From nobody Tue Sep 29 01:18:19 2026 Received: from sonic306-27.consmr.mail.ne1.yahoo.com (sonic306-27.consmr.mail.ne1.yahoo.com [66.163.189.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF6A837F320 for ; Thu, 13 Aug 2026 20:49:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.89 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654154; cv=none; b=s3nmE1lZe9Vbb/7eM2ujliPdEfIl4+65fzSUvQnJ08/D4JdlAzkDL8NYhmxORr2e93Y3CRlP+a/7p4DVYPm3vnalsGa01hjB2vfgRYNcYwHuFcsPi4UsxRZBMOCt4MgFWc+t3QZhjO91G9+4xtLwQpCxMqhkUKXgxc6LeT4xuGk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654154; c=relaxed/simple; bh=EIsDw/T1e28+cOLE63avay4qSNMYbGAZOtb2QqfUXTY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fqq9Ym+SDhZqLp9GSncYkMiDVe/gg1VbwwCV3DIwS3EcH0DnJdCPlslaAydVBuS1XvpCV3C6m43no8Bc3QabyynQgHL5G8XHIETAGQQTRPabe7AHnOVlpBMquVna2QyOtXITBpCJjEupGi66yIeKcr80yQMHshbF6IDoj3R51pE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=ULCeWBNM; arc=none smtp.client-ip=66.163.189.89 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="ULCeWBNM" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654151; bh=w8HPVukpPSLrmoVZPf8UU2BOkgF3+8NnKj9RcySYLaQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=ULCeWBNMK2gW2nELpdIBcG3Gyy+1/hGyT2H2tabY5QzK1ss7i0E/JTL86UY16X1WqDUEqZ/rufqVArqp6AKIRNc81ur9nnahpz4I4jnzy6oS/FQpg/gQvY7zwAZ8oi7OPuUG5RMa1rw0RKl+1Fqxh/vwm7Rgsi9pCjaNTy87W0nVinm72hcgTmRbhLLWjJu94AEpiLktIaY1+8sLfp8J7iUcUd5roLOj3VKXRMxGYn8eRVxLi5XYP6dDByxVEF8uBdNO05FcjtRPc1FtTcLN+PmHObTMQ8q7r8g7W+qZnp6SZ0abFwQb4pF9F0NIIa5MQ878L/R1oOH/yPxJJOfEkw== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654151; bh=hW+nbGPFSyyfWCccLgi6XG7JZTa9p+76I6zOkrAN453=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=uGz07Df7tq/srOK36STwbhQ9yA7a+2FD81slAalWhoHhpMhB1F3GDDhKmc6UH6/mi0M6zi9HeBVpW0lYrgwrc+woj2Zrxt5KuWUu9ZoX2l0q9aK/yOVNQxy6TIb2OQdqLcmPg6q036bKGFKzhVUyWG2zXnmroVDPdIeY0/58XZVGgqxRvvwMS1lCtvV0o2Alm6jolSpbdpcgcu6kDVwcmQ1BG6UQCE1Zjwhv+3D9PFzUFFiOhkR5mjqOsgxudBIklr82arwBW+O2Njh/IomhMMlmMeJLWMszpK/LilSn8Sa2VS6v5/kZ6n8INRkrK0ah7EHbSkuOj68XSZBJaMaGvw== X-YMail-OSG: XxAlhG0VM1n0h_axCYQM29b0pppQr2ScqpOinRo5fSyY1QBG52QM65snF_.cJgz PRBvi8cHw0BW.tQhNEa6hGmFdKEuii55j2qCkNWz3_6yqBMc9SExQkYmiqKTpmDGAqCvrDHJ2TVn .QLzYrV.9u0YrMi4FzRCoe0ZZutkAAVEU9s1zfloOqqdZpbWJ9U3rFvxaLJOHO_1o6Opoas1XmKr rSc9J7flQWHzcrBoUzMEtS9cYusxWxpoGIqqVmrdWKEMSr1pw6Y3jc7lRp8XR9DWcee89WfRTKHV PVrlJ_KVFw5CittDaGTsN7d3RRsbKfxKdcRiIsFpAy_k6ZJa8m94xyq85uHYp03KuCe2yS2UXPsY JrNlUcUranKfgXS5uFU8_hdjUjmDHXwzOiR0NBPdVFHS05i4vBKO1wAMfNMRSBFiSRaX0WWErh6v 7zoSgwnS_Cm.6RLz0TeAK4GOMUjtPwn559A27JTs6IU19D7_1jvfuSQeeZGMsoSyrPoiuzsQXc_V JG1Qmv.A2.Fs8KgQm3_xV2mhYuI0YqI2WAuiIKcYujbwmPGS2Cim2Epscpeoo9Cht.xnf9AIAg7Y XZqiSYXPnJRqSFcxhMzIQhBe7ozPdiV3AWlLHe.XtN7ZIknbKAoVEd0BGZcB85Sl9.ZwKop_ZkCm wM9aOMZdeXJd6eQXHEASCpUiuTMoxVNMcj5oqCyQ84eIYTZkvcmtYpEnUP1Wn71OqFnvdFRlz6A. QEkqJ5vrMvVQIbqWBvaYEnrEKzkelZy69Ao7s3DYXH.lTXswXF8cyT4fo9.Ddpb4MPhjyHkH8v2D C3lvDakxb3K7ZcYVX.OrI6qLjA95RDIjTozha3HTXEE2cGfXwSryOy.8u3m2B5kC3SWmbLP3SfoH xNSsDO_Leo9wwMORdSzf_R3d1HAh9iV5vUilVXNV86s3GGrqnsrTNLPwGqzxS.qwflIoNeWIBvzN EzKk3cT0jzJSMRDVL4YTrHNQmIcUm0kPf4x6oSlN0DGVhO5uRETnZiJYOYI3f9YEVJNLoMNpN3V9 tdUBRsjCG4s8aVawTJG72C1n45Xna8S9nCY788XobgbOI2BOPIrLbdjg.QnGODjuhAXBGWSJUCP2 Fcdh_N_DSdcTr4z0FbZ7Nm3.gUt3XhfmV6ud88b8iL7sxJKX8bII5SLPcRf03CXs0qLxilsLDCQ8 I2uTAQsCoC1DcRlNWQuWHjckLXU1PbBdMK43kW.1n.AZR7BcOGbngZqDcXBUW7.C6vJstcTNptkJ Ka_9Ea0_mg1wRP6MUMNMIdDw87couc.voEz87nMCFxkDFU1JR_b8JNbKnZf.ifLBQMFNEKsHV9bR iN6iGjg6NBhvfF5wfKIdOP_jmCpbK_DNYW8MvwL46evL2zLD.uQPLfkBkbfQYglHbMmGW36hNKs. UgNunm5o_ywNlOjnUAybfLg0udjGo8ygxcNqwQCq7zW8kJAi7WbO4.1CmgZ72Z52_XD8GSV1xyXz 3Sohz6p3uVWcyiBqQUXshrqWPhtDv79XpcHio5QLWdKnXCGWPRI7W0V73c9KyRIx3NrwIueYRWbQ _HZ18FXAncL0sA_I_mjJW.5LOONqNYQ9rXGYg_p_jrB4mGvdSg_oR5Qx.mWXiR8ch8MXi4eaMM68 e9XjBNEqbE4uvJRCcQdf7TDYp_UKMOXFnxpwCpLk1lfE.epm5bOWXL2lTiCzn3NsP.BOJ1h7xt7_ LmaaYhJCrChTehfjDZVQ1XLej.HrwSd8_WMAD87x3SaK2s6qVNeYe73Xwp4bfuewtE_FaJahip8z 1vvFCcvph2wRykMzTaBjlC7JcqqGBo2jHcutG4zvNUkTiKg5JCuQuHXLU3Fvx.uH.i3.UhymxkuP AzfGAQpyXsVEdrtVRotvLH8ATEpDctgPUv.HKtsOHmvASvYgxvNfthCd2yAkK4pZsWrs4nZC2KFy EyAGgzvT7fpwFUInhkcs0xKij9x4tiM7SCxmB0_2wXg._fcug1bX0gY.KavEvZxQ2CfpMFS4REjQ C4mxq5gJZ4d1VAQB7ZuTq4SY_CXVdA4VUTd2zwSSFTruTJfHrfAWgZNLjLRpb5nF9cJZTdRnlODg MhHVuM._d3LUpi89Tw8ZLz9ptlmytvCZ2xKFlcD..Tb0vlJ0RqB1BAZHylPzGOZhTGL6UIh2QpN3 HK9oPzbmhCuUKMcthFVIYFQGiBgMpK670UcTUc.EhYZXgfFSont4Yb1.vgXKWYr48HkRN7UR43In QeBBICgxOM4K9pSvRVPRF8n03gYQvfxwpxxDPeHVHViJiCaTxDmziuQGj1rYP3JAIv64i6iAQeFQ 2fds5sJTnG4Pgin0t7BsbHrKEMLiV X-Sonic-MF: X-Sonic-ID: c6b368e2-214f-46e0-83cf-9261145f17e6 Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:49:11 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:09 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 1/7] net, smack: Create a function to set secmarks Date: Thu, 13 Aug 2026 13:48:48 -0700 Message-ID: <20260813204854.19211-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Rather than open coding assignments to skb->secmark, use a helper function secxa_set_secmark(). This allows for a case where assigning a secmark is more complex than a simple assignment. The version of the function here does the legacy simple assignment. Change the functions that currently assign values to skb->secmark to use this function. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 22 ++++++++++++++++++++++ net/netfilter/nft_meta.c | 5 +++-- net/netfilter/xt_CONNSECMARK.c | 3 ++- net/netfilter/xt_SECMARK.c | 3 ++- security/smack/smack_netfilter.c | 3 ++- 5 files changed, 31 insertions(+), 5 deletions(-) create mode 100644 include/linux/lsm_secxa.h diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h new file mode 100644 index 000000000000..f4c732d26680 --- /dev/null +++ b/include/linux/lsm_secxa.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * Copyright (C) 2026 Casey Schaufler + */ + +#ifndef __LINUX_LSM_SECXA_H +#define __LINUX_LSM_SECXA_H + +#ifdef CONFIG_SECURITY + +#include +#include + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + skb->secmark =3D secxa; +} + +#endif /* CONFIG_SECURITY */ + +#endif /* __LINUX_LSM_SECXA_H */ diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 0a43e0787a68..bd0f7a0931f4 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -502,7 +503,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, break; #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: - skb->secmark =3D value; + secxa_set_secmark(skb, value); break; #endif default: @@ -950,7 +951,7 @@ static void nft_secmark_obj_eval(struct nft_object *obj= , struct nft_regs *regs, const struct nft_secmark *priv =3D nft_obj_data(obj); struct sk_buff *skb =3D pkt->skb; =20 - skb->secmark =3D priv->secid; + secxa_set_secmark(skb, priv->secid); } =20 static int nft_secmark_obj_init(const struct nft_ctx *ctx, diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e1..9d799d2459dc 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -14,6 +14,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -55,7 +56,7 @@ static void secmark_restore(struct sk_buff *skb) =20 ct =3D nf_ct_get(skb, &ctinfo); if (ct && ct->secmark) - skb->secmark =3D ct->secmark; + secxa_set_secmark(skb, ct->secmark); } } =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9..ea67aa92ddc2 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -36,7 +37,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_t= arget_info_v1 *info) BUG(); } =20 - skb->secmark =3D secmark; + secxa_set_secmark(skb, secmark); return XT_CONTINUE; } =20 diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index 17ba578b1308..b363c42f252e 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -29,7 +30,7 @@ static unsigned int smack_ip_output(void *priv, if (sk) { ssp =3D smack_sock(sk); skp =3D ssp->smk_out; - skb->secmark =3D skp->smk_secid; + secxa_set_secmark(skb, skp->smk_secid); } =20 return NF_ACCEPT; --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic306-27.consmr.mail.ne1.yahoo.com (sonic306-27.consmr.mail.ne1.yahoo.com [66.163.189.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D7B142AFBC for ; Thu, 13 Aug 2026 20:49:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.89 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654160; cv=none; b=IRhWkPRvGjHr3DN1Eeq5vDY41rG65YwOZdEr48suj/5KNyarQiXrRAKUsQQfM3tVtuPu4JxaSQyNR6302tNqZZ1KcuJ33C8sXgfj0p8wXN/8W8gVVxYd8jVbgPNF8LT7ChlMnTgAZIQQDQwhqZ9Ei+LiWOEA1GfSeOVGUWcxQVo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654160; c=relaxed/simple; bh=Q8hEe4FiSMW9doEYD8CNbwdNQfjUKt9PxQ+C5vtNY48=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=G9ke4m5DkLzU0X6qAsX5eEhNcsyLt9SJK7kT8JE2cAruh1H9S/JSscZrI4V/F+ppt4z6IgivOodTGQZR+dMYGvu3BQtdnWcCN0eufGvJWKbJHOLV2yzwcUJAHX4SGt1daNGv3SJ1fB+lxJeZb+muGFOUBlDc7kZFjZ18mepK+G0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=Kkohvl02; arc=none smtp.client-ip=66.163.189.89 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="Kkohvl02" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654156; bh=c9a770N4aWkurPkhcE57WAQe+ui08GmePE/hiOSNuLc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=Kkohvl02WxctfJW4GBWRE7ufsW3DIQRzX9716BTxL3z3CRbaEZzgAZTv2JZRajLVHsPev5pW0PtAXQGNRs5mct4u/nB7u/n3imuR1WmI3O+zV/WhXgyah2P5coZUDAWEPEAN+9+kaXCZtrNXKukrXDjSmnLAzS8aISsZI1myCZtQqYxz+TOwCcCuTM2MDcbV9g+GU1TKL+Hh5dG4D0o/Yu6+jbYuj4DyUdgXo6S8yrPfa3wNx6TGgaM3lB1gRVYC2Rw8HkEXLI2fGsniqvVhj/2w4NO1jBhhCZ1aPYixut90zHUr2VwsNxpAr6LvDhg3ktwPYwr7V7+eYMsmNLfTRQ== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654156; bh=3aL5er3R/rhZ8gN8/01dUxnbbEAtc5cYqR+++wsR9a2=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=pDbZzcxYT3uqSTots7o3Sy08CQm2W5oHrzVOiM0RVDUWgAFiyLxzeVyO4yeF5NbfhSsp/FTqGyqSuGrF79SUHlEaUevksPPdmdyspkfDGrJUpgdFstdSOgSmPhFGX7Y9hkz1nXHjbW3ddv19MPCMG0fBfqivzQLWGq4LXIHYPLFLZTfRLsfaZAJzwIp97s0Ki9GNXJnsUL8azc19R13+lLWltna/WYVwgnxOptOCVrLI1lu4CUrlDO+eRC/c03zJCiJznPsbdQnkvvwtY2xpFBhf0NU6R/FCeurJTMammBFZATL0cMctyHYjEo1cU4Tzq/Mq3YqnMdVP+rC2jIK+mg== X-YMail-OSG: iyvScPAVM1kAfnf_1rwQsZBKM383riop4vM17pJ3tT0Z8PGNJIfIMx3AElPMBCR Lg1O5vVthRI9LB.wbf8R8zuW47nFg6uLeankoi8rlW3JG8Qk39VQs.HZiikJdNMNjZLFLm6teF3j XMNZj.Ymvh9cnMczWlys7v834.7kYcTexH4BJtM0_laUrcncsZBsnbxSDNqWHJzrhZrdrizzD7S_ 2r5J0KHe95nH6DNk7uK3_s4Po.X1epMwOcII8IFP1i8zY20b_C99ci9vbTQrqE86cXOxwDMRV6Dq 8.1RWDpdx6A1F1e9zMwh9sPZ2Lv_3Z1X8eLIRfgB4hIs9EkI3.e4aIhAuMSd6ub1kLckTuB8VpzD nqBBteceYLg0YFI2xRKemiiQKnv4qXi5QCQsSjFyNPZd4WBpL2pYAVInoQUul6Mn3TYJUL2hvugZ otHnpnFbC1QOW6UQQKC5zGaVKwXUBW982nWvmviYssyySoA_9E6_Lqy22B4PhM_.lmw5pnmlEipi QMzajKvkymYGMSjRSH.yzms2abgSokqtOuhAoPhLXgfnwsnFE3P3Q0LE1KDoA6sO2fU9YeiL1Y4h 3uN5lDUFuYhdTQN0fWk_7FASc9Riil9zuwjmS8qgN71HzfoRH7XT2DzHc50CI_OqW4eTCXQfvfWx OZ2qlv9psh4r5cxot.aBbL4HTKLEB0BL6LiDMjiPha7UH0spH4YuXuLEUVtmajs5h7BCWDdqU5E8 hM_d7fRWiH853WIaRMpU4vh0Llj1C7AgXk038qiARBfWWepTJRryIAvmSSjuxM4ZwCx4gao3VKPM T4eqpHyKtTEQ6lU75IIcwo_soDzoN62TytSR6yRHK8Y2L08P354IZFgUX.6y4JpIJoCsXYcPsFjN bEyUc_Wx3p1zeNPHWkM1O3IYtd1guDg7oCFS.nEQ0.KIM.4PMTRQ8KmTnAZfF73uhDbYdrOCjoUj m5M0VjzcbccYHkOXC32rIQUpmi2Zd6h5fgvFHvZs62zXirq1ylljWSgeMNiGcLBRl.dZ_jrXe_7j u.WtPZoyl.hT.1Tvmar5Br1mHSzhT6vNXcGAado9gczwjcj93KcxXVyRMhfhXQN49betLwnRSZgf 3MLs9OxrbdoTepHYhA.2WKQta5N3ljXdMinc7MZ1r7vGrAZnNXmLdSuVy.K3LeNatZe.YUv7XcqS H8dY.OgHv0yU.kcjSZwvnQ3uugPhK.dWC60JtaIGF.1y1aoiTu3g8ivU7kegnyEvBXF17V_Vvx4O HRbbD5FWZUrHFFObL1fyfkPbTjNN2mst8D7VSiEPi0H6mAZpDI5qnUvqiAm.4LtMcMOq4fpC_zfc iub71cD5FTYWEYPrUJBNUa6JsdwLHVA3hFE0qjELQSPwwsf6oS3W0b0M1ZmVTOXB0cIhHgqHtQzn Ieey9Yf0F3DtCas5oVTAbOmeTRtEtJ.3cOh4yP8nyy9WwXW.4g54t162.NTMOa1TRZzSnwcha9b0 3pce8QTZ_QWM0acJcOer8Jsev6u7OJ2j8CF.aiFr5k2KE.s1KLFUo4fmz7G2Lqs_RT_0bRSBU8WY e1ylGTeC3Ryyb1lkMSHzPxPrwgVaRG_A7OA1Hpf3XBaqiCGW8HayHceNNTceiJUVw_2xWX6Aq41P zMvtyV0Vd.SpRqgwGYCMIRvO7ioFw6RNiqYxkelGo3TqjyZA2p3hr21G.CczmkQ_80MAoz9nYTiL daot1FrUyzuG0jwTFQqMnx6i01G4RXJubiNuit.J6qRcTfA32aBJFo8_JSUa5ZBaAwg7y9mbvZUE B0y9Pn8g2mCFIPQivJfOF_Xa3LtGs9UGMZHuKHxhXquaW3bRYpK5z2T92vx8oxNTLA4Fx8bi7Yyz k1B3svmaJE0l6zeC5D22quO9YCpmTTucRszYzxDwCgfxz485wexdhCtvAQgXWxgTuqIy7NZgNeIa pFb8wgswLDyzv8jNiXoMVFJQ.0NS76eLE5kZZYdabA_KZTxomwN2VZGXVq6PJZwh3dJ3kK4oYbkk WGr81UfUN6T1hpmE0gt3dNGkRMiZSn.fVuaKdTDSK7RqCxtxpodPYlj1FCH5iKK7glPDUj77Zj8k uiHR.NxRqxrptH9JP4l1qFj8f8Yv63gtEjH_6atGD9.f3gVTE6.zxOilwfWZnenpasFusZ1ClYfj XiZDvUbqARUBBhogxjDUul9AEstPWhsOf5_nHjRMyHuhSQckn_p9BiVS2fgOqoiG4rR.TkW0QoT3 96lCwNR6AX5W9PkmiQJ.8i2m0dP8JLS3bYmh31HpkvGgCo1TTJwV7htMiFec593wXSLSXL8jor9B dl9_uV_AUyOdJVn0WKvgY1yPC.6bH X-Sonic-MF: X-Sonic-ID: 959a22f4-34b1-4722-bb2a-6303523f9cc4 Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:49:16 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:10 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 2/7] LSM: Implement x array functions for secmarks Date: Thu, 13 Aug 2026 13:48:49 -0700 Message-ID: <20260813204854.19211-3-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement, but don't use (yet) the functions required to use xarray indexes in secmarks. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 10 ++-- security/Makefile | 1 + security/lsm_secxa.c | 107 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 113 insertions(+), 5 deletions(-) create mode 100644 security/lsm_secxa.c diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h index f4c732d26680..ffdc354b93fc 100644 --- a/include/linux/lsm_secxa.h +++ b/include/linux/lsm_secxa.h @@ -10,12 +10,12 @@ #ifdef CONFIG_SECURITY =20 #include -#include =20 -static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) -{ - skb->secmark =3D secxa; -} +struct sk_buff; + +int secxa_from_lsmprop(struct lsm_prop *prop); +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa); +void secxa_set_secmark(struct sk_buff *skb, u32 secxa); =20 #endif /* CONFIG_SECURITY */ =20 diff --git a/security/Makefile b/security/Makefile index 4601230ba442..e93be00bb6ae 100644 --- a/security/Makefile +++ b/security/Makefile @@ -8,6 +8,7 @@ obj-$(CONFIG_KEYS) +=3D keys/ # always enable default capabilities obj-y +=3D commoncap.o obj-$(CONFIG_SECURITY) +=3D lsm_syscalls.o +obj-$(CONFIG_NETWORK_SECMARK) +=3D lsm_secxa.o obj-$(CONFIG_MMU) +=3D min_addr.o =20 # Object file lists diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c new file mode 100644 index 000000000000..5b67d8218fd2 --- /dev/null +++ b/security/lsm_secxa.c @@ -0,0 +1,107 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +/* + * Implement functions supporting an x array for LSM properties. + * + * Copyright (C) 2026 Casey Schaufler + */ +#define pr_fmt(fmt) "secxa: "fmt + +#include +#include +#include +#include +#include + +/* + * An Xarray of lsm_prop structures. + */ +struct xarray secxa_xa; + +/** + * secxa_init - initialize the xarry of lsm_prop structures. + */ +static int __init secxa_init(void) +{ + xa_init_flags(&secxa_xa, XA_FLAGS_ALLOC1); + + return 0; +} +core_initcall(secxa_init); + +/** + * secxa_get_lsmprop - get the lsm_prop associated with a secxa + * @pro: destination for the lsm_prop pointer + * @secxa: index to look up + * + * Find the lsm_prop associated with @secxa and place a pointer + * to it in @pro. + * + * Returns 0, or -EINVAL if the mapping can't be found. + */ +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa) +{ + struct lsm_prop *lp; + + if (!secxa) + return -EINVAL; + + lp =3D xa_load(&secxa_xa, secxa); + if (!lp) + return -EINVAL; + + *pro =3D lp; + return 0; +} +EXPORT_SYMBOL(secxa_get_lsmprop); + +/** + * secxa_from_lsmprop - get the secxa associated with a lsm_prop + * @prop: lsm_prop pointer + * + * Find the secxa associated with @prop. If there is none, create it. + * + * Returns 0, or an error if the mapping cannot be created + */ +int secxa_from_lsmprop(struct lsm_prop *prop) +{ + struct lsm_prop *lp; + unsigned long il; + unsigned int index =3D 0; + int rc; + + xa_for_each(&secxa_xa, il, lp) { + if (!memcmp(prop, lp, sizeof(*prop))) + pr_info("%s found at index %lu\n", __func__, il); + if (!memcmp(prop, lp, sizeof(*prop))) + return il; + } + + lp =3D kzalloc(sizeof(*lp), GFP_ATOMIC); + if (!lp) + return -ENOMEM; + + rc =3D xa_alloc(&secxa_xa, &index, lp, xa_limit_32b, GFP_ATOMIC); + if (rc) { + kfree(lp); + return -EINVAL; + } + *lp =3D *prop; + + return index; +} +EXPORT_SYMBOL(secxa_from_lsmprop); + +/** + * secxa_set_secmark - add LSM information to a secmark + * @skb: buffer with the secmark + * @secxa: index of the information to add + * + * If the secmark in @skb is not set, set it to @secxa. + */ +void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + if (!skb->secmark) + skb->secmark =3D secxa; +} +EXPORT_SYMBOL(secxa_set_secmark); --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 58836433BB1 for ; Thu, 13 Aug 2026 20:59:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654773; cv=none; b=tn6RcsDFSgfZGhyCGPIX/JVksoCvSM03p+G5xosKgfFkLKfSE5ffDGD+Y/v16RGXT/mgzl1ACKMZRP6bdqOrqcGFfRrWW5OFaxlgkSLs23oE2K12pu/EZi1u5FmXFoDy+M/LqmTeJ62eXAHHkAVJTHk6cXxM9+tEAyOqpBhlDFk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654773; c=relaxed/simple; bh=ucSHUE7F2He/v65mfJnm8qKl06ZZN6jMNIuyCzgKkmM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BCgOz7klxtq6QdESj8Da5URsVfM2QS3HAaVnKgFLxiRzyMnA4tfHjPVKJJx92KrXHjWajxv2dsT43FzEGNoK9RrLZc1upsz85sX6LQRvhUaVdQFOdxsMA2VhXuwQ77cJiqLXO/oaRgHw8rKe4ivwKyReeujFOKrYEt1sRR/YQ/E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=opTrZKxc; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="opTrZKxc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654770; bh=sDHCxHvBj3bCkYweuZ9BxvPJbXdZ56Ci0vAjxYPJVdU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=opTrZKxcE3BOimD4yGtdxPbW6PD4ty/juXCvmSSrvV3U7GEGo5MoDNF6O6N+TbCgvERbUm0Z5I60agCSuxXMkAQHhU1lBpDtsMUM3/izSrgtKxVVyTz0+dtk2lrGA2kNRLbo6eH9mUu2KnxoXCIu0fEeTIxBF0h9zQeJ6GcILtxBOyx4ReFCSAZ28B+T/ZFKzH0n0eMzW8A21zKj9d8cTq3zSSlxvVFN98rC1zR2wifMyynYSuN6jz1A/licBCRyw2oav2WO7onyDhVpQ6FiUFMXDG5iYIzUfyvbA11OhqlEQR2jngajonPRGVwRPSC2hE4Z/tYQnxDl4cv/hAU+cQ== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654770; bh=uNxYFul74oNw1lWN7yCHFdvDoeMJDXVfTN7xgDS95j/=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=BZIGlwbpe/Ecfkga1SV2JwSV+3bAmjTo4fnTqgBOYV2cdfdoVPXeX8gaZjGDlaUOrVfLd9XhyLUpQrr1KvnBUDUB/QFMMGJxCO0KLlRQLhnUBcWoFpvepdTaoljU+MpUjqaEmgvnoG8lfTNYAE7zDHsJM0AA2pS4a7lhcbO0p44ehoe6o0tDkIZ0CDe5zcwJje12y/uwUksGBmEasWoruCYMEjgzCu/1pJ47wdIS1ooKh73jj4O5Tdk314uOk7gfhX7G+PYt+QrohBrwu+IbDDMTwYOMm5kS3WRhaxi6avLCQ1cZnStiIc6XVA5503hxNuhazjXdSiu4tMFChuqFkw== X-YMail-OSG: aJLRldoVM1kVIP5pT1W70jK1xP_Mg3FHL8EYG35rT10I6P7CiytQSdnBZJsRjEx YDPCiJLuDxPmmay_zgjaoj6CcDPN5neK4PcSVeSx53omHah21lGwBgFcVA2zmR_F6b6KsJMcfxoh pIOiACBCy0VqN7SQQWEDmMbN6yMbshtCDG_d50Ic0E4twllkv5NnuBvOTvde545K6H_T9DeGR8Wh HTiSPREM4HUOUitn_lyzxSoG6ZqwiGiDj4Fzfdl_E18Oz8w1eHCQKyrpUJPBPKnrgIhga74auMkc NObpsNo5s8ZjW7XErsvUPTrjZXTiGmIQQt9Q9SdleCWfvqqihpQkavn5A1G8oeUCg6ZPi3eN5tg2 X3m3_Uo0RUiIkup9scPzUYl2.bqhCOy8oA3R6z6tIM5mxEl_pNgZo7JrapTYuf.TVpOCKqcfXhO7 PXgjjxbbIeMcEOupzXPJ5CFtaR4lJ3b8PgS.eMKHUqFe05IDkirbAHoUcXL1N9J3.2kgbrCvPc1S .zCaETh6rmRZyniMe3kckYhMQSGUKse2cfjuhV4PLSpr7XFlnozYRgfQxvDVKuCrDZGbGP.CCaEg C9kgC01rNg7UU5YHaswrKONDnP1T76Ywv8LCc_AerkO9FLVKlT31y_4XtsbT78xc7bQnFOm480SM NZQ21hAl9xlYmMpYyNs_y8NRApOx.Df26tMEhal9x0CdXNI1rOAmhbWY4eJ3aiQmQJs2ebr4Bb9M VRNo16uwVpbpOHrK_TPw_v11rFun7tPjgaeJHntxFU.lgF81GHnBnthVQP.k.2fBjJHcUS_RuyBt aWTxT19bPoGCrMGfmsC6juHWqln0TvvKLjSsYupNmy45KMzAU93HkIi9Dp5bf6Cm8cFymiEGVFIN v0FcNGVNqDbRGar3z1S2WAFs1VD5f6Gl0t2byVPzPriRtaT.MPNvubd9D0S3BEKozgKCN7N4aLdn 7HDTN5bBs_ogfAHr3_wHwyra6xLSGgDz_gBkmtBSvQPA9xzF6fnshgdZgSIu.9yqBqH6tYWcpwsI G0MHAo2f3qf3oZDzWww.iFBDFQgXfrhqwdefrBgrQKdUBbpv4qjSOLmHf_h3NOSBertujA2OkK5h KCbiyrqMjzFYzoOVd3LN5gVncxrGSmNo_ds_Q1NqY9f1xUGuYwDTqGjD.nm4b2tZ84tbw0ZKL4GI cEyyg6biWTdhJuOqBUFOckUONhpqrAzyWKVHkZrUEtrR.jzGAz9LUY0BZueT3d..Wk5we_AJE_OJ WT.ATVNQMVpvLl4vnv4bB1Al3WL5FxGm16vgaCQA.CraSP_oNf4ta8EvGo9BfYNWz6ehERkWnFsv GnKZBbalcYBKZ.b0TjeJZqZ4r2OT4fB_AXtypdQmPw7jHdp2Hq54Lq1MLxh75W1lNtb6yns7JNXG oMrMn7.H.UN0iVqVMRgdROlQ4pyQT.UbJOu9RQE2K8FN5uNHW4zq8xeywCEuwPmHkU9ibLqcPktC MdOlpSEXhJzCxLNJquJtH5Oo6vseTdahTh0AVY7OTWxzrj30YqBMflCheeuyImQYZ9SO2qAJjIwA G7.feRZffedw7O0ymyhA0FLFEtT5Fw9V.G1dErS_HgjiddRfyWY9O3FYSZsWiCFNdqodVGPoqO9m 1NaE1NX6xnIdvNtal8_ZA.XoIp.c2MYPtTFrY5GUJIl6BD7BLWP.cpKYjR2.6ke4TUzWGfw5EsVW VvBtKmHABNlLaDDidLs7qSzuVF.tvGpXk3n66_l3mjfbjSyEgApIir2va2z4LMS1b3DUpoQ0RyLI FkAdD6MMntKOMQiJD8GBPEA8tamFjf.JYsXki1h.LScQmOKxBX6PvZzGHb3kVlloEHMmkcxCZrU4 P7Iky90f_oxpYgKHAKOog_mKf3E5h0lYR936t9IuPmmaN.INmjVx8Zc0xVR7Mo00keYwF8lnSgIx PgbdCK2spL5NfCZOYFP3O6NMtT0.P2dq8spOhTtjxcMfY2nveyFjLCtC3WexwJm8iPvoNC7gsur7 xZOfYXP_JMGDyt4d36rEIAYEQpyHgxka8XqiqFHWeyUSETs09dBrjSHjU1KaWsz74NnhnPyOAlMG XuUh8eoDQpHVy8gFjukLwZ4imD5SISb3QnQ7AWlDP9LBoUGZ5VwF4DTXzwnxoC.A.PV9aJ4qlJYO cGvGp9QhoNkaosALlUD4DGbymgjBCruaz3Q7Hy2Y19gzDq_6TZV.g9Nl6FbRXfs1o5Ir7ZguMPGe VrM1Y54M03MNID2o2z5qJnAC40p_x_Lp7FopfkBXR_9Z4bbxsUU7KtINxc5u_Cte0mQjSsNvCitk V5jNKfw5WWyAQwkCWSflARK4dLA-- X-Sonic-MF: X-Sonic-ID: 079dcd19-d024-439c-b9ca-4b87691621de Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:59:30 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:12 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 3/7] LSM: Two hooks for manipulating struct lsm_prop Date: Thu, 13 Aug 2026 13:48:50 -0700 Message-ID: <20260813204854.19211-4-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" security_update_lsmprop() updates the property of the specified LSM in the @dest structure with that in the @src. security_secctx_to_lsmprop() sets the @prop field associated with the LSM specified to the value of the passed security context. LSM specific implementations of these hooks to follow. Signed-off-by: Casey Schaufler --- include/linux/lsm_hook_defs.h | 4 ++++ include/linux/security.h | 17 +++++++++++++++++ security/security.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec207..3666d821b8a1 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -305,7 +305,11 @@ LSM_HOOK(int, 0, ismaclabel, const char *name) LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, struct lsm_context = *cp) LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop, struct lsm_context *cp) +LSM_HOOK(int, -EOPNOTSUPP, update_lsmprop, struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *se= cid) +LSM_HOOK(int, 0, secctx_to_lsmprop, const char *secdata, u32 seclen, + struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp) LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 c= txlen) diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f..b209d681e79a 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -576,6 +576,11 @@ int security_secid_to_secctx(u32 secid, struct lsm_con= text *cp); int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp, int lsmid); int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid); + +int security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void security_release_secctx(struct lsm_context *cp); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen= ); @@ -1581,6 +1586,12 @@ static inline int security_lsmprop_to_secctx(struct = lsm_prop *prop, return -EOPNOTSUPP; } =20 +static inline int security_update_lsmprop(struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) +{ + return -EOPNOTSUPP; +} + static inline int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) @@ -1588,6 +1599,12 @@ static inline int security_secctx_to_secid(const cha= r *secdata, return -EOPNOTSUPP; } =20 +static inline int security_secctx_to_lsmprop(const char *secdata, u32 secl= en, + struct lsm_prop *prop, int lsmid); +{ + return -EOPNOTSUPP; +} + static inline void security_release_secctx(struct lsm_context *cp) { } diff --git a/security/security.c b/security/security.c index 71aea8fdf014..932a2eca28b3 100644 --- a/security/security.c +++ b/security/security.c @@ -3965,6 +3965,13 @@ int security_lsmprop_to_secctx(struct lsm_prop *prop= , struct lsm_context *cp, } EXPORT_SYMBOL(security_lsmprop_to_secctx); =20 +int security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + return call_int_hook(update_lsmprop, dest, src, lsmid); +} +EXPORT_SYMBOL(security_update_lsmprop); + /** * security_secctx_to_secid() - Convert a secctx to a secid * @secdata: secctx @@ -3982,6 +3989,31 @@ int security_secctx_to_secid(const char *secdata, u3= 2 seclen, u32 *secid) } EXPORT_SYMBOL(security_secctx_to_secid); =20 +/** + * security_secctx_to_lsmprop() - Convert a secctx to a lsmprop + * @secdata: secctx + * @seclen: length of secctx + * @prop: prop + * @lsmid: which LSM the context is appropriate to. + * + * Convert security context to an lsmprop. + * + * Return: Returns 0 on success, error on failure. + */ +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid) +{ + struct lsm_static_call *scall; + + lsm_for_each_hook(scall, secctx_to_lsmprop) { + if (lsmid !=3D LSM_ID_UNDEF && lsmid !=3D scall->hl->lsmid->id) + continue; + return scall->hl->hook.secctx_to_lsmprop(secdata, seclen, prop); + } + return LSM_RET_DEFAULT(secctx_to_lsmprop); +} +EXPORT_SYMBOL(security_secctx_to_lsmprop); + /** * security_release_secctx() - Free a secctx buffer * @cp: the security context --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic306-27.consmr.mail.ne1.yahoo.com (sonic306-27.consmr.mail.ne1.yahoo.com [66.163.189.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C60C242F6FA for ; Thu, 13 Aug 2026 20:49:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.89 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654161; cv=none; b=hBpBOPnONfYsemobDrfldsPGGjUXEpzaVE6xjsieuvy51BMfQZHB2aoVv3oN76T+lqtLr0R9Dz9YKX/xmxkYWnO+jV4PKW0dtZGD6Ih4+P1VwitQZRc6DX1zlkk8T5XbkXXrxl2AYjPzzMv0VprIZDsXLrEpOFkQDuq4x0f88wk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654161; c=relaxed/simple; bh=s5artP1LDQIWhdH1NzccW8mdrQNOfSA1a6tUvGlrj4U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NKcP+FD5WJnC02yas8Y1KCVB+a7bEVDT8CA2En1BfDfnRYkGKB2e61ZwWrEkDIRzM76RMJKMUExE3sRVY6pNQ4+zQBs9MnyI8ii/4SyZ4lBjiRhG32vRaBrEQ2IiKOhXwwg/pTPUIwGgTOz7AdihZOsGamcTkDHNHccVlOsmsIc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=lmEdUXyf; arc=none smtp.client-ip=66.163.189.89 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="lmEdUXyf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654156; bh=ED8dgmLby4uDvmQmYjzWJwEfBzVYP4wU4faKBGjAcEo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=lmEdUXyfBPuMcxDiFFWDNhr5nLi5X6ecLYp4xoMh2HKBtvywgAETVCA6gIBuDK4Msdx5+PjndqA/DvFL0eNeWj2FA9i2NjOjVywVoFDlRgJnAS0r4w8IF78sA/TY8hMO14ftSFvBkR2SVNVvyYpI1GiN+jWstW5MgBRPA4vjhKlpW2+nq2aQ3cAnU6+Pvn8Lw1zd/lgSnMMaUIE9zpBFcHhq7r8CX5n8gM+AcB12m2rZBb69B+cZ4HgA5M4W0ycAqdGWzMCcxrRklu1r6LheddyssEjS5VZHgLbwyfB0bPi8ToiPQxjAQ/HvbQIT9MmieW2dbb77YRtEH+m81nGU/g== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654156; bh=KUaGpOy2b8TtfyDWk5b5Yhrja/CHfpWVBJBbthJvJ97=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=shTNst2vku2ID3wTuCgRFmF6wnNO7cvM5cPUW6sp2DXVvz13ckPerKfhJujRzHqqObfbH0ZXAcAXR2LZCJNppJl0xYmcwZH6BJejTSXd03szjm0C3AidLxfWVdGdiDwXSJpIwQudmxWa9333QtTKnyF7PCVakCiFCpFAY5GepmK0H1if6kN/Nd+TMAIZVLWjNpHAA671xyYaQUUqwssiGtBYY89LEdaHpNYByv0XW3MHmkAjyKmqu6jT8knd0iZlgY2P9pkX5PHVLpYTu2U3og6BbaJ/rkP4Ji2LczBCM5LFzvD9ggPu2q4hbHc2tfdddby1v13WrN38KUZm5mZDHg== X-YMail-OSG: NE_mH_gVM1mJrncOfyNJgEZqlITHP1oKTkq.qtypC_o9eFVc3h0e95Nfk5ZtFuT aGkqmv9GM6nGkWemslN5P2S._5.uGEz1DcLWfnaSGc5lgiuJyQF28qi8Z1aCrpaHqO5vDNYTNODt AOZhaOiaZ5_64Y2tQ.Y9nGJ4sdSMY7IvqOxNmA4b9k2ozV8FYSXBgINfxDK1EtqpnjY7TU0I7jET ftwu4MeHm17SCWl06YBPXY96YbbS74LLwYBoEZ40.PCsEMNkZyqWAOJDVVFD5abIrMaFVg4pNvBp pSSs.lSqPYdtun78GaVyrcp2.Bi7QAdWphqI3bSrQNxpNNMkkRWcINVYwRQ.ksmyhqGNy1h87s5S DDZUPdH8QwOfoCZ4M.P.wSHHIfbE7ozhx.gdA4czgHyHNhlHi2a6W9hz0plRQWkELIwac4546uPJ vBM.hYtTtbI.KW4811cCQXuskecgsm5x_aJyRW4Wcwz4AhaL3lNAxItUKtqXKfM3xxyvMNuZiMgn tFg3GfFtDp_Os45VoRrVmpYwfVU5goUG7s5TsNjsm8VDXjMQ5V1Ed7.WE5Ndp0Tb.wvkQ35pqfQd D79uYolN67aZXNufPtF1IYihrL6DD9dkAszuTX7f6BHrh0HF7MRtq0NwUa4OpT4miSoi2QhIZHqE tlOgc4_vKuij.xQtGd267GISmH0xt0z9lczDZtX9mgkQQo4dCxgc8tO8Z6M4206LxLbkSNIvGOyr gTbJrjk8tv.vThhU8Ho26GwPrunUgIA0Q9LzGzbzmkhSGJ6O6o_tKr_qDIcYLDHGxD2nLs13J5lc Zo3yiDpxfbHuhdeMJ4uKPwFsRufKIh9Mxr2tScMTOm1TQ_I6VhQ2AK1ka5BsNmSZB.cBkZTujaOz FnW1yEp2ofza.Dcq1u4bTsWyaKj8zDjs.qyx5MccELYQCmS3MUr4T34YZeIkNrAvGLcyOKR1BeAO 6vaxWnh1iMHLDdav4p9JshT7Or9jGJYC5Mk_Pq.LjEmWvjj3.WsmeoT9ltPzq7QgQO5oaiVhsiMN x9yZ40y71gD7q_xW8kuY9OZPS3DiZqEJ.UbyA3An6XbVCNe.twBo5HVDROfdod8BJ7uglh93Cq75 54Vzpbg62NSuK8MgFRMlPO6m1ZYSxTmMRTRbLOsuGPmiqXqoQz_pq1m5JIQDUG1Qgcu51w4ebTKD .KjDqbUGJdyemZe7ah8I3XT9cEz7tByyEaZVLsFCU4q33SviqLWnZheg_mrK9pBjOVwO_TXyJu_I nFesJx1bj7hmxOxx0HdEAiUlzRZkpVYaAwuGt_NLdzJyRaEbC.ry6ZvSYixTaA4DfTNZompNetZr zno.SzE_h64zNtAcFcxYqg2E5nfMivEHTzgoWeG66jjWHxUQfKpKzVFtow5MqDuwzD7SrOIqrEPd kHtPYdsa2lPgx6gl41NXgHZcy603sRcun9_Ms6yXVdx1.orweL1kaZoET79jLJF1TEALkOEUTQ.W 5CPiZop9nUDzV6pesjS73C8Gyt.zmx6ZT.eZ8nHRnChmmH0KBJSkI6UtZEtWqgjyXFPgHG1OBAP3 cW26ROpz2BLSSqzhTmrWolvkls8O5hq25Lv6MUTSZ5punVgAkdqbUulzI92w16gEpRDvOHE2TPOB mEyTmKDla4U2oBwIT3bGWW6jqF5rQwZzlP_YtfmrpluLzJ37Em9NXsS9ZI3cbNDExnkiG01nEzb0 MFup7py8j8OnYAFmTkc7Ul1RIa9Rpl6NPptxOFeZ46iE2xtKemHOdb2B2NpfJ2GTL._4XCnwSBrS E7kDvpwEQBTH0Inklaqsw84i.PLsPJhrCCkbSmHgDRl4Gzmu9fuw8hhGCsO_4RTqhw6o0q3v4gFk Ej9JxvI9hWTGu_haWvAzKW3jBlHqOog.ZpBbQBsFdaA6sIthjPBmX2H8lvMDg7kQBEC756JjX249 uDiPbdwUJfD292fpiC1mj9Dvh8xhcWwG5fRJGUj4mTnfDFakK3UY_vpvX_05uRtXrHZr0SZ_bp39 9cKy.HiWdw4oIhOzy438Wab5v7fuxM.L8pbXBd3Q8BLaEvSHml2xuJvGDrFF7S58ziDtro3EyECg 7qkdnw.65vVNDNgtyRpeJo7.v6fDVxbI3MNdYq1IqOyY0SMKuiKX0bURyB6mdVwY4kBCecgVYczp 4ITW3XBPS0zNTkgymBP9CcRT.I.O1BSysv_AXpM17a72EG7A7.zPqyckBDIRFswt8o0x_Ecj2E4P ofekgTmbzUYgnBf44fA1JanqONynWWmzozoLgIgHC6m9VeDFsHHtSAc8xdbkjCuqGNfux.eje6jn XrCtSd.Xw_Gp0zoF99CDMzgtkR98- X-Sonic-MF: X-Sonic-ID: 732d7d6b-6705-4274-ba08-40485e0f121c Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:49:16 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:13 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 4/7] SELinux: hooks for secctx_to_lsmprop and update_lsmprop Date: Thu, 13 Aug 2026 13:48:51 -0700 Message-ID: <20260813204854.19211-5-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/selinux/hooks.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8d6945edae7a..c05c05e71078 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6946,6 +6946,15 @@ static int selinux_ismaclabel(const char *name) return (strcmp(name, XATTR_SELINUX_SUFFIX) =3D=3D 0); } =20 +static int selinux_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *= src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SELINUX || lsmid =3D=3D LSM_ID_UNDEF) + dest->selinux.secid =3D src->selinux.secid; + + return 0; +} + static int selinux_secid_to_secctx(u32 secid, struct lsm_context *cp) { u32 seclen; @@ -6964,6 +6973,13 @@ static int selinux_secid_to_secctx(u32 secid, struct= lsm_context *cp) return seclen; } =20 +static int selinux_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + return security_context_to_sid(secdata, seclen, &prop->selinux.secid, + GFP_KERNEL); +} + static int selinux_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp) { @@ -7694,6 +7710,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { =20 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, selinux_secctx_to_lsmprop), LSM_HOOK_INIT(release_secctx, selinux_release_secctx), LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), @@ -7812,6 +7829,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, selinux_lsmprop_to_secctx), + LSM_HOOK_INIT(update_lsmprop, selinux_update_lsmprop), LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic312-30.consmr.mail.ne1.yahoo.com (sonic312-30.consmr.mail.ne1.yahoo.com [66.163.191.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B24F4322E9 for ; Thu, 13 Aug 2026 20:49:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.191.211 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654161; cv=none; b=N2HhjDmkDannXrCvemvhUNWtFv20RjI0QQ79MQQZdAhceQ6k24cnjlhEuxrLfyUCJKiBoCvsx/dSivuXLnHy8pgsSA4nMTaxj7yB9JHyRaE8OYIWwd/IQstt08uSt2UU68gY4UmQSD1NZmHDnnN/7C7G32cmwlL+GDH4mjtu8ko= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654161; c=relaxed/simple; bh=dgCnGtDWunupJVBmMDbBgaAex+j+MWb7sztonDRNoKU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bEnIdg0Vv6uFCIV39yGJKle+m38Iy+UEOs7zsuBGY8f/eLc+vdZR/BuaILGiLM8pe/YH75LuKoN05+Q1rDrJYZA6y/c67AlDPxQUHebS9xniDy5Gd4RVrbU+NAJ+ijDfnWvZ+e9PTYXNz0KvdZ1Uqwod5x4zMV0TWW0nZVxGB/A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=pCvLWvKz; arc=none smtp.client-ip=66.163.191.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="pCvLWvKz" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654157; bh=4jgSYkvNqJAotmJA9U70wuCpNvKAtOU4Q7SDLp3QXXs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=pCvLWvKzJ4wOxYW2cxJqQR3vdumArbBVP4q/PYiKDdSkwC0qNT9ytKtpMokTYf6oy288+YrYyVnGZ82OsL+ZIVlsMiw3dJqwE6BOafy/bX6rwTwYxBxHS1R8ZFEo6jnTMmKl1QfuvfQXpam9r5V4pEUvWqQjIZz5WTezIB8hWjRS01ojYj7mjtbG3eLBXH//WJDfHrHnOo347YRCNjONziO6Ol+ury6rP21xRUBbWD3bhdGIbvbttxdFmxWxtK69ewxGNwXePI7N/RLiiqNoG1gI8d8ZCYRc70sXg3s6cI9k4KP8aflWCuS9/j+Av5DKVJAJ+8Z1dNIxBGsHloDYYA== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654157; bh=5mjeRZJsPe++HzLLeJLHExlsYFMKWa4ouHmCCD1fkWs=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=MG8vOSeAkGiuSoHpeLFdP7G9k9AH8ZH6Zm8GYQNxdHAf/QdEa9n8DbkHGWsKnwzh529BcUH8gHiDN86DKpoT9+uHsVtyqEVcdBI20olnsJlHFymWf66dOHxAZkWE2Y3+sYx3WihOCx4fooS06pQ9cEikzyWArJKVmUPLZRMIoKyr5rT91N0DpXixuF4BRQGpAoVOVSJHD8818+wZWU7WH+qMR+rPGqso5J1kjzJVPkNUnKYIzw3Oko7e42uMhx0+6xx3zQM9MObIGa6/uVhv6ql1yD25Ceyd8eyCAt0QoeNuayC4s+jp4P3LV356i5nViLujxBxhelsx6onFAWL97A== X-YMail-OSG: iLY3fV8VM1k.C1pPxnRkLGfTCYok4KBkR64wivAixl12.NkvjZ6OvaaKFatdxjB GYdlGqO0RqEj0cOy8SFLdPEps9nVHJNCpJY_BjtdDEP33_MFXSp2IJQAb.4WWnpavMyanmCmM63X y50GIwgOHPnxEmraSzfiyX8U_lZE7bI8AOcXqqbFqGb_Y3Du3gVf6jtiuiE7CBuTQZTrYf5CmavT AnORPWSNAYE_ChjqER7rOBFDHuQUC.5xeEnd2Fl261Fg9199V84RD2k360EzuOoQ3nNw8DVK3DVy 10bIRk996_w1md4wdpw2Iyv7EwFxFmQHBE.xUVi_BZkKIt.36S9c52rBj4h4y6..e3f2zt4tG2nb eG0LYcEzRwQZ.dseBHvIFW2A8B1r0ojd6Ive8VS.JbsYGqSPPS7W8xYdi6GoeZb1dwnnqcBi2wu1 H2fU5UawPxA7VuxEEd95x4_JIgnqvhlhOizwp04kPeJQN7YErl4U6hr42hyF6D6Ckci5f9e9tS62 Ueg7XAvMjxXP4AIBcVXA.h9NswC2lFucOEZGoifiYqKcQ0Zv2WM.1NrkbmGCgsLUi9ZrX_jxd9uz 9YtnwPt1v4ILsUkuXSBn3qMxVleZgaB.S.ZQU5r2ieWliRx0KMXE0Wtvq.jx8LFKdGi.15dOxYrl 3FA7RlJf2AYVSJqioVuzQf9DLjRT5xI7B4LlykRPiT9yI4OuF2cQZn8cGmjj1tY_ljWj9SEROymw cxS3mS682Ly73JCJDAn7Byz2cWL0GEJlaKdKUD.Gjnpn7Ki0AOzLKAX.M_LPdF.ROd3ZwU8jUCoG uetiKTxBYCUG0oQquSXasgYX_PkwuKnlLy2VIhRo0P2lUcTThok2JscRAfCvPVvcJlPNN.dzmI50 2c9djM1hZPTN_brninaJB8UMWPVM.iKiZb_fOTg.7jJf8QeKiBSQbsu8ao3G1bsOXg4rMEazf.Sa ZBvA3oUtj.iG9NMZLCG8gm4qH4f942UdY7jOPZ5wwRJiWqwM5MHGKDTG3QJVvwQWgMo.AoolGgTh cBgmMfDHY4SZpMFjhhrOK6HD2h9NiCD7WD2jx05rhfz5LlonzIn6EHJ316QdVmkRkl.Eo6_Oqicy RmwpTeVHePIlIBpAh..YvYYRveTRPO3imjVLauB0L12qu4jVkBE4f723Zxr8E7TNUVCuR6kXVJ5V kODHRV72jHV8hnv_oJ1L_kPgtbaCOMYdd9mRPbkp9GrwcIboRX16UtkpUjaP8ZjQa2r_JvwQwof. EMpsarY2s85D1LPdsKbWFx1WbEFtbVaKvikpbdsVSMGBO24Ij6HzcQuiCW1HhTvfDqJ2jaEPPYCW Lo.J8wL_QQ6LkCSyXvuopeUKoPY_ne6u9aTJArtl8EoURrDo.hdUPJiZ2r49M_NPj1HAB4ns3HhL riOKnygrjXn0byQjS0sr_oU74k0FjCo6e8EO9au1wtNr3Pq.1NHKC0CKM7ei8m.NTuk3f7v3P.WE GvB0Ujn.7Lkw7JtldPWjVPltuoJttPAE9YoJT8n4jM4VkNLFKh0rfXWDPm2jbFL6CtEaLxsqmDSf ZWoF13zovNgmmjBgDW02ixxSM8ca0JxM.M35KpqAj9kptnIkYrzLmyTHujQRQWkBKic9OPTiK.iC TTQMdz1hUtVJ5qHnX5ESuurHUtr9W1i0VJupyGI0hMMdRK6Guvzg6iD4n9SjEhad0D9Oxz9LYBvp 5FpGwvYZrpKzKd9rDZgtDLqJTSV4OxLoRwp7EiMQXqJKofPVUvVHWQHthbASstTT0u3zDVTD_3fE Yj__7BZb52iI_i7XIq4niRxXmON_kNBIOMAzFHdRvn88LXbwFhe.8nj_zBjtyUPRqjjAQv3plKvR QyZnnZ3DhR122vwVQ5S37dLi3eAPnERIZ5tLSEvnQ.145BbR.GVMgQV51_LDRlKonjSqBWSJ5VEh dEvoPyaDbwmaA5dgK9yXbLCfUKYGgt_WqDfYgMSQtxWs8rMq7sbLv2fdvuDx0Uuwh_V5_MgQjtgC lZ9.B.tYm6xz4gZGopaDB1d9DQcZYevE6g6cb00a3ghLTPE0DjAVJoZY2IuR67DKV6zJAAQlgHE7 gi9L_4lpWfw3KuRgCDubNOIvHePnWWF8cKxTljwminRdwtRb3g4nLYP5B_xVEb10Ua7.rk.pinni NSEBsjd2zZaJygt52SPBbT3YDHo9ldsebxoYbDiufK2AQJ2CvpgSNIyMdtoeLsFCw0uh1WaXQjqe RVPi.mF9AwsNi0VTKRLRjfX1X0HvFm4X3tCLBJQ_CrMGi.486RZk- X-Sonic-MF: X-Sonic-ID: 3b115120-30a8-487d-b45f-93ffb3cc9c5e Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:49:17 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:15 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 5/7] Smack: hooks for secctx_to_lsmprop and update_lsmprop Date: Thu, 13 Aug 2026 13:48:52 -0700 Message-ID: <20260813204854.19211-6-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index ff115068c5c0..8e3ab61dfdd9 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4909,6 +4909,40 @@ static int smack_lsmprop_to_secctx(struct lsm_prop *= prop, return smack_to_secctx(prop->smack.skp, cp); } =20 +/** + * smack_secctx_to_lsmprop - add the smack label to an lsmprop + * @secdata: smack label + * @seclen: how long label is + * @prop: where to put the result + * + * Exists for audit and networking code. + */ +static int smack_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + prop->smack.skp =3D smk_find_entry(secdata); + + return 0; +} + +/** + * smack_update_lsmprop - set the smack label in an lsmprop + * @dest: destination properties + * @src: source properties + * @lsmid: which LSM is relevant. + * + * Set the Smack entry in the @dest if appropriate. + * Returns 0. + */ +static int smack_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *sr= c, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SMACK || lsmid =3D=3D LSM_ID_UNDEF) + dest->smack.skp =3D src->smack.skp; + + return 0; +} + /** * smack_secctx_to_secid - return the secid for a smack label * @secdata: smack label @@ -5269,6 +5303,8 @@ static struct security_hook_list smack_hooks[] __ro_a= fter_init =3D { LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, smack_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, smack_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, smack_update_lsmprop), LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECBDE43744A for ; Thu, 13 Aug 2026 20:59:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654777; cv=none; b=drGf9IaWcGAlvKJJZcBNSeamBdSItjVVlEsmrzio6IiiHWwLuNfBdA8Aq1hfkWlGxR4a0ktK7BgVNjZIZJZT96SwQvDkjATVn4vIFocgT6t2j+8CTJNCv2Ke70703/5puDz3fOB5jRlCb/C3qqA13LD+6DD6pY7j672pxHCbH2g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654777; c=relaxed/simple; bh=iplEOpAuewoDbtmO5Bgo946/rCYzlrvNkYvSo61Gg+0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N7Zbx0demiDwu7kF8oeTdw72KV1lYOQ8zkXJhwV5E1RQ6mD6cqrsYS5XYxh11KA9KLnKeDbG725WhDVT6wyAop71xPa4WerePrhlL3lNOyA1Bb+7w9nzdyEz3+8m/+sZ2P7fK9UgK4jCri6hpWKzVkOvK+ok2SAMrch1By9E/RY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=c3Mn0nRj; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="c3Mn0nRj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654775; bh=L8gF9lbb3/GdM063c/AqJxtVF10JcTPk+9Ii0LVaols=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=c3Mn0nRjddd37T/EP2WpMG9zFCl00+SHVRYe+X9IKJdPYG83mnP3ATutvQf0q4KqwcT5WLpjlNUsUHXD3FKbcT0fGbN+pSkiulkBRD1Xlh1NBwuV2FOoWvxIKYxDJxbR27Oa3eVkwZntKRZ5MrAgG4ckSGZGO6vZ9cxJ0e7b2mULFSglAvdiWaugVQpwXgYBOMQNHUxqAneJ9RD8Cv9NtxmfEIvAIhJdp0bL3/xmBjAWxAqZJHy4ZZDrHfN/VPdyYd0XZH827KWbEAUTkz0qdZUV4n7c/i1SYXlriQXyw/QNAcvIsx55BRiLk0ymRhBM0vIKqDNI1oIjSbrkKib/eg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654775; bh=b0MATl6xilqkwbFvRhXeaBwPAjtIZU23munaPyq6fb4=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=YceKzCzT5KGpD3zBqwZDZk9mOhR1ouHdEj/t9FRhf4Zr2sa7UqenFBYxgkxboyrlrRIPwuECR33wr2kKtl9kBPYJiHYxyRa/3GLqNKAhIHcHhExM8exKRM31Tn0EieM90M61IoQMwPfGY11gdSorRUUYyOy2wOvHmQEFDqix7XQ8gIOoIPsIEO7loqzS9n62yKCCcJI0Igg17ki+OFhJiBYBoWaszLs1flgW4mM74cOWOMX0NdnUUzCjF4SCDcZOHAHCnmLVv9fjNRnblYIe+xC7IgbYMNY4DksX65e0yn7SJMCkVHnl0jpNLl/mAUSONDRdXCEWwnoL3ZaOAo3TBA== X-YMail-OSG: v.aM1UEVM1mRwhXWuoIVtQjgLTChcQQxIObiZted9Av0P_KoQiCW.xehYlBLl4A PLwehYS3vk8PER1Xh0xS1.yuwDmZYiTxyHZuTVmkM159P3eBPxHZP5zrkrBoKD3rb0yphLvwGBFw 3oY6IMYZaDc768E4yXc0kAgWZ.CrLCaVxqNicV70IETUJCWPTUW8dVm9IQ_mPY6g3MoyUmsNVbcA Hsx_WfkBco_j.Ruv5oRn08NQS2Wfz1ZOjNwFfIIZ0i0w3DNHjpBx1T9mWZd0sxRJ9dqgGpdUuTx8 rVYZF9F.Xm6ZU6Vw6MF4rvQBUZ9nAacp6UOJDoxVdHiUNB_Xg6mXMfNXaec8M2x4aCstqwRpNjPy c7E6AbQkOtiOK9OEyBFKGlxmOFs9QxJ8tNK0_.r8EkqII2DX3FL2hwLKxBBPxGo._nVaPA7SM7tM NKx4iACoecExmdLp3AJcrl69dpQqNuyFIfejqSdD.zcBdnERZrkSGCkZAhHbdMJ1CZ_o6qSmvqwJ bnndJdun2GlyI27OixsCL4zzoYtnjoJoCkjxU7FL_6GvaoWnd.qqzBL8x8AxXBqt5RgkYBeMXOom ESNLKjH4rQGYzPyB0QKqMc30DJaVzzHHj8kWcPLKr1DZrhoUzdaR_wjv4MJ4reyFQHqE8Q5IRt06 vkPs_aRho2szOvPOEACcP1ZIoCgegXkKkwX3oLDj7o.sss.u9Uxu2G92HtMkoez5xxsxEwAD3Vc_ C7kRDfirVII3KUFrObh7kcWjiAzq36POX16zxRT61wTB5Ot07LQz0zeIpmd2hVsGmJ5_ujZ8HTOn I2z3AwRqtgHVYfpciOqJbvobJ3gXeQ3.387L_44bzjhVHovykA8OouPd3sN.UnmKYvadQnRw3kTn FJjSUr932.a1nbXEDCfbk0kCrOgQ327edZhNmnZIaA1S43ULRdmslw9FieM.YgyB6oFYwnZFm79. Xt2ZgoBZ.8qoulNYdynHD1LPSet70qNK9fMfYYVRC_cfXiedCXC5l5hVaRxH6YBXKqSv7HubvAGJ Eo1Nk5vwRsgix54M6xX3geqBcQ8AHeXu7CBetfsh_LHXRfh_b4fQZDu8_jy0xZJ.qjr.cYCMaCpD MunEwUo0RQ.boGMOWNmFBUHXh3ckOaksrSde5Jo9SgFNLVzpQRmAAeOBCHcwpx9nTUWOFH54UmxV tBOdB9leo_z2hXT9AhyK6Odrd0unf7lQvFsVB.76KmYdcohJ0wNOfrkMUxFZ35PVeA_7S.atGbil M56LNxShuCbFJ_Ne2fZYnpwoTqwgY1DYbonSzk0hL9HuZjWu_e9oUdgSqucItfEOeZu_vhsnco4_ pTBnVVWiXmiOR8yB_0D6j7yGBCoilC4FlxK4z8JjMSStXl.CYYYq.q1T89x24csVxQjP5i760O_T gB.WGcCGEPUaZV3fh95ExKK3e7qcp3kTeBzCdyKUwVlhtYXHHF9FWhkx8f0dfoh31zFz7CpkHeyv rv1VUbiTJ6RGQbb3azj5D6uF0mzs1d93MDQPcKRU9L4TpX..XS6E2Uvny8RWpm4gmaU9OENjQH67 TQDucHVDQbVqsVE3IHg9NTp5uqe1GQbJEtaFUTQpp5AezAWGjZ0oZvYkmBW1iwZ0YKwAJPIoxQfV seggGTamasoVAs8fLQhb_bqtcQ8qDyDMRPGErj.ujm__rPfeeXbF26LrAfZ_q1M1wMAdRoCpnsSS ECBsI7emrRmKIno_jOICb1xF7urBEH89cBY._0YnBOiv_OgKV0hLBB5TjsfcKeSmNWaN_LfGtiMM OQaOxEq15AG_dLHd9Zf9qEkeRnXVE2KyvaNQXlTm1laZdie9db9v9qS.oAvivvkBy.V9ILnUIQRc HBTkSlGo_mIPpOlfzeXw3vXUBG3aHa6T2TIa8KkGnFLoykwpqjfAAMSOr4Tw0kr1sJ6lbaL4uU.6 3g0Luj4Qz6D.fongKWk9dE1GX_UF03E69N0WMHG3jaWdbXnRBrlJkFMIlpwrIVVbWelUuu0n86Xe SBJ8aqwfGjNiPSNntx_pHWLUvGEK4SZwf1HOe85hg799WAYnme.YODkYUmvD4PeFdr1UkCLlv3DW H_7UILBPn4AfHAL._V9MYUZHzc776s18rNPtlkDotIP1q1VpeYsFasx9FPdFcUZqC38UEVS4UjwI UZvoz6F_7dv_jALSvix_fR2AFmsGvSL3DPk2dpm72fNvmTUsfMLrtPFtOZ.dofufu23RYIkBGJm7 D9xgKAe4RX6DHO.XmAdYs2dcn6bojntgT0mITsok9RP83SB_fxjSotKwQGQZpkJ5pyt7emKlfW25 .A.4uBYRKRo93gfKviGaKhsvUks7g X-Sonic-MF: X-Sonic-ID: b6a70a9e-8261-4e33-811a-1e77ff204f88 Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:59:35 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:16 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop Date: Thu, 13 Aug 2026 13:48:53 -0700 Message-ID: <20260813204854.19211-7-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/apparmor/include/secid.h | 4 ++++ security/apparmor/lsm.c | 2 ++ security/apparmor/secid.c | 23 +++++++++++++++++++++++ 3 files changed, 29 insertions(+) diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/= secid.h index 6025d3849cf8..b290ae8f9b01 100644 --- a/security/apparmor/include/secid.h +++ b/security/apparmor/include/secid.h @@ -28,6 +28,10 @@ struct aa_label *aa_secid_to_label(u32 secid); int apparmor_secid_to_secctx(u32 secid, struct lsm_context *cp); int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp); int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop); +int apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void apparmor_release_secctx(struct lsm_context *cp); =20 =20 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 88d12e89d115..1f304b88eaf9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1766,6 +1766,8 @@ static struct security_hook_list apparmor_hooks[] __r= o_after_init =3D { LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, apparmor_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, apparmor_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, apparmor_update_lsmprop), LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), =20 #ifdef CONFIG_IO_URING diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 28caf66b9033..51f3e4ab053e 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -106,6 +106,29 @@ int apparmor_secctx_to_secid(const char *secdata, u32 = seclen, u32 *secid) return 0; } =20 +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + struct aa_label *label; + + label =3D aa_label_strn_parse(&root_ns->unconfined->label, secdata, + seclen, GFP_KERNEL, false, false); + if (IS_ERR(label)) + return PTR_ERR(label); + prop->apparmor.label =3D label; + + return 0; +} + +int apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_APPARMOR || lsmid =3D=3D LSM_ID_UNDEF) + dest->apparmor.label =3D src->apparmor.label; + + return 0; +} + void apparmor_release_secctx(struct lsm_context *cp) { if (cp->id =3D=3D LSM_ID_APPARMOR) { --=20 2.54.0 From nobody Tue Sep 29 01:18:19 2026 Received: from sonic310-30.consmr.mail.ne1.yahoo.com (sonic310-30.consmr.mail.ne1.yahoo.com [66.163.186.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03AE542EEBE for ; Thu, 13 Aug 2026 20:49:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.186.211 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654168; cv=none; b=Wud7ySAJrTj1aQkb+CaeMhd+hXDUR/Ei9kn2XUmX8H1zxeIqP4FuqQFg5F0SShC0VaqO1Zbhf+8QJ+NKosxO2mqyIGqnvw4uPuGWjjMT60F0X3+5FVIVZou6Md7ym04MHW21wMuSaEgXlg+4fFMXSzdrmc7xDEsNEuTJCQCWJFw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786654168; c=relaxed/simple; bh=72YhhNU6NWvPLl2DQfZr45uphCv8J0DRSZwFwwujUac=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gae73HUA185Bw80OYfkNTm2k8ZhWvM2m/jeVc0ohJ9UekznxrT6dm0uuDXYqYymA705X02d+Lol9uab+3a9BU72vKu4qiZ4qYamGWzDyLHn/SNxFqIa1NxrJwizM/rOMZbQIfKEdo9DsDGnRI7muK1tIXQo4st+0PXd8shwu5RY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=THx0I7te; arc=none smtp.client-ip=66.163.186.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="THx0I7te" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654165; bh=FRCocopSO5EfBEt+ygxtllafaFTCGOtGFBdAwiisUyU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=THx0I7teNFzbrIqHaJkKIrnOhmnV27/qnEm8Mp6hC4PwZ535HBMVrlwKpt0q3d+ezoGnTUa9e//PJBqMZOqgBuK0Ef08Txq+ZNIjOLykmNeTXqPewpPSXpusM1nIbRfUO13irOgn6OpxLDVC0Agkxzsn0kmPTJrIMzAbjv+VZmxbabt+DZw0ROiAwwI9nOvipP6VLOrvApPPZv2qoGcIgPUFP1gag2IWEmYIXegqUXwnoibb3Lob6Ri7nmV/pFobD0qC1SibfF4gmtPUlkRePJllxHueUg/PvSRejUNeLyAi5AYfIBnvya47Zc4z4X3SFrYNOtrc9SZCLMlPxKFYdg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1786654165; bh=i577mnP/8KO+geTT2pGDgvbizXY/QJgNdeE6nW+QAjF=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=aD84lthkbmls705LZ9wv3d2x9gRxUHSkZ3Ow8T1j0LcuLsbp+1Ie7pJSwvsa/Wsob8I8uj89/bnvRPUX43O4Pt5F6b32AvCROEHo5DYpcuCkEj+v++rqb09a/oS3eO2Qof+LxK1awpA8CP37yI8OpFeh01XdCLS98RxblM6XSk1B0k9edC2ffniOkeIXf4+4JIzaFpHhXejgcP7C1BxbFvnFZJ0oG3hyyhDXMw+VmXhT8h8LSB1GsGPPtXpqi+4ZZ5ET4JCKRm/ErIc3bIDmCrXWlYlyJKzPJetbND3v9DkKPzDOtC4bZrvnbAZWc5U5CePpkEkcDp8z357EY91gpQ== X-YMail-OSG: FVTJgFgVM1mVr_LeJk8uwxbYUs3Pe0JyVAa.zkfepHtlJxctuMQnG.j_8PPk0AY _yN9z7B4ZbdXcsBeEa7mjRn2RtaO2CmhkoszHI7XSoT1tVE_usFManAcFfvLLnIwS2BwMkJBSnlT B.5Ozu60kjjA6Bx304AKDmwN0YFFm_h4yAMARN0N4mk7Efr4hvrWNPBJoxWTKo78iY_UK5KwlWd7 4vPInDW8sKlS1cH6xRf9cMsHKPlWuudSd9rTfptBdGx8ZYsnCJK8v40.L9DfwKxNu_EaCWwaOyTz 1K0kXP_ZpWgvJfeC_U8v_l2gq5uTrzGgWO4NzFoUWxreBwhHbciVUuHdVbKFEzpt5dV6pDRLolG6 vtZY90nAbN3f2KS9LHxf.oWTMXua29Vn1Ctqrx.EocucA23bZ5pQFVfinhI2zmdeeb7Lc2fyF.01 A0Mqys6ZbFT6Kr_jC1GmhAOffqxEKyY.8ZZHDPbZecdr_qG65waysQfCCB_KsinUepm9_prHNI8R 6acVXUI4giwNXPhdBXT_Cad8ss1YycvzH0AQ.tFkpeFxloi.FvDiTnskGEBrxDq9RLJSFqhLW9SW r7LRi0gCCVxX.3h.w8hrO19e1lsKh1ZIkHYr7Y9sTdazrhJK.ai2RQkfzdAW3u16cVmfV6f_Lthy VbdEK0KhxyZozwhM1BZUdPxi7BVf5ZJHUm7I3ZDCRL51WS6d3.0coPWifuFn.zQmDSxLUGt7yME0 S74OiSSDkC4woV7OWdjiUmC0uMJA_c1Y58JLq2lKp4g6bu7Vs5mn1Hesw8iq.61wsjMPBPRP0p33 gzwNH4oCvOuUYYtQVdhc0pHJTJkPsLmyPqiZZ2hSVr_EQYUVl2nn9tYDwfeHlvNFN_NzQDHOxHSj 2OJ3Pz5IdUuHpK5wWDjm9ZsVj_MX55CXEZZasYton.lfzkag8E3LySk037PJo2aoyUhNShWYbD1u iYbjXbzaNmv9gbxe0HJDeqykDCVigcE3wt8iuL7WiDYCw96RPdqPamudFPfyk04VZ.Tz638cYwBU JzuYZryH0OO_qQxPdgJS6B9zbyG4sxDG.qdNu3sCrWBXrjUBsJU8EoLvVJhOBBxkZjtCHXauCK7E Augs1eCqGFGYz9JTM74Bycf67pKrWgY4o51PtU0067igS4DMuwCi2yStJ5E0CWD_zHGKHsauO32t zoexSl_mTjZV.DdjYDzU6PtyOmwCqYhofqdXiE45E9B9JGPvqDaupj5PvxJsQ7DwEJLbDHLUlKzg 4pPT5ovSEY9otAEe6OPZRt8lzt3y8MEz1J1Gx4vGz5Gbq7JEWlCLVjbjFmh6GYwfuF4PBExjaOaH DB11Mf4G0qXlVC2f3dd5foomJ9CgmcG0ReF2vALcfuNO8.__40JvCLoPW1asbTby8uVOCjJ5xWpj MEVSaxYltIUDJPwYDCsOZrkhclSVVH7i52nYgg9Jr6FDmonkxr7AC1_Yv3iL8sauW7NQuSzNYKh3 QHrgA7L49gpibxiVxcDV_1PPceVqX_xzoc.eBSKXxLyj0YXYaE9UsUUNZFoPE93OGWez7HlV7HVI faYkArRt51ZcyHJryuc3FM7KEHvaobjlLhaBTv6RKCsi2_.eP7CsleAqcowWUgeIa2iheS3smYbZ B9dLiC4JEKmXPxBfaH4CyuqwvLy8zTcW_DZTRHiSII92Q9nJlapjWvHdU2pm9r_Dg2gIbACxykez ETbXdY8EIcEtqDZUnDQ_bjPC6URiCEpaHDML7CS2s9bhvWS.jIxRC9AhfNqm6aD2uSiYhakEi.UT E81LxfjCcoQAg79PRG7tnEnmrroBspzamb6YvZDTK4feG_8ZImTS2pR_g90g2OCGWunaC5_1_TPD 02GNBkf6tj8FTU5aPxD6L8EM7ZHjVLHL6Hp3GCBGuwHTrmJFRLufVdsGj6srk_9TJNOJmpMZzvCu y5qONu6IvnHTsoKRrd.jyS6uEx358_Rp88FDLG0qUroYpbOqBgD.IoRxkrFTy3WEt3Htc6mHFHpW 5oDQRwREaG7Wn_63iwHGX4zGtQ0dK8k1rlKNu.wyPazNQayN9tAhl9N9qhm8zn66cwRmM3BBN.Zw TDyopT4gWknXlN37Iv8eRogaCwrD4oDglQijVw6G_VyERQDTjLAoBmUgcKiCxmC74Y_KJWelvpLC 4NDi1a3Jdr6BuKqMB6mER_8qm2HoLm009OyQGQi3Agpdhgv9Q9KupJAefVBS.1UIhDXvt.xUfWbT STsXGaIC3Q65pbKEJCPw0cmbsda43lwZ_vqxAykL6zZERGjcIIbVhrAHUa7FWZZ6Ij0N_qA428UL Y_QfEP59c.DItcVsknSykqpDBXU2xJeExDQ-- X-Sonic-MF: X-Sonic-ID: 7eafed83-78ac-4e4d-b4b6-05717535b423 Received: from sonic.gate.mail.ne1.yahoo.com by sonic310.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 Aug 2026 20:49:25 +0000 Received: by hermes--production-gq1-678d9dd684-6hkng (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID afc5ff34d004487469fb59f8ce77dff6; Thu, 13 Aug 2026 20:49:19 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 7/7] net, lsm: Change skb secmarks to x-array indexes Date: Thu, 13 Aug 2026 13:48:54 -0700 Message-ID: <20260813204854.19211-8-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260813204854.19211-1-casey@schaufler-ca.com> References: <20260813204854.19211-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Maintain a xarray of lsm_prop structures which represent the LSM security information passed via skb->secmark. Pass the xarray index of the appropriate lsm_prop (the secxa) instead of an LSM specific secid. Allow multiple LSMs to specify their components in xarray entries, or create new entries as necessary. Change uses of security_secctx_to_secid() to security_secctx_to_lsmprop() in the netfilter and iptables code. Change security_secmark_relabel_packet() to accept an lsm_prop pointer rather than a secid. Change secxa_set_secmark= () to update and create new entries as necessary. Update the SELinux, Smack and AppArmor hooks that use secmarks to expect a secxa xarray index instead of a secid. Signed-off-by: Casey Schaufler --- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 +- net/netfilter/nfnetlink_queue.c | 12 +++++- net/netfilter/nft_meta.c | 11 +++-- net/netfilter/xt_SECMARK.c | 12 ++++-- security/apparmor/net.c | 8 +++- security/lsm_secxa.c | 18 ++++++-- security/security.c | 6 +-- security/selinux/hooks.c | 71 +++++++++++++++++++++++++++----- security/smack/smack_lsm.c | 10 ++++- security/smack/smack_netfilter.c | 8 ++-- 11 files changed, 127 insertions(+), 35 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 3666d821b8a1..7ba4547daded 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -371,7 +371,7 @@ LSM_HOOK(void, LSM_RET_VOID, inet_csk_clone, struct soc= k *newsk, const struct request_sock *req) LSM_HOOK(void, LSM_RET_VOID, inet_conn_established, struct sock *sk, struct sk_buff *skb) -LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid) +LSM_HOOK(int, 0, secmark_relabel_packet, struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void) LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock = *req, diff --git a/include/linux/security.h b/include/linux/security.h index b209d681e79a..844fbef4a6a8 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1716,7 +1716,7 @@ void security_inet_csk_clone(struct sock *newsk, const struct request_sock *req); void security_inet_conn_established(struct sock *sk, struct sk_buff *skb); -int security_secmark_relabel_packet(u32 secid); +int security_secmark_relabel_packet(struct lsm_prop *prop); void security_secmark_refcount_inc(void); void security_secmark_refcount_dec(void); int security_tun_dev_alloc_security(void **security); @@ -1899,7 +1899,7 @@ static inline void security_inet_conn_established(str= uct sock *sk, { } =20 -static inline int security_secmark_relabel_packet(u32 secid) +static inline int security_secmark_relabel_packet(struct lsm_prop *prop) { return 0; } diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queu= e.c index b8aaf39cb4d8..ebab037edc6b 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -606,8 +607,15 @@ static int nfqnl_get_sk_secctx(struct sk_buff *skb, st= ruct lsm_context *ctx) { int seclen =3D 0; #if IS_ENABLED(CONFIG_NETWORK_SECMARK) - if (skb->secmark) - seclen =3D security_secid_to_secctx(skb->secmark, ctx); + struct lsm_prop *prop; + int rc; + + if (skb->secmark) { + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (rc) + return 0; + seclen =3D security_lsmprop_to_secctx(prop, ctx, LSM_ID_UNDEF); + } #endif return seclen; } diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index bd0f7a0931f4..24535c45dab3 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -927,17 +927,20 @@ static const struct nla_policy nft_secmark_policy[NFT= A_SECMARK_MAX + 1] =3D { =20 static int nft_secmark_compute_secid(struct nft_secmark *priv) { + struct lsm_prop tmp_prop; u32 tmp_secid =3D 0; int err; =20 - err =3D security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid= ); + err =3D security_secctx_to_lsmprop(priv->ctx, strlen(priv->ctx), + &tmp_prop, LSM_ID_UNDEF); if (err) return err; =20 - if (!tmp_secid) - return -ENOENT; + tmp_secid =3D secxa_from_lsmprop(&tmp_prop); + if (tmp_secid < 0) + return tmp_secid; =20 - err =3D security_secmark_relabel_packet(tmp_secid); + err =3D security_secmark_relabel_packet(&tmp_prop); if (err) return err; =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index ea67aa92ddc2..5a7b83c67430 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -43,13 +43,15 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark= _target_info_v1 *info) =20 static int checkentry_lsm(struct xt_secmark_target_info_v1 *info) { + struct lsm_prop prop; int err; =20 info->secctx[SECMARK_SECCTX_MAX - 1] =3D '\0'; info->secid =3D 0; =20 - err =3D security_secctx_to_secid(info->secctx, strlen(info->secctx), - &info->secid); + err =3D security_secctx_to_lsmprop(info->secctx, strlen(info->secctx), + &prop, LSM_ID_UNDEF); + if (err) { if (err =3D=3D -EINVAL) pr_info_ratelimited("invalid security context \'%s\'\n", @@ -57,18 +59,20 @@ static int checkentry_lsm(struct xt_secmark_target_info= _v1 *info) return err; } =20 - if (!info->secid) { + if (!lsmprop_is_set(&prop)) { pr_info_ratelimited("unable to map security context \'%s\'\n", info->secctx); return -ENOENT; } =20 - err =3D security_secmark_relabel_packet(info->secid); + err =3D security_secmark_relabel_packet(&prop); if (err) { pr_info_ratelimited("unable to obtain relabeling permission\n"); return err; } =20 + info->secid =3D secxa_from_lsmprop(&prop); + security_secmark_refcount_inc(); return 0; } diff --git a/security/apparmor/net.c b/security/apparmor/net.c index cf590dd08540..e26e15c2d947 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -8,6 +8,7 @@ * Copyright 2009-2017 Canonical Ltd. */ =20 +#include #include "include/af_unix.h" #include "include/apparmor.h" #include "include/audit.h" @@ -365,12 +366,17 @@ static int aa_secmark_perm(struct aa_profile *profile= , u32 request, u32 secid, struct apparmor_audit_data *ad) { int i, ret; + struct lsm_prop *prop; struct aa_perms perms =3D { }; struct aa_ruleset *rules =3D profile->label.rules[0]; =20 if (rules->secmark_count =3D=3D 0) return 0; =20 + ret =3D secxa_get_lsmprop(&prop, secid); + if (ret) + return ret; + for (i =3D 0; i < rules->secmark_count; i++) { if (!rules->secmark[i].secid) { ret =3D apparmor_secmark_init(&rules->secmark[i]); @@ -378,7 +384,7 @@ static int aa_secmark_perm(struct aa_profile *profile, = u32 request, u32 secid, return ret; } =20 - if (rules->secmark[i].secid =3D=3D secid || + if (rules->secmark[i].secid =3D=3D prop->apparmor.label->secid || rules->secmark[i].secid =3D=3D AA_SECID_WILDCARD) { if (rules->secmark[i].deny) perms.deny =3D ALL_PERMS_MASK; diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c index 5b67d8218fd2..2015dab01bdf 100644 --- a/security/lsm_secxa.c +++ b/security/lsm_secxa.c @@ -71,8 +71,6 @@ int secxa_from_lsmprop(struct lsm_prop *prop) int rc; =20 xa_for_each(&secxa_xa, il, lp) { - if (!memcmp(prop, lp, sizeof(*prop))) - pr_info("%s found at index %lu\n", __func__, il); if (!memcmp(prop, lp, sizeof(*prop))) return il; } @@ -101,7 +99,21 @@ EXPORT_SYMBOL(secxa_from_lsmprop); */ void secxa_set_secmark(struct sk_buff *skb, u32 secxa) { - if (!skb->secmark) + struct lsm_prop *olp; + struct lsm_prop *nlp; + struct lsm_prop prop; + + if (!skb->secmark) { skb->secmark =3D secxa; + return; + } + + olp =3D xa_load(&secxa_xa, skb->secmark); + nlp =3D xa_load(&secxa_xa, secxa); + + prop =3D *olp; + security_update_lsmprop(&prop, nlp, LSM_ID_UNDEF); + + skb->secmark =3D secxa_from_lsmprop(&prop); } EXPORT_SYMBOL(secxa_set_secmark); diff --git a/security/security.c b/security/security.c index 932a2eca28b3..059cf0a97d2c 100644 --- a/security/security.c +++ b/security/security.c @@ -4646,15 +4646,15 @@ EXPORT_SYMBOL(security_inet_conn_established); =20 /** * security_secmark_relabel_packet() - Check if setting a secmark is allow= ed - * @secid: new secmark value + * @lsmprop: new secmark value * * Check if the process should be allowed to relabel packets to @secid. * * Return: Returns 0 if permission is granted. */ -int security_secmark_relabel_packet(u32 secid) +int security_secmark_relabel_packet(struct lsm_prop *prop) { - return call_int_hook(secmark_relabel_packet, secid); + return call_int_hook(secmark_relabel_packet, prop); } EXPORT_SYMBOL(security_secmark_relabel_packet); =20 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c05c05e71078..55d7679f3403 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -94,6 +94,7 @@ #include #include #include +#include =20 #include "initcalls.h" #include "avc.h" @@ -5414,7 +5415,16 @@ static int selinux_sock_rcv_skb_compat(struct sock *= sk, struct sk_buff *skb, return err; =20 if (selinux_secmark_enabled()) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5483,7 +5493,15 @@ static int selinux_socket_sock_rcv_skb(struct sock *= sk, struct sk_buff *skb) } =20 if (secmark_active) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5885,10 +5903,10 @@ static void selinux_inet_conn_established(struct so= ck *sk, struct sk_buff *skb) selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); } =20 -static int selinux_secmark_relabel_packet(u32 sid) +static int selinux_secmark_relabel_packet(struct lsm_prop *lsmprop) { - return avc_has_perm(current_sid(), sid, SECCLASS_PACKET, PACKET__RELABELT= O, - NULL); + return avc_has_perm(current_sid(), lsmprop->selinux.secid, + SECCLASS_PACKET, PACKET__RELABELTO, NULL); } =20 static void selinux_secmark_refcount_inc(void) @@ -6016,10 +6034,21 @@ static unsigned int selinux_ip_forward(void *priv, = struct sk_buff *skb, } } =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) return NF_DROP; + } =20 if (netlbl_enabled()) /* we do this in the FORWARD path and not the POST_ROUTING @@ -6093,10 +6122,20 @@ static unsigned int selinux_ip_postroute_compat(str= uct sk_buff *skb, if (selinux_parse_skb(skb, &ad, NULL, 0, &proto)) return NF_DROP; =20 - if (selinux_secmark_enabled()) - if (avc_has_perm(sksec->sid, skb->secmark, + if (selinux_secmark_enabled()) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(sksec->sid, secmark, SECCLASS_PACKET, PACKET__SEND, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) return NF_DROP_ERR(-ECONNREFUSED); @@ -6215,10 +6254,20 @@ static unsigned int selinux_ip_postroute(void *priv, if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) return NF_DROP; =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, secmark_perm, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (peerlbl_active) { u32 if_sid; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e3ab61dfdd9..38bd97c89179 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -4189,10 +4190,17 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb= , struct sockaddr_in6 *sip) #ifdef CONFIG_NETWORK_SECMARK static struct smack_known *smack_from_skb(struct sk_buff *skb) { + struct lsm_prop *prop; + int rc; + if (skb =3D=3D NULL || skb->secmark =3D=3D 0) return NULL; =20 - return smack_from_secid(skb->secmark); + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (prop) + return prop->smack.skp; + + return NULL; } #else static inline struct smack_known *smack_from_skb(struct sk_buff *skb) diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index b363c42f252e..5270b55eaacf 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -24,13 +24,15 @@ static unsigned int smack_ip_output(void *priv, const struct nf_hook_state *state) { struct sock *sk =3D skb_to_full_sk(skb); + struct lsm_prop prop =3D { }; struct socket_smack *ssp; - struct smack_known *skp; + int secxa; =20 if (sk) { ssp =3D smack_sock(sk); - skp =3D ssp->smk_out; - secxa_set_secmark(skb, skp->smk_secid); + prop.smack.skp =3D ssp->smk_out; + secxa =3D secxa_from_lsmprop(&prop); + secxa_set_secmark(skb, secxa); } =20 return NF_ACCEPT; --=20 2.54.0