Re: [PATCH v3 16/16] LSM: Blob sharing support for S.A.R.A and LandLock

[Kees Cook <keescook@xxxxxxxxxxxx>]

On Wed, Sep 19, 2018 at 5:21 PM, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote:
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 8f3b809d7c26..0156ffea7f8c 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -3475,18 +3475,16 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
>  {
>         struct smack_known *skp = smk_of_task_struct(p);
>         char *cp;
> -       int slen;
>
> -       if (strcmp(name, "current") != 0)
> +       if (strcmp(name, "current") == 0) {
> +               cp = kstrdup(skp->smk_known, GFP_KERNEL);
> +               if (cp == NULL)
> +                       return -ENOMEM;
> +       } else
>                 return -EINVAL;
>
> -       cp = kstrdup(skp->smk_known, GFP_KERNEL);
> -       if (cp == NULL)
> -               return -ENOMEM;
> -
> -       slen = strlen(cp);
>         *value = cp;
> -       return slen;
> +       return strlen(cp);
>  }

This should be separate: it looks like unrelated refactoring? (I
mentioned this before, I think?)

> diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
> index 0110bebe86e2..f386f92c57c5 100644
> --- a/security/tomoyo/common.h
> +++ b/security/tomoyo/common.h
> @@ -1216,8 +1221,13 @@ static inline struct tomoyo_domain_info **tomoyo_cred(const struct cred *cred)
>   */
>  static inline struct tomoyo_domain_info *tomoyo_domain(void)
>  {
> -       struct tomoyo_domain_info **blob = tomoyo_cred(current_cred());
> +       const struct cred *cred = current_cred();
> +       struct tomoyo_domain_info **blob;
> +
> +       if (cred->security == NULL)
> +               return NULL;
>
> +       blob = tomoyo_cred(cred);
>         return *blob;
>  }

I think this is another lost hunk?

-Kees

-- 
Kees Cook
Pixel Security