Maksytka/linux
1
1
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-11-30 23:16:01 +07:00
Code Issues Packages Projects Releases Wiki Activity

selinux: rename the cred_security_struct variables to "crsec"

Browse Source 
Along with the renaming from task_security_struct to cred_security_struct,
rename the local variables to "crsec" from "tsec".  This both fits with
existing conventions and helps distinguish between task and cred related
variables.

No functional changes.

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Paul Moore
2025-11-18 17:27:58 -05:00
parent dde3a5d0f4
commit 3ded250b97
2 changed files with 117 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

230
security/selinux/hooks.c
View File

@@ -210,12 +210,12 @@ static int selinux_lsm_notifier_avc_callback(u32 event)
*/
static void cred_init_security(void)
{
struct cred_security_struct *tsec;
struct cred_security_struct *crsec;
/* NOTE: the lsm framework zeros out the buffer on allocation */
tsec = selinux_cred(unrcu_pointer(current->real_cred));
tsec->osid = tsec->sid = SECINITSID_KERNEL;
crsec = selinux_cred(unrcu_pointer(current->real_cred));
crsec->osid = crsec->sid = SECINITSID_KERNEL;
}
/*
@@ -223,10 +223,10 @@ static void cred_init_security(void)
*/
static inline u32 cred_sid(const struct cred *cred)
{
const struct cred_security_struct *tsec;
const struct cred_security_struct *crsec;
tsec = selinux_cred(cred);
return tsec->sid;
crsec = selinux_cred(cred);
return crsec->sid;
}
static void __ad_net_init(struct common_audit_data *ad,
@@ -437,15 +437,15 @@ static int may_context_mount_sb_relabel(u32 sid,
struct superblock_security_struct *sbsec,
const struct cred *cred)
{
const struct cred_security_struct *tsec = selinux_cred(cred);
const struct cred_security_struct *crsec = selinux_cred(cred);
int rc;
rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
rc = avc_has_perm(crsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL);
if (rc)
return rc;
rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
rc = avc_has_perm(crsec->sid, sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELTO, NULL);
return rc;
}
@@ -454,9 +454,9 @@ static int may_context_mount_inode_relabel(u32 sid,
struct superblock_security_struct *sbsec,
const struct cred *cred)
{
const struct cred_security_struct *tsec = selinux_cred(cred);
const struct cred_security_struct *crsec = selinux_cred(cred);
int rc;
rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
rc = avc_has_perm(crsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL);
if (rc)
return rc;
@@ -1788,7 +1788,7 @@ out:
* Determine the label for an inode that might be unioned.
*/
static int
selinux_determine_inode_label(const struct cred_security_struct *tsec,
selinux_determine_inode_label(const struct cred_security_struct *crsec,
struct inode *dir,
const struct qstr *name, u16 tclass,
u32 *_new_isid)
@@ -1800,11 +1800,11 @@ selinux_determine_inode_label(const struct cred_security_struct *tsec,
(sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
*_new_isid = sbsec->mntpoint_sid;
} else if ((sbsec->flags & SBLABEL_MNT) &&
tsec->create_sid) {
*_new_isid = tsec->create_sid;
crsec->create_sid) {
*_new_isid = crsec->create_sid;
} else {
const struct inode_security_struct *dsec = inode_security(dir);
return security_transition_sid(tsec->sid,
return security_transition_sid(crsec->sid,
dsec->sid, tclass,
name, _new_isid);
}
@@ -1817,7 +1817,7 @@ static int may_create(struct inode *dir,
struct dentry *dentry,
u16 tclass)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
struct inode_security_struct *dsec;
struct superblock_security_struct *sbsec;
u32 sid, newsid;
@@ -1827,7 +1827,7 @@ static int may_create(struct inode *dir,
dsec = inode_security(dir);
sbsec = selinux_superblock(dir->i_sb);
sid = tsec->sid;
sid = crsec->sid;
ad.type = LSM_AUDIT_DATA_DENTRY;
ad.u.dentry = dentry;
@@ -1838,7 +1838,7 @@ static int may_create(struct inode *dir,
if (rc)
return rc;
rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
rc = selinux_determine_inode_label(crsec, dir, &dentry->d_name, tclass,
&newsid);
if (rc)
return rc;
@@ -2251,8 +2251,8 @@ static u32 ptrace_parent_sid(void)
}
static int check_nnp_nosuid(const struct linux_binprm *bprm,
const struct cred_security_struct *old_tsec,
const struct cred_security_struct *new_tsec)
const struct cred_security_struct *old_crsec,
const struct cred_security_struct *new_crsec)
{
int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
@@ -2262,7 +2262,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
if (!nnp && !nosuid)
return 0; /* neither NNP nor nosuid */
if (new_tsec->sid == old_tsec->sid)
if (new_crsec->sid == old_crsec->sid)
return 0; /* No change in credentials */
/*
@@ -2277,7 +2277,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
av |= PROCESS2__NNP_TRANSITION;
if (nosuid)
av |= PROCESS2__NOSUID_TRANSITION;
rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
rc = avc_has_perm(old_crsec->sid, new_crsec->sid,
SECCLASS_PROCESS2, av, NULL);
if (!rc)
return 0;
@@ -2288,8 +2288,8 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
* i.e. SIDs that are guaranteed to only be allowed a subset
* of the permissions of the current SID.
*/
rc = security_bounded_transition(old_tsec->sid,
new_tsec->sid);
rc = security_bounded_transition(old_crsec->sid,
new_crsec->sid);
if (!rc)
return 0;
@@ -2305,8 +2305,8 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
{
const struct cred_security_struct *old_tsec;
struct cred_security_struct *new_tsec;
const struct cred_security_struct *old_crsec;
struct cred_security_struct *new_crsec;
struct inode_security_struct *isec;
struct common_audit_data ad;
struct inode *inode = file_inode(bprm->file);
@@ -2315,18 +2315,18 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* SELinux context only depends on initial program or script and not
* the script interpreter */
old_tsec = selinux_cred(current_cred());
new_tsec = selinux_cred(bprm->cred);
old_crsec = selinux_cred(current_cred());
new_crsec = selinux_cred(bprm->cred);
isec = inode_security(inode);
/* Default to the current task SID. */
new_tsec->sid = old_tsec->sid;
new_tsec->osid = old_tsec->sid;
new_crsec->sid = old_crsec->sid;
new_crsec->osid = old_crsec->sid;
/* Reset fs, key, and sock SIDs on execve. */
new_tsec->create_sid = 0;
new_tsec->keycreate_sid = 0;
new_tsec->sockcreate_sid = 0;
new_crsec->create_sid = 0;
new_crsec->keycreate_sid = 0;
new_crsec->sockcreate_sid = 0;
/*
* Before policy is loaded, label any task outside kernel space
@@ -2335,26 +2335,26 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
* (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
*/
if (!selinux_initialized()) {
new_tsec->sid = SECINITSID_INIT;
new_crsec->sid = SECINITSID_INIT;
/* also clear the exec_sid just in case */
new_tsec->exec_sid = 0;
new_crsec->exec_sid = 0;
return 0;
}
if (old_tsec->exec_sid) {
new_tsec->sid = old_tsec->exec_sid;
if (old_crsec->exec_sid) {
new_crsec->sid = old_crsec->exec_sid;
/* Reset exec SID on execve. */
new_tsec->exec_sid = 0;
new_crsec->exec_sid = 0;
/* Fail on NNP or nosuid if not an allowed transition. */
rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
rc = check_nnp_nosuid(bprm, old_crsec, new_crsec);
if (rc)
return rc;
} else {
/* Check for a default transition on this program. */
rc = security_transition_sid(old_tsec->sid,
rc = security_transition_sid(old_crsec->sid,
isec->sid, SECCLASS_PROCESS, NULL,
&new_tsec->sid);
&new_crsec->sid);
if (rc)
return rc;
@@ -2362,34 +2362,34 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
* Fallback to old SID on NNP or nosuid if not an allowed
* transition.
*/
rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
rc = check_nnp_nosuid(bprm, old_crsec, new_crsec);
if (rc)
new_tsec->sid = old_tsec->sid;
new_crsec->sid = old_crsec->sid;
}
ad.type = LSM_AUDIT_DATA_FILE;
ad.u.file = bprm->file;
if (new_tsec->sid == old_tsec->sid) {
rc = avc_has_perm(old_tsec->sid, isec->sid,
if (new_crsec->sid == old_crsec->sid) {
rc = avc_has_perm(old_crsec->sid, isec->sid,
SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
if (rc)
return rc;
} else {
/* Check permissions for the transition. */
rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
rc = avc_has_perm(old_crsec->sid, new_crsec->sid,
SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
if (rc)
return rc;
rc = avc_has_perm(new_tsec->sid, isec->sid,
rc = avc_has_perm(new_crsec->sid, isec->sid,
SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
if (rc)
return rc;
/* Check for shared state */
if (bprm->unsafe & LSM_UNSAFE_SHARE) {
rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
rc = avc_has_perm(old_crsec->sid, new_crsec->sid,
SECCLASS_PROCESS, PROCESS__SHARE,
NULL);
if (rc)
@@ -2401,7 +2401,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
u32 ptsid = ptrace_parent_sid();
if (ptsid != 0) {
rc = avc_has_perm(ptsid, new_tsec->sid,
rc = avc_has_perm(ptsid, new_crsec->sid,
SECCLASS_PROCESS,
PROCESS__PTRACE, NULL);
if (rc)
@@ -2415,7 +2415,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Enable secure mode for SIDs transitions unless
the noatsecure permission is granted between
the two SIDs, i.e. ahp returns 0. */
rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
rc = avc_has_perm(old_crsec->sid, new_crsec->sid,
SECCLASS_PROCESS, PROCESS__NOATSECURE,
NULL);
bprm->secureexec |= !!rc;
@@ -2483,12 +2483,12 @@ static inline void flush_unauthorized_files(const struct cred *cred,
*/
static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
{
struct cred_security_struct *new_tsec;
struct cred_security_struct *new_crsec;
struct rlimit *rlim, *initrlim;
int rc, i;
new_tsec = selinux_cred(bprm->cred);
if (new_tsec->sid == new_tsec->osid)
new_crsec = selinux_cred(bprm->cred);
if (new_crsec->sid == new_crsec->osid)
return;
/* Close files for which the new task SID is not authorized. */
@@ -2507,7 +2507,7 @@ static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
* higher than the default soft limit for cases where the default is
* lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
*/
rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
rc = avc_has_perm(new_crsec->osid, new_crsec->sid, SECCLASS_PROCESS,
PROCESS__RLIMITINH, NULL);
if (rc) {
/* protect against do_prlimit() */
@@ -2529,12 +2529,12 @@ static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
*/
static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
u32 osid, sid;
int rc;
osid = tsec->osid;
sid = tsec->sid;
osid = crsec->osid;
sid = crsec->sid;
if (sid == osid)
return;
@@ -2911,7 +2911,7 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
{
u32 newsid;
int rc;
struct cred_security_struct *tsec;
struct cred_security_struct *crsec;
rc = selinux_determine_inode_label(selinux_cred(old),
d_inode(dentry->d_parent), name,
@@ -2920,8 +2920,8 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
if (rc)
return rc;
tsec = selinux_cred(new);
tsec->create_sid = newsid;
crsec = selinux_cred(new);
crsec->create_sid = newsid;
return 0;
}
@@ -2929,7 +2929,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr,
struct xattr *xattrs, int *xattr_count)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
struct superblock_security_struct *sbsec;
struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
u32 newsid, clen;
@@ -2939,9 +2939,9 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
sbsec = selinux_superblock(dir->i_sb);
newsid = tsec->create_sid;
newsid = crsec->create_sid;
newsclass = inode_mode_to_security_class(inode->i_mode);
rc = selinux_determine_inode_label(tsec, dir, qstr, newsclass, &newsid);
rc = selinux_determine_inode_label(crsec, dir, qstr, newsclass, &newsid);
if (rc)
return rc;
@@ -3660,7 +3660,7 @@ static void selinux_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop)
static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
{
struct lsm_prop prop;
struct cred_security_struct *tsec;
struct cred_security_struct *crsec;
struct cred *new_creds = *new;
if (new_creds == NULL) {
@@ -3669,10 +3669,10 @@ static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
return -ENOMEM;
}
tsec = selinux_cred(new_creds);
crsec = selinux_cred(new_creds);
/* Get label from overlay inode and set it in create_sid */
selinux_inode_getlsmprop(d_inode(src), &prop);
tsec->create_sid = prop.selinux.secid;
crsec->create_sid = prop.selinux.secid;
*new = new_creds;
return 0;
}
@@ -3698,7 +3698,7 @@ static int selinux_inode_copy_up_xattr(struct dentry *dentry, const char *name)
static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
struct kernfs_node *kn)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
u32 parent_sid, newsid, clen;
int rc;
char *context;
@@ -3726,8 +3726,8 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
if (rc)
return rc;
if (tsec->create_sid) {
newsid = tsec->create_sid;
if (crsec->create_sid) {
newsid = crsec->create_sid;
} else {
u16 secclass = inode_mode_to_security_class(kn->mode);
const char *kn_name;
@@ -3738,7 +3738,7 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
q.name = kn_name;
q.hash_len = hashlen_string(kn_dir, kn_name);
rc = security_transition_sid(tsec->sid,
rc = security_transition_sid(crsec->sid,
parent_sid, secclass, &q,
&newsid);
if (rc)
@@ -4165,10 +4165,10 @@ static int selinux_task_alloc(struct task_struct *task,
static int selinux_cred_prepare(struct cred *new, const struct cred *old,
gfp_t gfp)
{
const struct cred_security_struct *old_tsec = selinux_cred(old);
struct cred_security_struct *tsec = selinux_cred(new);
const struct cred_security_struct *old_crsec = selinux_cred(old);
struct cred_security_struct *crsec = selinux_cred(new);
*tsec = *old_tsec;
*crsec = *old_crsec;
return 0;
}
@@ -4177,10 +4177,10 @@ static int selinux_cred_prepare(struct cred *new, const struct cred *old,
*/
static void selinux_cred_transfer(struct cred *new, const struct cred *old)
{
const struct cred_security_struct *old_tsec = selinux_cred(old);
struct cred_security_struct *tsec = selinux_cred(new);
const struct cred_security_struct *old_crsec = selinux_cred(old);
struct cred_security_struct *crsec = selinux_cred(new);
*tsec = *old_tsec;
*crsec = *old_crsec;
}
static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
@@ -4199,7 +4199,7 @@ static void selinux_cred_getlsmprop(const struct cred *c, struct lsm_prop *prop)
*/
static int selinux_kernel_act_as(struct cred *new, u32 secid)
{
struct cred_security_struct *tsec = selinux_cred(new);
struct cred_security_struct *crsec = selinux_cred(new);
u32 sid = current_sid();
int ret;
@@ -4208,10 +4208,10 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid)
KERNEL_SERVICE__USE_AS_OVERRIDE,
NULL);
if (ret == 0) {
tsec->sid = secid;
tsec->create_sid = 0;
tsec->keycreate_sid = 0;
tsec->sockcreate_sid = 0;
crsec->sid = secid;
crsec->create_sid = 0;
crsec->keycreate_sid = 0;
crsec->sockcreate_sid = 0;
}
return ret;
}
@@ -4223,7 +4223,7 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid)
static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
{
struct inode_security_struct *isec = inode_security(inode);
struct cred_security_struct *tsec = selinux_cred(new);
struct cred_security_struct *crsec = selinux_cred(new);
u32 sid = current_sid();
int ret;
@@ -4233,7 +4233,7 @@ static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
NULL);
if (ret == 0)
tsec->create_sid = isec->sid;
crsec->create_sid = isec->sid;
return ret;
}
@@ -4748,15 +4748,15 @@ static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
/* socket security operations */
static int socket_sockcreate_sid(const struct cred_security_struct *tsec,
static int socket_sockcreate_sid(const struct cred_security_struct *crsec,
u16 secclass, u32 *socksid)
{
if (tsec->sockcreate_sid > SECSID_NULL) {
*socksid = tsec->sockcreate_sid;
if (crsec->sockcreate_sid > SECSID_NULL) {
*socksid = crsec->sockcreate_sid;
return 0;
}
return security_transition_sid(tsec->sid, tsec->sid,
return security_transition_sid(crsec->sid, crsec->sid,
secclass, NULL, socksid);
}
@@ -4801,7 +4801,7 @@ static int sock_has_perm(struct sock *sk, u32 perms)
static int selinux_socket_create(int family, int type,
int protocol, int kern)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
u32 newsid;
u16 secclass;
int rc;
@@ -4810,17 +4810,17 @@ static int selinux_socket_create(int family, int type,
return 0;
secclass = socket_type_to_security_class(family, type, protocol);
rc = socket_sockcreate_sid(tsec, secclass, &newsid);
rc = socket_sockcreate_sid(crsec, secclass, &newsid);
if (rc)
return rc;
return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
return avc_has_perm(crsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
}
static int selinux_socket_post_create(struct socket *sock, int family,
int type, int protocol, int kern)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
struct sk_security_struct *sksec;
u16 sclass = socket_type_to_security_class(family, type, protocol);
@@ -4828,7 +4828,7 @@ static int selinux_socket_post_create(struct socket *sock, int family,
int err = 0;
if (!kern) {
err = socket_sockcreate_sid(tsec, sclass, &sid);
err = socket_sockcreate_sid(crsec, sclass, &sid);
if (err)
return err;
}
@@ -6530,37 +6530,37 @@ static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
char **value)
{
const struct cred_security_struct *tsec;
const struct cred_security_struct *crsec;
int error;
u32 sid;
u32 len;
rcu_read_lock();
tsec = selinux_cred(__task_cred(p));
crsec = selinux_cred(__task_cred(p));
if (p != current) {
error = avc_has_perm(current_sid(), tsec->sid,
error = avc_has_perm(current_sid(), crsec->sid,
SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
if (error)
goto err_unlock;
}
switch (attr) {
case LSM_ATTR_CURRENT:
sid = tsec->sid;
sid = crsec->sid;
break;
case LSM_ATTR_PREV:
sid = tsec->osid;
sid = crsec->osid;
break;
case LSM_ATTR_EXEC:
sid = tsec->exec_sid;
sid = crsec->exec_sid;
break;
case LSM_ATTR_FSCREATE:
sid = tsec->create_sid;
sid = crsec->create_sid;
break;
case LSM_ATTR_KEYCREATE:
sid = tsec->keycreate_sid;
sid = crsec->keycreate_sid;
break;
case LSM_ATTR_SOCKCREATE:
sid = tsec->sockcreate_sid;
sid = crsec->sockcreate_sid;
break;
default:
error = -EOPNOTSUPP;
@@ -6585,7 +6585,7 @@ err_unlock:
static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
{
struct cred_security_struct *tsec;
struct cred_security_struct *crsec;
struct cred *new;
u32 mysid = current_sid(), sid = 0, ptsid;
int error;
@@ -6671,11 +6671,11 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
operation. See selinux_bprm_creds_for_exec for the execve
checks and may_create for the file creation checks. The
operation will then fail if the context is not permitted. */
tsec = selinux_cred(new);
crsec = selinux_cred(new);
if (attr == LSM_ATTR_EXEC) {
tsec->exec_sid = sid;
crsec->exec_sid = sid;
} else if (attr == LSM_ATTR_FSCREATE) {
tsec->create_sid = sid;
crsec->create_sid = sid;
} else if (attr == LSM_ATTR_KEYCREATE) {
if (sid) {
error = avc_has_perm(mysid, sid,
@@ -6683,22 +6683,22 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
if (error)
goto abort_change;
}
tsec->keycreate_sid = sid;
crsec->keycreate_sid = sid;
} else if (attr == LSM_ATTR_SOCKCREATE) {
tsec->sockcreate_sid = sid;
crsec->sockcreate_sid = sid;
} else if (attr == LSM_ATTR_CURRENT) {
error = -EINVAL;
if (sid == 0)
goto abort_change;
if (!current_is_single_threaded()) {
error = security_bounded_transition(tsec->sid, sid);
error = security_bounded_transition(crsec->sid, sid);
if (error)
goto abort_change;
}
/* Check permissions for the transition. */
error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
error = avc_has_perm(crsec->sid, sid, SECCLASS_PROCESS,
PROCESS__DYNTRANSITION, NULL);
if (error)
goto abort_change;
@@ -6713,7 +6713,7 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
goto abort_change;
}
tsec->sid = sid;
crsec->sid = sid;
} else {
error = -EINVAL;
goto abort_change;
@@ -6880,14 +6880,14 @@ static int selinux_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
static int selinux_key_alloc(struct key *k, const struct cred *cred,
unsigned long flags)
{
const struct cred_security_struct *tsec;
const struct cred_security_struct *crsec;
struct key_security_struct *ksec = selinux_key(k);
tsec = selinux_cred(cred);
if (tsec->keycreate_sid)
ksec->sid = tsec->keycreate_sid;
crsec = selinux_cred(cred);
if (crsec->keycreate_sid)
ksec->sid = crsec->keycreate_sid;
else
ksec->sid = tsec->sid;
ksec->sid = crsec->sid;
return 0;
}

4
security/selinux/include/objsec.h
View File

@@ -217,9 +217,9 @@ selinux_ipc(const struct kern_ipc_perm *ipc)
*/
static inline u32 current_sid(void)
{
const struct cred_security_struct *tsec = selinux_cred(current_cred());
const struct cred_security_struct *crsec = selinux_cred(current_cred());
return tsec->sid;
return crsec->sid;
}
static inline struct superblock_security_struct *