[PATCH v33 18/29] LSM: security_secid_to_secctx in netlink netfilter

[Casey Schaufler]

Change netlink netfilter interfaces to use lsmcontext
pointers, and remove scaffolding.

Reviewed-by: Kees Cook <keesc...@chromium.org>
Reviewed-by: John Johansen <john.johan...@canonical.com>
Acked-by: Paul Moore <p...@paul-moore.com>
Acked-by: Stephen Smalley <stephen.smalley.w...@gmail.com>
Acked-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Casey Schaufler <ca...@schaufler-ca.com>
Cc: net...@vger.kernel.org
Cc: netfilter-de...@vger.kernel.org
---
 net/netfilter/nfnetlink_queue.c | 37 +++++++++++++--------------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 625cd787ffc1..2aff40578045 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -301,15 +301,13 @@ static int nfqnl_put_sk_uidgid(struct sk_buff *skb, 
struct sock *sk)
        return -1;
 }
 
-static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
+static void nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsmcontext 
*context)
 {
-       u32 seclen = 0;
 #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
        struct lsmblob blob;
-       struct lsmcontext context = { };
 
        if (!skb || !sk_fullsock(skb->sk))
-               return 0;
+               return;
 
        read_lock_bh(&skb->sk->sk_callback_lock);
 
@@ -318,14 +316,12 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char 
**secdata)
                 * blob. security_secid_to_secctx() will know which security
                 * module to use to create the secctx.  */
                lsmblob_init(&blob, skb->secmark);
-               security_secid_to_secctx(&blob, &context);
-               *secdata = context.context;
+               security_secid_to_secctx(&blob, context);
        }
 
        read_unlock_bh(&skb->sk->sk_callback_lock);
-       seclen = context.len;
 #endif
-       return seclen;
+       return;
 }
 
 static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
@@ -397,12 +393,10 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        struct net_device *indev;
        struct net_device *outdev;
        struct nf_conn *ct = NULL;
+       struct lsmcontext context = { };
        enum ip_conntrack_info ctinfo = 0;
        const struct nfnl_ct_hook *nfnl_ct;
        bool csum_verify;
-       struct lsmcontext scaff; /* scaffolding */
-       char *secdata = NULL;
-       u32 seclen = 0;
 
        size = nlmsg_total_size(sizeof(struct nfgenmsg))
                + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
@@ -470,9 +464,9 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        }
 
        if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
-               seclen = nfqnl_get_sk_secctx(entskb, &secdata);
-               if (seclen)
-                       size += nla_total_size(seclen);
+               nfqnl_get_sk_secctx(entskb, &context);
+               if (context.len)
+                       size += nla_total_size(context.len);
        }
 
        skb = alloc_skb(size, GFP_ATOMIC);
@@ -603,7 +597,8 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
            nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
                goto nla_put_failure;
 
-       if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
+       if (context.len &&
+           nla_put(skb, NFQA_SECCTX, context.len, context.context))
                goto nla_put_failure;
 
        if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
@@ -631,10 +626,8 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        }
 
        nlh->nlmsg_len = skb->len;
-       if (seclen) {
-               lsmcontext_init(&scaff, secdata, seclen, 0);
-               security_release_secctx(&scaff);
-       }
+       if (context.len)
+               security_release_secctx(&context);
        return skb;
 
 nla_put_failure:
@@ -642,10 +635,8 @@ nfqnl_build_packet_message(struct net *net, struct 
nfqnl_instance *queue,
        kfree_skb(skb);
        net_err_ratelimited("nf_queue: error creating packet message\n");
 nlmsg_failure:
-       if (seclen) {
-               lsmcontext_init(&scaff, secdata, seclen, 0);
-               security_release_secctx(&scaff);
-       }
+       if (context.len)
+               security_release_secctx(&context);
        return NULL;
 }
 
-- 
2.31.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit