Several of the Linux Security Module (LSM) interfaces use a pair of pointers for transmitting security context data and data length. The data passed is refered to as a security context. While all existing modules provide nul terminated strings, there is no requirement that they to so. Hence, the length is necessary. Security contexts are provided by a number of interfaces. The interface security_release_secctx() is used when the caller is finished with the data. Each of the security modules that provide security contexts manages them differently. This was safe in the past, because only one security module that provides security contexts is allowed to be active. To allow multiple active modules that use security contexts it is necessary to identify which security module created a security context. Adding a third pointer to the interfaces for the LSM identification is not appealing. A new structure, lsm_context, is created for use in these interfaces. It includes three members: the data pointer, the data length and the LSM ID of its creator. The interfaces that create contexts and security_release_secctx() now use a pointer to an lsm_context instead of a pointer pair. The changes are mostly mechanical, and some scaffolding is used within the patch set to allow for smaller individual patches. This patch set depends on the patch set LSM: Move away from secids: https://lore.kernel.org/lkml/0529f07a-d8c5-4290-8056-6d04aa70c670@xxxxxxxxxxxxxxxxxxx/T/ https://github.com/cschaufler/lsm-stacking.git#lsm_context-after-lsm_prop-6.11-rc3 Casey Schaufler (5): LSM: Replace context+len with lsm_context LSM: Use lsm_context in security_inode_getsecctx LSM: lsm_context in security_dentry_init_security LSM: secctx provider check on release LSM: Use lsm_context in security_inode_notifysecctx drivers/android/binder.c | 5 +- fs/ceph/super.h | 3 +- fs/ceph/xattr.c | 16 +++---- fs/fuse/dir.c | 35 +++++++------- fs/nfs/dir.c | 2 +- fs/nfs/inode.c | 16 ++++--- fs/nfs/internal.h | 8 ++-- fs/nfs/nfs4proc.c | 22 ++++----- fs/nfs/nfs4xdr.c | 22 +++++---- fs/nfsd/nfs4xdr.c | 25 ++++------ include/linux/lsm_hook_defs.h | 14 +++--- include/linux/nfs4.h | 8 ++-- include/linux/nfs_fs.h | 2 +- include/linux/security.h | 44 +++++------------- include/net/scm.h | 5 +- kernel/audit.c | 9 ++-- kernel/auditsc.c | 16 +++---- net/ipv4/ip_sockglue.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 8 ++-- net/netfilter/nf_conntrack_standalone.c | 4 +- net/netfilter/nfnetlink_queue.c | 27 +++++------ net/netlabel/netlabel_unlabeled.c | 13 ++---- net/netlabel/netlabel_user.c | 3 +- security/apparmor/include/secid.h | 5 +- security/apparmor/secid.c | 36 ++++++-------- security/security.c | 62 +++++++++++-------------- security/selinux/hooks.c | 57 ++++++++++++++--------- security/smack/smack_lsm.c | 55 +++++++++++++--------- 28 files changed, 244 insertions(+), 282 deletions(-) -- 2.46.0
