On 10/10/2024 8:08 PM, Paul Moore wrote:
> On Oct 9, 2024 Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote:
>> Replace the secid value stored in struct audit_context with a struct
>> lsm_prop. Change the code that uses this value to accommodate the
>> change. security_audit_rule_match() expects a lsm_prop, so existing
>> scaffolding can be removed. A call to security_secid_to_secctx()
>> is changed to security_lsmprop_to_secctx(). The call to
>> security_ipc_getsecid() is scaffolded.
>>
>> A new function lsmprop_is_set() is introduced to identify whether
>> an lsm_prop contains a non-zero value.
>>
>> Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
>> ---
>> include/linux/security.h | 24 ++++++++++++++++++++++++
>> kernel/audit.h | 3 ++-
>> kernel/auditsc.c | 19 ++++++++-----------
>> 3 files changed, 34 insertions(+), 12 deletions(-)
>>
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index f1c68e38b15d..5652baa4ca3c 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -291,6 +291,19 @@ static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
>>
>> #ifdef CONFIG_SECURITY
>>
>> +/**
>> + * lsmprop_is_set - report if there is a value in the lsm_prop
>> + * @prop: Pointer to the exported LSM data
>> + *
>> + * Returns true if there is a value set, false otherwise
>> + */
>> +static inline bool lsm_prop_is_set(struct lsm_prop *prop)
>> +{
>> + const struct lsm_prop empty = {};
>> +
>> + return !!memcmp(prop, &empty, sizeof(*prop));
>> +}
>> +
>> int call_blocking_lsm_notifier(enum lsm_event event, void *data);
>> int register_blocking_lsm_notifier(struct notifier_block *nb);
>> int unregister_blocking_lsm_notifier(struct notifier_block *nb);
>> @@ -552,6 +565,17 @@ int security_bdev_setintegrity(struct block_device *bdev,
>> size_t size);
>> #else /* CONFIG_SECURITY */
>>
>> +/**
>> + * lsmprop_is_set - report if there is a value in the lsm_prop
>> + * @prop: Pointer to the exported LSM data
>> + *
>> + * Returns true if there is a value set, false otherwise
>> + */
>> +static inline bool lsm_prop_is_set(struct lsm_prop *prop)
>> +{
>> + return false;
>> +}
> If we're going to call this lsmprop_is_set() (see 5/13), we really should
> name it that way to start in this patch.
Agreed. That's an unfortunate artifact of the lsmblob to lsm_prop name change.
> Considering everything else in this patchset looks okay, if you want me
> to fix this up during the merge let me know.
I can do a v5 if that makes life easier, but if you're OK with fixing it
during the merge I'm completely fine with that. Thank you.
> --
> paul-moore.com
