On 3/25/2025 4:44 PM, Fan Wu wrote: > On Wed, Mar 19, 2025 at 7:50 PM Casey Schaufler <[email protected]> > wrote: >> Add a parameter lsmid to security_lsmblob_to_secctx() to identify which >> of the security modules that may be active should provide the security >> context. If the value of lsmid is LSM_ID_UNDEF the first LSM providing >> a hook is used. security_secid_to_secctx() is unchanged, and will >> always report the first LSM providing a hook. >> >> Signed-off-by: Casey Schaufler <[email protected]> > .. >> diff --git a/security/security.c b/security/security.c >> index 143561ebc3e8..55f9c7ad3f89 100644 >> --- a/security/security.c >> +++ b/security/security.c >> @@ -4312,6 +4312,7 @@ EXPORT_SYMBOL(security_ismaclabel); >> * security_secid_to_secctx() - Convert a secid to a secctx >> * @secid: secid >> * @cp: the LSM context >> + * @lsmid: which security module to report >> * >> * Convert secid to security context. If @cp is NULL the length of the >> * result will be returned, but no data will be returned. This >> @@ -4338,9 +4339,17 @@ EXPORT_SYMBOL(security_secid_to_secctx); >> * >> * Return: Return length of data on success, error on failure. >> */ >> -int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context >> *cp) >> +int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context >> *cp, >> + int lsmid) >> { >> - return call_int_hook(lsmprop_to_secctx, prop, cp); >> + struct lsm_static_call *scall; >> + >> + lsm_for_each_hook(scall, lsmprop_to_secctx) { >> + if (lsmid != 0 && lsmid != scall->hl->lsmid->id) > It took me some time to figure out why if LSM_ID_UNDEF is passed the > first LSM providing a hook is used, might be better to change it to: > > if (lsmid != LSM_ID_UNDEF && lsmid != scall->hl->lsmid->id)
Thank you. That change will be in v4. > > Otherwise, it works as described. I'm working on adding a new IPE > property based on SELinux file labels, and this just came up as I > needed it. Thank you. > > Tested-by: Fan Wu <[email protected]> > >> + continue; >> + return scall->hl->hook.lsmprop_to_secctx(prop, cp); >> + } >> + return LSM_RET_DEFAULT(lsmprop_to_secctx); >> } >> EXPORT_SYMBOL(security_lsmprop_to_secctx); >> >> -- >> 2.47.0 >> >>
