On Tue, Nov 23, 2021 at 8:50 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote:
>
> Change the secid parameter of security_audit_rule_match
> to a lsmblob structure pointer. Pass the entry from the
> lsmblob structure for the approprite slot to the LSM hook.
>
> Change the users of security_audit_rule_match to use the
> lsmblob instead of a u32. The scaffolding function lsmblob_init()
> fills the blob with the value of the old secid, ensuring that
> it is available to the appropriate module hook. The sources of
> the secid, security_task_getsecid() and security_inode_getsecid(),
> will be converted to use the blob structure later in the series.
> At the point the use of lsmblob_init() is dropped.
>
> Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
> Cc: linux-audit@xxxxxxxxxx
> ---
> include/linux/security.h | 5 +++--
> kernel/auditfilter.c | 6 ++++--
> kernel/auditsc.c | 16 +++++++++++-----
> security/security.c | 5 +++--
> 4 files changed, 21 insertions(+), 11 deletions(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index ddd4cf48413c..d846d90f5624 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -1954,7 +1954,7 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer)
> int security_audit_rule_init(u32 field, u32 op, char *rulestr,
> struct audit_rules *lsmrules);
> int security_audit_rule_known(struct audit_krule *krule);
> -int security_audit_rule_match(u32 secid, u32 field, u32 op,
> +int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
> struct audit_rules *lsmrules);
> void security_audit_rule_free(struct audit_rules *lsmrules);
>
> @@ -1971,7 +1971,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule)
> return 0;
> }
>
> -static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
> +static inline int security_audit_rule_match(struct lsmblob *blob secid,
> + u32 field, u32 op,
> struct audit_rules *lsmrules)
> {
> return 0;
Assuming you fixup the typo above that the test robot found it looks
reasonable to me.
Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx>
--
paul moore
www.paul-moore.com
