible for more than one LSM to provide a
* release hook, do this check:
* if (cp->id == LSM_ID_SELINUX || cp->id == LSM_ID_UNDEF)
*/
kfree(cp->context); kfree(cp->context);
cp->context = NULL;
cp->id = LSM_ID_UNDEF;
}
} }
static void selinux_inode_invalidate_secctx(struct inode *inode) static void selinux_inode_invalidate_secctx(struct inode *inode)