On 2/20/2025 9:40 AM, Paul Moore wrote:
> On Thu, Feb 20, 2025 at 11:43 AM Stephen Smalley
> <stephen.smalley.work@xxxxxxxxx> wrote:
>> On Wed, Oct 23, 2024 at 5:23 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote:
>>> Replace the (secctx,seclen) pointer pair with a single lsm_context
>>> pointer to allow return of the LSM identifier along with the context
>>> and context length. This allows security_release_secctx() to know how
>>> to release the context. Callers have been modified to use or save the
>>> returned data from the new structure.
>>>
>>> Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
>>> Cc: ceph-devel@xxxxxxxxxxxxxxx
>>> Cc: linux-nfs@xxxxxxxxxxxxxxx
>>> ---
>>> fs/ceph/super.h | 3 +--
>>> fs/ceph/xattr.c | 16 ++++++----------
>>> fs/fuse/dir.c | 35 ++++++++++++++++++-----------------
>>> fs/nfs/nfs4proc.c | 20 ++++++++++++--------
>>> include/linux/lsm_hook_defs.h | 2 +-
>>> include/linux/security.h | 26 +++-----------------------
>>> security/security.c | 9 ++++-----
>>> security/selinux/hooks.c | 9 +++++----
>>> 8 files changed, 50 insertions(+), 70 deletions(-)
>>>
>>> diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
>>> index 76776d716744..0b116ef3a752 100644
>>> --- a/fs/nfs/nfs4proc.c
>>> +++ b/fs/nfs/nfs4proc.c
>>> @@ -114,6 +114,7 @@ static inline struct nfs4_label *
>>> nfs4_label_init_security(struct inode *dir, struct dentry *dentry,
>>> struct iattr *sattr, struct nfs4_label *label)
>>> {
>>> + struct lsm_context shim;
>>> int err;
>>>
>>> if (label == NULL)
>>> @@ -128,21 +129,24 @@ nfs4_label_init_security(struct inode *dir, struct dentry *dentry,
>>> label->label = NULL;
>>>
>>> err = security_dentry_init_security(dentry, sattr->ia_mode,
>>> - &dentry->d_name, NULL,
>>> - (void **)&label->label, &label->len);
>>> - if (err == 0)
>>> - return label;
>>> + &dentry->d_name, NULL, &shim);
>>> + if (err)
>>> + return NULL;
>>>
>>> - return NULL;
>>> + label->label = shim.context;
>>> + label->len = shim.len;
>>> + return label;
>>> }
>>> static inline void
>>> nfs4_label_release_security(struct nfs4_label *label)
>>> {
>>> - struct lsm_context scaff; /* scaffolding */
>>> + struct lsm_context shim;
>>>
>>> if (label) {
>>> - lsmcontext_init(&scaff, label->label, label->len, 0);
>>> - security_release_secctx(&scaff);
>>> + shim.context = label->label;
>>> + shim.len = label->len;
>>> + shim.id = LSM_ID_UNDEF;
>> Is there a patch that follows this one to fix this? Otherwise, setting
>> this to UNDEF causes SELinux to NOT free the context, which produces a
>> memory leak for every NFS inode security context. Reported by kmemleak
>> when running the selinux-testsuite NFS tests.
> I don't recall seeing anything related to this, but patches are
> definitely welcome.
I'm looking into this but as you well know the NFS tests aren't
always especially cooperative.
