[PATCH v20 17/23] LSM: security_secid_to_secctx in netlink netfilter

[Casey Schaufler]

Change netlink netfilter interfaces to use lsmcontext
pointers, and remove scaffolding.

Reviewed-by: Kees Cook <keesc...@chromium.org>
Reviewed-by: John Johansen <john.johan...@canonical.com>
Acked-by: Stephen Smalley <s...@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <ca...@schaufler-ca.com>
cc: net...@vger.kernel.org
---
 net/netfilter/nfnetlink_queue.c | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index d3f8e808c5d3..c830401f7792 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -301,12 +301,10 @@ static int nfqnl_put_sk_uidgid(struct sk_buff *skb, 
struct sock *sk)
        return -1;
 }
 
-static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
+static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsmcontext *context)
 {
-       u32 seclen = 0;
 #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
        struct lsmblob blob;
-       struct lsmcontext context = { };
 
        if (!skb || !sk_fullsock(skb->sk))
                return 0;
@@ -318,14 +316,14 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char 
**secdata)
                 * blob. security_secid_to_secctx() will know which security
                 * module to use to create the secctx.  */
                lsmblob_init(&blob, skb->secmark);
-               security_secid_to_secctx(&blob, &context);
-               *secdata = context.context;
+               security_secid_to_secctx(&blob, context);
        }
 
        read_unlock_bh(&skb->sk->sk_callback_lock);
-       seclen = context.len;
+       return context->len;
+#else
+       return 0;
 #endif
-       return seclen;
 }
 
 static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
@@ -401,8 +399,7 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        enum ip_conntrack_info ctinfo;
        struct nfnl_ct_hook *nfnl_ct;
        bool csum_verify;
-       struct lsmcontext scaff; /* scaffolding */
-       char *secdata = NULL;
+       struct lsmcontext context = { };
        u32 seclen = 0;
 
        size = nlmsg_total_size(sizeof(struct nfgenmsg))
@@ -469,7 +466,7 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        }
 
        if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
-               seclen = nfqnl_get_sk_secctx(entskb, &secdata);
+               seclen = nfqnl_get_sk_secctx(entskb, &context);
                if (seclen)
                        size += nla_total_size(seclen);
        }
@@ -604,7 +601,7 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
            nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
                goto nla_put_failure;
 
-       if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
+       if (seclen && nla_put(skb, NFQA_SECCTX, context.len, context.context))
                goto nla_put_failure;
 
        if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
@@ -632,10 +629,8 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        }
 
        nlh->nlmsg_len = skb->len;
-       if (seclen) {
-               lsmcontext_init(&scaff, secdata, seclen, 0);
-               security_release_secctx(&scaff);
-       }
+       if (seclen)
+               security_release_secctx(&context);
        return skb;
 
 nla_put_failure:
@@ -643,10 +638,8 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        kfree_skb(skb);
        net_err_ratelimited("nf_queue: error creating packet message\n");
 nlmsg_failure:
-       if (seclen) {
-               lsmcontext_init(&scaff, secdata, seclen, 0);
-               security_release_secctx(&scaff);
-       }
+       if (seclen)
+               security_release_secctx(&context);
        return NULL;
 }
 
-- 
2.24.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit