From nobody Sat Sep 26 09:16:54 2026 Received: from sonic306-28.consmr.mail.ne1.yahoo.com (sonic306-28.consmr.mail.ne1.yahoo.com [66.163.189.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6578941686D for ; Wed, 2 Sep 2026 22:02:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.90 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386539; cv=none; b=hVLM2dE63esDBr1SJoiJvjhLMEQ6yPBF2t1xLmKf/yR9q/GqnyFuBnGhd7hGH97yxSkfOT9Y5y/TIKBHBRHIfA5QJHrpdNPjH99U5yOpec87sf/AC5F67vJtoOoAzeI51MzlfUX//r0MoiSO5p2Cd9z3EplS9YcJoL4AOxw2/TE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386539; c=relaxed/simple; bh=YePZ51dlYmZ/cucTyw+gosn8F7f35BMcwjmeoZtY7Bw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T7fuep0D5FO50t7xG12HRfjKuSjr+RvIFGNt/OIyjVgpXvsU3hlqzeSxIBgy3wEvFtNzuAlhp8zOCqaq0pVpPi1JZXD9jJHbmtFJMcRrI/X2i3sY937OZMuuCBoI4uS3y+sPCrU1zqCNEVUBba5wbPum/yar9n0m6Zm4AJ6NyPw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=moyRBFJn; arc=none smtp.client-ip=66.163.189.90 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="moyRBFJn" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386526; bh=yHlrmN78oxAAQbX+BTQB5IQgb1bzCbKp9XLNwOjJhUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=moyRBFJnmjEOXp0cu0W0YXF51tTa/JKusHspmFEp1fCf88plxwqPUJ4YgU0txTeCf7IKmEWM5EqDiXJg0VUMVrFCpNpuDZiZqZelfEzF0RpycarI/wgiVvXYEyh4mbEB/9BjTkCFJNoJafg13BfHpA86c+sQN47Y7hhpKrVZwRFCMt9xVz9k6XpGici/umXBCkOSKOEaYADtGNrgV3f2iHg6mu+s2NeBvlTkzPgHErBEV3ndsGA2RPuAAqC0J4f10UFL7XmKq1VKAtCnWy+6r2kBKolryyogd7DC+qFwNxNCq9P3ozEZc62SYAtExq4Zwj0eK0k1XA0ZGd4HaUHw2g== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386526; bh=rHAuPVQSlNPBPD1AZj8DFXMRW5csewSbXSJoRErwmEK=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=UXyDgj/fThrxCWNpEAjyGPVXEYfN2zvC6X3Zsl67TzVL/7p+BQu+V50Zo398nPPFrJ7shLasldvyHywG/yudt0s/CC7/6m3la7M6NCKEyw0OawSVHkiOZMwLW7fs2m4CAr1pw5YMaYAOVsxup8VXFQALMXPp4rq9lB2hgXFFtOgaAieJdi+dQ67ggF/da7rOJWWBmFQTusEMZZTfktOklSFrcZ8kQK0sWlyxsnxUhVEdzU8y8z2yiq51xDeKCs3ZUQAcy/4wBalceSH9JoEQsINVYug3XiRtFQfTTEQs6sC8JvQ+p02xk4WtNRFxijh454kJ0sinJwtNp0GFVbEm+A== X-YMail-OSG: c2CNKksVM1nrISRBf2URQ6BWUvFkDkFeXETfEGOGpuAYHacV83L2Ib4DRZc7VyV 5bA4P1tEFEy_j7_ek6i9n_zKnVTPfQO6pB.J8ksEX9xqJDBkhWs4dg_epQHazN5HhXhZIZxw8yQP 7tyuGl1FBXfCwTaZrj2dxL5tK0i_LOuiNU_6NRXI89gSzEzsC7TnE.DbttsF0GHF5P6Jvrrn8_Om nIXDfW3bleFkx8SxbmfAVfyl4bFIw5tVGJILFCv2Ivu4NihPDw.QJrbjh7EoBN3dlbkzKdZI8c5t JaMu790XpWH73l3uvDsIy_Qe2nYxVCp68N7nrse5D3zcdQwTmgoE7OpEh9AuTlCJgu5Tyg24ThuF pVwCxDLYLk0vo4VYanNSndoW0y.1IEARERia8Ce9qtUOLiLG5YenGDIySt4CiFzP6o34ZPziTbrK 5o8EUOb.3jbn6w_pDiZ0.GJioFssWqosBB0.Slehod1adqnENqhvTY3uJ.1szVxgc7ir9V2CCbmm kl0mdiflqFmiEVjZnVOQqUrX.OS3NHUHwqYNjgqFoiyGR06EQmKG79VayPIoBcpMLhcDL29zK21Y WJnm3cfEyd1I_O6uuUtqpSMYdCkSK_hiCwqDC6wf67XQSYXkaCRUX0xF0lDN8sfmqup7jsRHfFQ4 hPDnroqIzO7tIQsrUSIBJBlx3pFiHdboEjULZKom1VJXLmrinbIZwoDDI_qaYmjekPjm_VvfW0Zm EevRuSS4LKOVC7OP1kRQrx_fk6IJk.ml.uvwpciRbx5szX8UHBYKFyzF8rwIe5baSjgO98tj7UxI 3QpMdoG5pokKNdNkHzSFHm9FBFy1ioat78hc3uSJ3YEHdYnaIA8TDZa0h9Od8K3mXg8Cf5YIUhVw PYFwY1LYdDDL0iizAWwOjsiV.shpi8tPLe63RW8TCRgECmcI.Cry0SzacePbQUslQg2WWYRADFcY FB5bs0MrI1KI3Xa7AsaPuN2SJT.qckgry8H_WH.Mbx1vwC2B_o49fSC4GYlYK4GSvxC8VWJuIM5d _6g0Kpp7Aw60gc.kuquz0.xn.g77FgAqh8Zm5ndXm.5N6iicTkRfiISPkZ9iTt.P5_CGCAOpU_j8 h2_psp7nj0urwZXsDQ.zqTdu2eJEKanbz9R2n7EOHqggpGQGllzAdyyiwqbSSaxQhqQ7CeYoz1Q2 ydz4ty.DChasU2_qDw1uWGF2mvQPR13IhBy6_lQM3NkESmu2IuyFcqsOEbbw4juwwZpC5K1F2301 hThZJx1Wj2X_NNfteBQW8zY9Q_5dw579DwE1fLIBBa782i.3yWKXo685iq9X1wXRG1PHh9JsA4lT zeqRWfxEjSzDhlWPjVQgqSnEGyrDlkF49roHbEjdohWIMdg8aUaGx4VNsDMpbOvqOr6JfDAPgQJg qafcKqJd2NuELZdR36tXcMUcX8PDrwMlMX2QPd7m9VtJYJlEiVBK8wjURUgPVurqzeRI6R8D3hOc 3.b1vmjCgTjdizyIL1o5AKXwgJ1rwtzKIWVZNlBI.Bnr18eikPJNVwMqGAZsRMWHRcWYkNbs91ts kNW69_HUYod0ui7eDDdo7Jcf6FFN6bFQSF6oylzf31IfVcl69EVB6JZ7wzjS81ecYypY6oXnz6.U FiTZ2dkSes7fgQT_rxeVjgrPQDXrQeylqr5fazLJnKHsrtQDDuR4I3uYgoWMP1lASpqmvY4IZwyp 7FH46lTGjIA5tUFkw6GsstMKlqLcIZMlrzdb_5lulMMeB_MIsdaG124ptIrAbwGvs3g9FcRwE4cD lORHwnDClZ7VHanZ2vQCWbxC6iA3Qx4iyYugFHVWJTH1AU4Gm1HWXcY7RbtXcUeTAWSorI7EIHfz 1gWwaYAv62Ys0Waz3wIjpPNJyVAWsUXI2bwTREAy9M2Dk2X3ZFuStjGKgiYQUodJq.BREwLm8jU6 dKqXEMy4ITVQFvjvplSYF6l_3O6vraZpdzaD8t00nJYZqiZCV79yj1qOabdfMSaVD.KFhoz8GMcX uB4MyGkmLzAJ9hR0mIeP_UwYLAX1QOjviE40H3aRy8UbL2sAPCUI0JwHEFKZPIYhHvGZGimDEErE Dd6deAGHJvYuf6ApPjb1VkLA9AQ559Z0JsCx.oNacj39Mg4Kj04j6coLn5Z8MdsOCwaHdxo24S3_ zYifJUzJQscmHkPDIlm5rliBU7oYZWyBhX1N6cyav.PEvvnAN31wk_OGUw1j5UWjRkWgi5FLuzfc 4rd3BJCDcCP8XvBSniiP6iWiEdPlq6qI1spsAomAAAhSlalM.ROirbuqBYtndXkioluVLvUn4ef8 w8UfY2dDVBGViqQkpLEftI_E- X-Sonic-MF: X-Sonic-ID: 38997c78-a1ee-469c-a996-0309c53fa4f3 Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:06 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:04 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 1/7] net, smack: Create a function to set secmarks Date: Wed, 2 Sep 2026 15:01:44 -0700 Message-ID: <20260902220150.18586-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Rather than open coding assignments to skb->secmark, use a helper function secxa_set_secmark(). This allows for a case where assigning a secmark is more complex than a simple assignment. The version of the function here does the legacy simple assignment. Change the functions that currently assign values to skb->secmark to use this function. Signed-off-by: Casey Schaufler Reviewed-by: John Johansen --- include/linux/lsm_secxa.h | 28 ++++++++++++++++++++++++++++ net/netfilter/nft_meta.c | 5 +++-- net/netfilter/xt_CONNSECMARK.c | 3 ++- net/netfilter/xt_SECMARK.c | 3 ++- security/smack/smack_netfilter.c | 3 ++- 5 files changed, 37 insertions(+), 5 deletions(-) create mode 100644 include/linux/lsm_secxa.h diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h new file mode 100644 index 000000000000..926257d4730c --- /dev/null +++ b/include/linux/lsm_secxa.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * Copyright (C) 2026 Casey Schaufler + */ + +#ifndef __LINUX_LSM_SECXA_H +#define __LINUX_LSM_SECXA_H + +#ifdef CONFIG_NETWORK_SECMARK + +#include +#include + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + skb->secmark =3D secxa; +} +#else /* CONFIG_NETWORK_SECMARK */ + +struct sk_buff; + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ +} +#endif /* CONFIG_NETWORK_SECMARK */ + +#endif /* __LINUX_LSM_SECXA_H */ diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 0a43e0787a68..bd0f7a0931f4 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -502,7 +503,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, break; #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: - skb->secmark =3D value; + secxa_set_secmark(skb, value); break; #endif default: @@ -950,7 +951,7 @@ static void nft_secmark_obj_eval(struct nft_object *obj= , struct nft_regs *regs, const struct nft_secmark *priv =3D nft_obj_data(obj); struct sk_buff *skb =3D pkt->skb; =20 - skb->secmark =3D priv->secid; + secxa_set_secmark(skb, priv->secid); } =20 static int nft_secmark_obj_init(const struct nft_ctx *ctx, diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e1..9d799d2459dc 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -14,6 +14,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -55,7 +56,7 @@ static void secmark_restore(struct sk_buff *skb) =20 ct =3D nf_ct_get(skb, &ctinfo); if (ct && ct->secmark) - skb->secmark =3D ct->secmark; + secxa_set_secmark(skb, ct->secmark); } } =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9..ea67aa92ddc2 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -36,7 +37,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_t= arget_info_v1 *info) BUG(); } =20 - skb->secmark =3D secmark; + secxa_set_secmark(skb, secmark); return XT_CONTINUE; } =20 diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index 17ba578b1308..b363c42f252e 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -29,7 +30,7 @@ static unsigned int smack_ip_output(void *priv, if (sk) { ssp =3D smack_sock(sk); skp =3D ssp->smk_out; - skb->secmark =3D skp->smk_secid; + secxa_set_secmark(skb, skp->smk_secid); } =20 return NF_ACCEPT; --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic307-16.consmr.mail.ne1.yahoo.com (sonic307-16.consmr.mail.ne1.yahoo.com [66.163.190.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4498440F75E for ; Wed, 2 Sep 2026 22:02:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.190.39 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386547; cv=none; b=fqCeNBEht+jZiR3Sqxyx+vm1Oddbdg7YSb26ib0nk8b9QlOVsChC4Qo2Wn6eQwP43gQZshdCe4QID2HcUlgmnV/kgxA4/MGC1S/pKLRKS8qFCOxeJfrd2anKnlLZeataWKJwyyiHO1Wp2/8tB4BQu65O2xqLNXJquklDyICiUBI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386547; c=relaxed/simple; bh=LNWXFljLkpq0sNTIZjo7ZVj+8YP01OWnm3kOOlz8cgU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=URW1El0qrQevnvZrnwAQ+z7k6+8To1uy4Ib6glyBKqHLc9jBDvWY8cjTy3HmGfmfWND+B+L1A8QsXHYVlIA6C3+37iALDe8MF7h0f5S3K+tWzNEunYlmoYcq/mu7uHVzNKewkFSo2+Hrwm23074J+UTNr4kDLCqI5s6oZzzYqEo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=qonSmkDE; arc=none smtp.client-ip=66.163.190.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="qonSmkDE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386532; bh=+G7f48kgSLF3lQnxkxKP4UiGFczw6mAmMwToOl2pe+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=qonSmkDEBI1NuWkPbbis7lpjot4HoRjXSmLQr41ucSQoYnmZUnrpd/klelUwNxxK9ZcHktUlUAxCypDGOU0y6u5zX5uq6MHDfg1A0NMsPHqscoMLeYQCzGaTsVACE998OtPgA8UqEqymwCbb8t1JOFQeX3dJDQmoGku/xJkilrJ1F/uU+a+yCN6Q9JYQuf8dsad7TVBpf7r22CiV0uICvMs+rjHTLp46EUmtNaFOkm6z+g93btG7dyuRqKN9kXYSZG99k/KCx269m3741dA8IM+v6J17nnSWDpNlv58gFd2COGQInv/QhncSkMPA4VNLGMrwrGexuNrfu2L+SI53Uw== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386532; bh=9bOYfY1LOYSdUNpXlGr8JF5OfWJHlCXA5rv56d7gv0q=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=gddnD7C7yyYNuHc3OZXO2jNqNav8x7zIlE/cucxUT1ULWh4JVJ8dgpU99GcBF2tAr2q+c0zrVbZiXW+QjGtPBFjNoU2Vf0KRFn53ensLtpxI4ccOY2HSqC5c5fr7tPXla545TTW5rVRxlWz/EZCuKIS7rLcJQW/iql0R+pDAx5bi7X6NvP9KhWZB1eB5iKV9VUJ6AWLlB0hg1tYXe3+W7HJOPWp8MZThdIyZ21Ea8iLs+ijy82fMyqQgdFgfTw4AU+8s3qwEu+NTXAeMSYyCmYpb+X1o8/hn40YwHqeQRa0EJyrjnKXTtC2sS8fKD8uYX0fJmwW4q0zEoO7C7zRq3g== X-YMail-OSG: reL6sYIVM1m8.gW7L2kC8i8u.CgmWzkhk_i6xMX4cZ8BqQdfTGflDcagw6GIZd0 PT4w.tTgaI6143G0MnQgn2xwVKG1FgIPZSkEbwIs_fTvDBCXtkxbA0OIn7k4CTYOJ3xhIKx2CxzV KW5Q3S1rglQ0TdT5TCsjzLfx95nRoE318JQHttq_f8BY_WxVft0DpQF87Lxe7EzA.C6IvCmB7hsP O6smIbOM.F4Ck2fC59mS6Aj0DBwJmBYZWz_2mDqiZEw4J.WJDBFALMI7Bt5_LdjSEp0C0fexwJfG N.U33CQRj2iPNucwMevRU2UwAmYIRQlMSngZFsQb3r7KAJAi6K9kJkyfrgsNTbKpOFMl5PhHW2Op 6PYmOUAb5nobBFoByXnFXEQ.hHt3dTllJBN0GG.h_auhBssqLEb8XynoxqC1MLiIkDISxjQ0PWzH DZnw3ikEV2nGdficd1XeD2ImqTwDptWbnuIya_O851mlEzSkwh4ssmjilbxzi4Wx8ns3OsW52c0d XlI2Pqo1i2PmKxz7fcb5Ia6eFCtKwE5uTBl4kCbSLReWtaeet5e5r3t9JQ3d4KUrrw0VZ0gJ6phz C0fZkmhGp6Z6.XVFpRhW1QVkmEZBCriMTVUa.yLSD.HyFq6g_l9qgtUj2UJpcDjnCjG_V9CflZWN uaUgPQkJAQR5WxBeqAZZmGaRDrLLXLsmcG0XIaGZThrg94E0bNr43JxI1ldVtmonfiK35pkZn1Pe iEqEyMwReRw.vDU1JApq0b87f7diyHLFC1yvzsv3Hjw9SnFSnT.fhwWNVCYA6Ry4Unm9y8COZFYT FZArtIQE8H34k7k8H69ll.5jjAMLUGYnb3Z7bweiPthO6Ul3g3areAk39A5X9tr7hhNaoodXPItp RT3lC8nls6GOoqfNBtYHxG0TRK7X1SCbAJKNpGz16Rsai8emihKH8fYCO8LI38XLc4Q0ge3K2myB lY5McAdg1ukMDUC9Hhn4PmMWDw2SRY5B9Xdpv1WtCoop7lbr7NphUFr6egjp.6jckG5IwfrHrpXd Eg4B2jT17Ok3exmPRfFfT4cpHEiUDWJTu4Swinm5NpTCN_HjXCItzdJUTwNGKhPMfKFZDYHHkRKQ jV0KgCe5Dh9Qfvjm2pooFVh5rBXzirYAVInYr85ZL1dF27dwKF4QA7nMn.zEIFqYGuN8ICLknibr tRXKv2mEjXebaEL2mHASnr4SAjewGFsWAwoVEqs27UeZJAInxgis9MP4DW6fYdIsxNudoFxlPrUq 3jNEEmWcaoRQ68vQfOx_uIjpM7XhAY9CPcDIJeqRfR3wrNm_1jafOc2LTuD5PX7OO32gXaWKC6oH 99hi63zqW4zxZeEI7tsJHSlxmxEm6IbPiNa4RSUCnbWf3PLgWxDAM4pnlSy77k8ovVKqrYf8J2Sv OYnSKqsfierC9gDzFI2KCcYDM5UiiYEgKKriQVeodV55h7U4VWd0l_eGryB5K2Ifm3AjTW4trvgR GmoK0y6xmvNYtjqSq1p._RX.akRlpb8kSb.7wq3l25.k9YgkBQcBirW5xTkiXkhM1KspR6H1lT.j qlHPuMWY7Z4ImC6HYrD5niLS.qoubQqeLX0oyyLzAhjbMob4uzslBrXM30KQaVHYrcxw_8xrWqZn J1j5LXePHBLdp2msyPYLyetCVblWFltmZfCqurGI2pRPr7EbLflkABX.1KnvpsLDY_foWK0cmBQl A9LULFJUfg1WeU4NQOjeBP.7h6MXJQtPi3D.O0lm16vlDfGVWoMoALxW80kvz5.6T9NCMcjDrNLM Ir3WJXcWPSLFQhnsr3yNNYEkInwLxgRsQsqcVWWW6mxSjMOl5mq_yBrr0EtyuPJ430.n6sspqag0 0nYqvxP0Q2ZFFD9v4cnW3trqRAHyPrUoJpJ_1joyOR1ougYc38JgG_lbH8Xz1pEusXuMeC2X01vv Q.QZkQRnBNJqUyRK.scfQRSwjBKE1zsJTJIPOHg8yGuyQOVxKM4ExWwdE1Rg5sZ9y1ReVwHMFClx Qqq1TgqWrJS7ZTHe_k5PbYXhBZ4SSs2cQ8ZLB1ZqOeK16UqWVJ3KdJm6LacsxYwURixM2BXoc53N 4DetV_HJlurVqCIlqcPOkKJXwwc7ubeXhMT7PwcncLz.uEUNxa4OWyVQ5ExCF18HCIjnkBCEyyMY rTDlL0uwJ_Z_2qdbkxZVwK.jh7KOSAI1gqnRUP_Zh33VVGZBQfp_YjlXxN9iLewE2UwRC9BGi1fG ugWDtnLzX7ABBfWGQo43zdw8ORe5iOtKzxNK.fObjv9EpHZ4_H3UvYxJ1LhRroTroJcv2eTgC1U6 Txdat6T.UI89b0yhdt9VrRnmFaQ-- X-Sonic-MF: X-Sonic-ID: 6dcff937-1b8f-4d29-b520-af074db5d2da Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:12 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:05 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 2/7] LSM: Implement x array functions for secmarks Date: Wed, 2 Sep 2026 15:01:45 -0700 Message-ID: <20260902220150.18586-3-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement, but don't use (yet) the functions required to use xarray indexes in secmarks. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 19 ++++--- security/Makefile | 1 + security/lsm_secxa.c | 109 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+), 8 deletions(-) create mode 100644 security/lsm_secxa.c diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h index 926257d4730c..84b06c093460 100644 --- a/include/linux/lsm_secxa.h +++ b/include/linux/lsm_secxa.h @@ -7,19 +7,22 @@ #ifndef __LINUX_LSM_SECXA_H #define __LINUX_LSM_SECXA_H =20 -#ifdef CONFIG_NETWORK_SECMARK +#ifdef CONFIG_SECURITY =20 -#include -#include +struct lsm_prop; =20 -static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) -{ - skb->secmark =3D secxa; -} -#else /* CONFIG_NETWORK_SECMARK */ +int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa); +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa); + +#endif /* CONFIG_SECURITY */ + +#ifdef CONFIG_NETWORK_SECMARK =20 struct sk_buff; =20 +void secxa_set_secmark(struct sk_buff *skb, u32 secxa); +#else /* CONFIG_NETWORK_SECMARK */ + static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) { } diff --git a/security/Makefile b/security/Makefile index 4601230ba442..e93be00bb6ae 100644 --- a/security/Makefile +++ b/security/Makefile @@ -8,6 +8,7 @@ obj-$(CONFIG_KEYS) +=3D keys/ # always enable default capabilities obj-y +=3D commoncap.o obj-$(CONFIG_SECURITY) +=3D lsm_syscalls.o +obj-$(CONFIG_NETWORK_SECMARK) +=3D lsm_secxa.o obj-$(CONFIG_MMU) +=3D min_addr.o =20 # Object file lists diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c new file mode 100644 index 000000000000..ccbe78095d70 --- /dev/null +++ b/security/lsm_secxa.c @@ -0,0 +1,109 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +/* + * Implement functions supporting an x array for LSM properties. + * + * Copyright (C) 2026 Casey Schaufler + */ +#define pr_fmt(fmt) "secxa: "fmt + +#include +#include +#include +#include +#include + +/* + * An Xarray of lsm_prop structures. + */ +struct xarray secxa_xa; + +/** + * secxa_init - initialize the xarry of lsm_prop structures. + */ +static int __init secxa_init(void) +{ + xa_init_flags(&secxa_xa, XA_FLAGS_ALLOC1 | XA_FLAGS_LOCK_BH); + + return 0; +} +core_initcall(secxa_init); + +/** + * secxa_get_lsmprop - get the lsm_prop associated with a secxa + * @pro: destination for the lsm_prop pointer + * @secxa: index to look up + * + * Find the lsm_prop associated with @secxa and place a pointer + * to it in @pro. + * + * Returns 0, or -EINVAL if the mapping can't be found. + */ +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa) +{ + struct lsm_prop *lp; + + if (!secxa) + return -EINVAL; + + lp =3D xa_load(&secxa_xa, secxa); + if (!lp) + return -EINVAL; + + *pro =3D lp; + return 0; +} +EXPORT_SYMBOL(secxa_get_lsmprop); + +/** + * secxa_from_lsmprop - get the secxa associated with a lsm_prop + * @prop: lsm_prop pointer + * @secxa: result + * + * Find the secxa associated with @prop. If there is none, create it. + * + * Returns 0, or an error if the mapping cannot be created + */ +int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa) +{ + struct lsm_prop *lp; + unsigned long il; + u32 index =3D 0; + int rc; + + xa_for_each(&secxa_xa, il, lp) { + if (!memcmp(prop, lp, sizeof(*prop))) { + *secxa =3D il; + return 0; + } + } + + lp =3D kzalloc(sizeof(*lp), GFP_ATOMIC); + if (!lp) + return -ENOMEM; + *lp =3D *prop; + + rc =3D xa_alloc_bh(&secxa_xa, &index, lp, xa_limit_31b, GFP_ATOMIC); + if (rc) { + kfree(lp); + return -EINVAL; + } + + *secxa =3D index; + return 0; +} +EXPORT_SYMBOL(secxa_from_lsmprop); + +/** + * secxa_set_secmark - add LSM information to a secmark + * @skb: buffer with the secmark + * @secxa: index of the information to add + * + * If the secmark in @skb is not set, set it to @secxa. + */ +void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + if (!skb->secmark) + skb->secmark =3D secxa; +} +EXPORT_SYMBOL(secxa_set_secmark); --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic312-30.consmr.mail.ne1.yahoo.com (sonic312-30.consmr.mail.ne1.yahoo.com [66.163.191.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E7E0414A20 for ; Wed, 2 Sep 2026 22:02:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.191.211 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386553; cv=none; b=Ki4X+knocs4Xq6x5MsuoCUHY6Qr8J6lhwsHIoFh5pfoS/mM5+9JPmoLHDL7ARmNwLfrRd1WRqIu8TytTpXpykt6gXw0h8Td84ZUnTnoikXz6y1haabwA56qFTnqHP8twcrqNxzmwEQ/FpMgoVcUIU0IiFKeIMyr7RCw42NYBY8c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386553; c=relaxed/simple; bh=XVSjcaZyuUD2SrbqN9FUXg2GXtPt/4t566caTuPgIpQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=X9p/eZx+OGaZRsMO+kxqAsAnxsQnU9P2yzhQFbbY7QzeRpFka8mJq/9VJwM6sjO3bsysb1LRPCNFAdGQqKMExjzRjaHC+8xcXSvIIMr3N1iC0B6IRLJp7eeofqrRGTWJA0lNtI1ZQO8A3ei8/Nd0Izz2S2BeiRrQGNLJoDqqUZs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=ExBwVp8d; arc=none smtp.client-ip=66.163.191.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="ExBwVp8d" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386535; bh=tLRp/oU1oiSOD4+KZUJnxFQDz8wkKZs/J7I1da4eUx0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=ExBwVp8d8nDylCLh77KcI3HmLcPmefifIFBTLuI11xwwnrrxRtPjDhqHn+Jw76n3X4pqWD3486XgLsfpsghwsoZ4SDKfQehZrtcEXmwVFT7uGfOI8FZ3aGCLY4IBeCy3gK7iwzrrvFQNfOVD4sS3mDK6O4V2xyX42hqlJqzKRylul7j1kCXnIvL7SgulcjMpNlWxU1mqdbOTu7WpR18Qfye98WrxXSg+K3pdLT4CRnDa5JQGKaRE7Qinu0XesD3HuNWC1d2EVJLdwEgP60xyyBJe7Wv28WJWtICsoG3HAz2nFm88huUuc6M1bJdkfFd7/lf46RbJRf1171HgNMI84w== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386535; bh=+v5K2uFpu5dCBXjy939H/WDTC/DhQqaxP3dUSfFGCf/=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=XD/e+qxD7JgnVnbCmZzAQX40NW2slkWKk5gmtFJsbxEH65Du5c3RkvVXMOD/G4StqxPSjn3cMcHODf1jWWy+2JU4dRZkBjrD5KIyM0D8vpygNlBd8nsB2EHnSLKzplhJyifvi6dIbsy2p3zk9yfNxaUuiNAwKEp6r5fysNVZKxev8K1DWqVpyPeD57qHkrrYzV2sgIfmvdA0i5ASME6I7Ua2sp0+i3as+7k18keBephiL38OGP5wSj3z6B3Pel1lT4onnElcIS5F0L9fDGgsCtOTncXyJcwLpDo2+icOPfY7iwnTdeJX9GC2ehZtQrOY4Eg63A1mBRt1FU9WJEkCcA== X-YMail-OSG: TJKKPT4VM1l_Va2xG1kVZ7sz8hR0vjw6l8SzEn5_05v4yx.PxjeWWgC66InfWJg A.HgW9ghqij7Qhcxhq4XVmBEzRbf_zZPZOMV0Qht7fPVfl3kasYfV71ScWpDAn1RERbAHypUK_h3 feQvz9sJbeJgD10HZUSxvb0w16ExXDvaXQtS6WOXU7ibFrNj6dESZ0wIYeDF49N08mOiLKr5V7JW 6gVdyImqm5p3vDVt_DUnd4TEnC1iKZORbnKIIdh6mJAnxbo6qbxk1o2SIEhllqqjjhwgCXpcdzPY ZtHEBu2kpqbQWSf4lQTMtKfVxAgQSeIfRCIYNs9.xPnGNFxLEsufnBsdNIx80F4zjknoKsFOOEt. c9MpkYlLhmZlwqxznoEu9JerC36rpk7fZnoOKm6k8Kbqik0zsna5zZ5RqFwSmOxzLI4P91ZQLX1S ez3EC.nyQIWD4x4FBpfkweBhcNF5y3gXTmcq7nQS_jaCCft0jKgj37ccf2HfQfJe2bymoJusfgGf 8QwegX21pd9LBIcSFLBwj6IEV8THLKqofUr2T.smSubgYNP9rvFk8fwngTtdaG4jLhqdPz2HnJWV kgu0nHcO7HfgGRhdDhmurZElPWIAidcEszCQz_vWjJludoJDl2xufuGT8MOkjpBsEIRco4CVPMVy Bmz_oHUQ1nUUKohdhCmBFl3I5UfDvgwA70BNaOncE1Bmx3PNWT24TvLxKho2Nyg_7NBNAGAsIGuH oJ7z7IbmvBzrJWqG2bRjYio_HKJDJUzNZqlRAy8tzV8IPSD3A2SEav87cwaCYn2zFmqV9WL3z7RY P2PDTZnZ8f.TivwXJ6Mjiwu0VYahNSsBn4GPErBDaROgiL9xEse.ymcw24ZypGKbTtK53myhHP0N jvm2iLX.1MI7CUBmXxkH4_2D.qaK5r2L85eluifWZmOEFG1LSVXbofIJjQnnIdomhhtlmgy06q4Y aHow8cQMfzOH.jqZojFRFsXmjeuyaepm1XyGewGwkxVGv7bOi33e__UEJHMgLiI89vlm2v0Q_Rac kSXohDcCBWaoGqmDfgi0zLnBHJZKDz9Sgm0Ca95BtIWJHIdBWeOyFh2cZWE2QrOhFNMJ2eCltdkP H4p7l0PjDS_J5LJsc6Fh2lj6UQJ7f.Ntg6oWrxpVB6lmjhd3I0sQOQZi6oFWIkm4OhE4._E0AGrm IWAERlq0ICfxBMYEbtrOOrXPxxBxjXujzfdh2xOdwMvDct22tyWIK8ODMQ5B6JyEU02dCq.kfzVu RtgMjCzxlZ6qph1nFEOTtU0BxRQIA1mtGVPSddVaTrJWeIs2PUWQWu3hVLgvyTraDg38yA9q0.hL hJixHC7_qL6X3LLqJQji2PWkCh8ePuWDx553wlGFqn_RUXOYwBZAZu4OmIuGxUVXi.1YGVtFqHg. 2X4rdMkdlY9usnquLCp7b1pIISGNW0_tmk730KUWGXun2g2TDeHydiHGaGjJbTW80VXuPGw3mfIx IXu3niTCRzT4Wr.uHepWBmXX2fGFkNnGHqEyMO8_K6zQEnWvSCnjmigFkhaz0OD1xY_5gQWp3rET bXirnxggPfc17jslbrH9352KsCevpRWmlilFMb6dLCFagybghvx3hRFERPDQfJ0Gd0Fnx_ZneMpc yvMZMEVApVqqiwPNmum_Q1xtdtVe6_S0dCjI7Lf78HCZgsGXOyAxMpuDlj96kgxeM5Jtw4lq8lWt ORn5fdELp10XtVmYHd4B1uBoh13ALjR0tOwPyhFBLWzcbMaADiJJBraz917r7A6eCpY.KQ.rqCJA VKkYssY5b0zLVgyAfnyWmy.cJjuxasmRTtn32UGSibVjgynKIiWzcY3VPxfbziFxVQiCtyL5q6l4 H.SWG2E8YAjDMefU3xuFdBsmxjY_g2ibEgIlxvHPubUmqyRbp3Ob7tRmFIyKwz1M0nWjTW6dQ.U2 drCss3HyHbb9MxvQbjIdc_QrXLZFIIftv2FruyJFx7KDX24e2vWH8Pv6BVg_y3DkQkt3jsoimrP_ 2xS0pu6riyL7AhOtibsl1gR.KuV2Zn.VsfS2ZwT6D2.mNnHttTnB48KvvucnwkgF.NWxKPobQ81H Jx..FJG7VPSPVjHnMfuUR5WHglL0EMfDXaawdvbbv9F7zaQDH6CZMfK0YF3rKwBH1hBPSLyq8u58 bmZnMdD0UNjrzeWeE5ITIL43tuh7J3JGIja3mnQNqtN691jgEcj_18gGLeFoJlwQlurWMMBdoGOA 0E8Gpuwmw5GsUFWMDrb3vGjaSmsw0thalu074CSFilTwH.ZKY2VYGfQHWJ6ThZsLdlydazzB4eYE 1sJ_beJJ7TCFWDwEUCxpo0lA- X-Sonic-MF: X-Sonic-ID: 1557c0c9-4797-4679-b987-c0c0087dacc5 Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:15 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:09 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 3/7] LSM: Two hooks for manipulating struct lsm_prop Date: Wed, 2 Sep 2026 15:01:46 -0700 Message-ID: <20260902220150.18586-4-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" security_update_lsmprop() updates the property of the specified LSM in the @dest structure with that in the @src. security_secctx_to_lsmprop() sets the @prop field associated with the LSM specified to the value of the passed security context. LSM specific implementations of these hooks to follow. Signed-off-by: Casey Schaufler Reviewed-by: John Johansen --- include/linux/lsm_hook_defs.h | 4 ++++ include/linux/security.h | 16 ++++++++++++++++ security/security.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 52 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec207..679c40a8e127 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -305,7 +305,11 @@ LSM_HOOK(int, 0, ismaclabel, const char *name) LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, struct lsm_context = *cp) LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop, struct lsm_context *cp) +LSM_HOOK(void, LSM_RET_VOID, update_lsmprop, struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *se= cid) +LSM_HOOK(int, -EINVAL, secctx_to_lsmprop, const char *secdata, u32 seclen, + struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp) LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 c= txlen) diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f..19adc19eb9af 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -576,6 +576,11 @@ int security_secid_to_secctx(u32 secid, struct lsm_con= text *cp); int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp, int lsmid); int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid); + +void security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void security_release_secctx(struct lsm_context *cp); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen= ); @@ -1581,6 +1586,11 @@ static inline int security_lsmprop_to_secctx(struct = lsm_prop *prop, return -EOPNOTSUPP; } =20 +static inline void security_update_lsmprop(struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) +{ +} + static inline int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) @@ -1588,6 +1598,12 @@ static inline int security_secctx_to_secid(const cha= r *secdata, return -EOPNOTSUPP; } =20 +static inline int security_secctx_to_lsmprop(const char *secdata, u32 secl= en, + struct lsm_prop *prop, int lsmid) +{ + return -EOPNOTSUPP; +} + static inline void security_release_secctx(struct lsm_context *cp) { } diff --git a/security/security.c b/security/security.c index 71aea8fdf014..1dec0037370b 100644 --- a/security/security.c +++ b/security/security.c @@ -3965,6 +3965,13 @@ int security_lsmprop_to_secctx(struct lsm_prop *prop= , struct lsm_context *cp, } EXPORT_SYMBOL(security_lsmprop_to_secctx); =20 +void security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + call_void_hook(update_lsmprop, dest, src, lsmid); +} +EXPORT_SYMBOL(security_update_lsmprop); + /** * security_secctx_to_secid() - Convert a secctx to a secid * @secdata: secctx @@ -3982,6 +3989,31 @@ int security_secctx_to_secid(const char *secdata, u3= 2 seclen, u32 *secid) } EXPORT_SYMBOL(security_secctx_to_secid); =20 +/** + * security_secctx_to_lsmprop() - Convert a secctx to a lsmprop + * @secdata: secctx + * @seclen: length of secctx + * @prop: prop + * @lsmid: which LSM the context is appropriate to. + * + * Convert security context to an lsmprop. + * + * Return: Returns 0 on success, error on failure. + */ +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid) +{ + struct lsm_static_call *scall; + + lsm_for_each_hook(scall, secctx_to_lsmprop) { + if (lsmid !=3D LSM_ID_UNDEF && lsmid !=3D scall->hl->lsmid->id) + continue; + return scall->hl->hook.secctx_to_lsmprop(secdata, seclen, prop); + } + return LSM_RET_DEFAULT(secctx_to_lsmprop); +} +EXPORT_SYMBOL(security_secctx_to_lsmprop); + /** * security_release_secctx() - Free a secctx buffer * @cp: the security context --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic310-31.consmr.mail.ne1.yahoo.com (sonic310-31.consmr.mail.ne1.yahoo.com [66.163.186.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72F4149E5D8 for ; Wed, 2 Sep 2026 22:02:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.186.212 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386545; cv=none; b=J2hrhifok54t87sVFc5H3U1BB/RqYKkgD84P+4X35i+luvptJrLp5u6uEbNZhqscz4zU+Ag38UOh1mWZusHds+Ionoq7s6IrTo1vSmhqUJje0c433ZfYTRUGdQeX/VrfDEA9o/VCjEMGQMD5ddWdDgYOBHKDjzmrOLmuyOBWT94= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386545; c=relaxed/simple; bh=d4zY/ltnmjXjcN3r0DfckvWNHNEg/g2aMa3mQiZA4Cw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Hdd5nNAL49jxxr7HaJdyl9ciHDG3SzZYO9yIAM9GamhRGplsTu110GNszDhj6CtE+dMOPNhj8jFIHqS7oP//sm+YQMjktItVh+b98ABmU2rl69JJf6p5tEyJzBP6w1UJVQqyk5u+YmukFTxSHQjhClB24bQXfR2Hht+GzANjbq4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=ayYjjUm3; arc=none smtp.client-ip=66.163.186.212 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="ayYjjUm3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386531; bh=8t0OQ77yaNOPEWl7EKKJc1q7r/apIJtz5Yj4MAKBYDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=ayYjjUm3K9ScfXOuxOosgAX46Dfz6naQzuvQ88T3VuaSpc6rcUu24JJgKl73rnS1QwExgmy1uoXNhhJG5U6mMNRiYF9KN42CGGmpfEimqlKl8mIDpm4SXsZ0KMom17xWMW+8EVrwkkrJLXEXiHr4c5P3KaxPPkQ1TQ5hq3E/YX+5M2VD3PKmVkSwL/Npvii+bAXlNjyFTZFCwzGYSvzduRZ3GoeaUlOMRKgn0E4QozGU07YMCVyao35BofrD8JSIgEIuXxa0WVhiPNlHGfsLr06/glP/kmIC0xQb2ulH1C38MHCwHogyj7COl04u2gpzlx3R7iHgbeDe4YmjhaokDA== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386531; bh=knvcAXfkU4H8ZRFZFMIhTAp6m6xqNExa9Vl42w+n/Ee=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=JJEepLfC1v5C3SFmSrC3opxP+FHWEp23W63g8LVsvEvImyI6VYW/TAVvnUUpuYD5o+IiqJ373tYMv+FuUUPxPieCgj+mzhAJtfRN1pdUV5+vIsk1sG77AB9a8fT63H1s//WvhpsxyC3srcP5hXxhtRyR9W1xrKPz3ztyllo74fDV5KltwE1N4Hqbnlaol1SToZtyIoR8Jpun+iDsE4Flqi+qux2UTivB4hkbK9/7fDHXSC3vb6aY3+8g+QJVHz89/n0nPtKRMsaJxsVOog0+kZpkQVmscbFRJUfdFkNtuSSzLVWhQqPreEwt76CropqArjjIALavvZvPW5DMI5QcEQ== X-YMail-OSG: d_zXfyEVM1lG_lj8xgjQEXV.a4t3xiKEfxGWK8IYdZ7zAOGKvhQRo_GYqZks2x3 VcliSYvjEE7vjuHZJ97QtG6vuRYAi40s_Fo6pa_K67qFC.RBAx_CFogMAAXC6McT34U3f31B1vio VGMiUS6QKlLQ4rQek5XcrKI2A2kyxD4K680KEyRzFjhgByhFpAHnZ3FWMhd5CnuHehL8PgQtSIGG e.Y9.fn43dxLm3hxQISJv3vJzGlnrAgB3.seaArncXCNpnX4DpQm5cww86XqE7wrj1AjqVt1mC.8 sJkjjZRzxTX53tygrHNcX3wkSlm8fQjKmacOXnJHb8MzzsP6A6xj0Qs5k8zLFXhzP2lUudr3jiMk Ao3Q1.cQ32nq3bGIFYAH3wGFQUSj4NDA3Zg184hKOQNU06whD9XKoNtEYQkNOwjyygS2WzadzR.2 YpQIN_Mv.EmY2H5OtQVVJ2fqEtsZ1Zpczb1QAocL7ndy6DDVs1YeCiUHdll6uVoL_gfzvRyJFeVp FGFv9AtbU7dy5jiZZkzG_vnFh1w6ijzTqq6GEhmYRa8JGEU.VPd20iRvG1Y0g8LNKfkEQIJAeGd3 f2aGcjvJ.Ff884pLZkEalfVqM7Cw9HkbZS8aNX0lHlFIwgmlS1z7Ws.mmKoTH3EnDNHnX630asyE NCbnpwUp5f5ZSxiQXTMZ4tt3HHs1ibsaVODygv2LF4su4Q_Y9Wc2BARZfnHhxM5vTKrgKLe.VyTZ qnHcXsuM1MX_sQ6FClMjkM5awSGoGYnxW0Kayq8SyQeDrweGzFYBGc74ohpbpNBdRGPyatL1.REr AIZwHsIyVD3xPEmv83P8iHZTL5O3XvmROf6DhFwZMETrcEW0EOhiPUSbMp5Rv2_HOxyYLxrIaZv5 KHLvmt1h.OoPBEorGUDzfuVZiIZt7BTRJ_.RYPcddq5IIk6LsAq5E8rdp9JaxmKvYODkX1B11K0Z PbrfEjhM4mh4kOaVF_2qpbDmSleRNRtexln3PYavbqKfQlugqZGfaVEXCzNN72rUFSgQzxn7qNFK dRZzQzJ_Z1_517dWkHgiYeqgwujietgcWGbLw9HttbRQn61hF2ZVG8VVDnlZr_sAc6pPbS.ldYnD AIuWALxP6WA0qqBlAEINr_EFx0UvecyffBLaTjR73R8EGOgVxOkLdt52fkvJoQ4ycvpIq.VPZSDP TRch44CVAiTKGKhImMSMKuQGv_NtmPXn_Tcr15_sit5vkDfrNAQmB5I5gCAaDoEKmKENGkfGwBUm PX5.0bgRey.o_pp_zno9FCwXR7h7UMpmWpnna41jLGqd2AupFCeE.9aFLqRkqe9OdNzXSUmLlI9U 3TDAbecGYq3ZTBIqWV.oCjVUbu6lfkMK2v1XoFbGKczf_nmpgdoYhOLYnmEyGYwivdMZswsE4FKw BOPog7nKxAy15JdBAQSjLECj5oHIpThdijG2IbBdFjHnkYXKJ5bxBEx0Xyx2R9BENhrsoCfNMClF uzyr2jHD9.diFzDN0faLkXgbQTmZAimh8HtER4_BRrG74gKVIRpWVNQNW24iJDn42zr2doHfQiKS yExryH.9PpOPGpMTEAvcEV.JjNVCr0JkeXdR914vX6qlOsW8.oW2laYXHGGMFJmJqLk8aoLPX.36 1T7ePWmOYT5XLaaFjRkGlbvn8uw59hBGj56mfBX_hGbt0.zztVil2Qe.9znG9LtrICV.n3FJ4xKB alI7NCF3M10lUAGtTpfJnLOILQ2bCYCaOv9FLfWn6obZ2gn8deL5.Fr9opLDC1lKAGAPjDl0JcRe Sgabmqtm2JTeMNheoTFsKZRbPDiuDXSpImzzrjfgZxUZtUa0DhEYH.w.iRyP8iE4.rQA620chCku d4bJ5TplxTzfuFOjLrWg.YeoX6qFhq9V4XR2.xIMphpC1szI.Wyw30_7X1DVJNODh47k3_uvUXdr ZDBalU_YxgWagjapyUbBaJKXkSb_ak67DOis.Zk1YBLz2th0VaWcAVGIsnnMqs.oc3gm8JBhaaCH ATL046fTOhpFXrJz2Y5kw2h0xi2jQAQS4VYAM1FGeyLO_f9lAmxl3dcM9zb1acg4V7kPuGf4WxEm c3x6ZnMmMmgpv0RpMyNG73GfpmQG4o_iRzXL3tE8nl4QebB7EFzYr2aZY_.jLwF41cX68cKXUoDH LrrfH2QOmMxijLzZ.PCl9YbB_mPLjGNq3SPVwJZSwPWyAb0dWIXFzpPnPcFUI_ytwQGLISEFV2lx _KP6Wvy2zYbr9Zfz.Y_3AsWvzAHyHOCawXAqkj1jGE0Qf0hWOEtjYTnKQYcastNqLZ6CVwu3RQVY VfVLwCvhl1hKafqDOSwvSXIIR X-Sonic-MF: X-Sonic-ID: f774f129-ab3a-474e-bda9-a787c86b58a7 Received: from sonic.gate.mail.ne1.yahoo.com by sonic310.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:11 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:10 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 4/7] SELinux: hooks for secctx_to_lsmprop and update_lsmprop Date: Wed, 2 Sep 2026 15:01:47 -0700 Message-ID: <20260902220150.18586-5-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/selinux/hooks.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 18dd28b2bb13..12614478b638 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6946,6 +6946,13 @@ static int selinux_ismaclabel(const char *name) return (strcmp(name, XATTR_SELINUX_SUFFIX) =3D=3D 0); } =20 +static void selinux_update_lsmprop(struct lsm_prop *dest, struct lsm_prop = *src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SELINUX || lsmid =3D=3D LSM_ID_UNDEF) + dest->selinux.secid =3D src->selinux.secid; +} + static int selinux_secid_to_secctx(u32 secid, struct lsm_context *cp) { u32 seclen; @@ -6964,6 +6971,13 @@ static int selinux_secid_to_secctx(u32 secid, struct= lsm_context *cp) return seclen; } =20 +static int selinux_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + return security_context_to_sid(secdata, seclen, &prop->selinux.secid, + GFP_KERNEL); +} + static int selinux_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp) { @@ -7694,6 +7708,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { =20 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, selinux_secctx_to_lsmprop), LSM_HOOK_INIT(release_secctx, selinux_release_secctx), LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), @@ -7812,6 +7827,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, selinux_lsmprop_to_secctx), + LSM_HOOK_INIT(update_lsmprop, selinux_update_lsmprop), LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic307-16.consmr.mail.ne1.yahoo.com (sonic307-16.consmr.mail.ne1.yahoo.com [66.163.190.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 939413FE671 for ; Wed, 2 Sep 2026 22:02:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.190.39 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386545; cv=none; b=oi/B7Kbmips2XC5vX8uPZRiz7VlsGF8XWJtX41qBXgTrbu9FVHxYyHUsg474jvB2n2r5wJ4DkUPKyPFsFrYIFSxMvlMO4l3CT+oiDf+cfAc27ion5Py3SorikiFuwE6GUbr5SyBWZK2PVIfixOoFjTVARO2bAQsYc2HRIYjnExM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386545; c=relaxed/simple; bh=l5xZJq7SJIQbEKIdMk/8CyU82z95S13RHM4M5HNEOB0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LUNPUoMeZenJgaQOUJLUk5aNarEN1SSMOkw2czdY5x0q3yoHr4CL2p1C8jQUrbQXAkIjv8sudnhfpzWRNlP82+h+0cPG49RhH/lHA5MOGOnYOyRC0Q4pO5Xo0nkHnEfQerxlCpbPBniPfBBWIENhybel2zWzfhrg3fUTOohKHd0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=um3r++hs; arc=none smtp.client-ip=66.163.190.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="um3r++hs" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386532; bh=spL1TCRGv1nTSaQv5qslf2f6hMhi+lllz41KcBPUl+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=um3r++hsjViMIWBa1PLlvtzqpRBPt4Xhl0SxhAnKNZzY/SBvEO8K+Ha1Ik69CC0RFeCbFnkAb0fhEgGtsbpWk0n/XX62j35ljo1XBqYu8RwuTp0kBSGL8foRi7Xo6tHIHq8gmIXPin//0a/vrmIYcyXsGOUDStiORN5ZyzeQcbD7/hEL3EX+2NhaYr//0D6pIOqFSKX9EaD3KUFV/pg1XFUVuQ8pm1v8ZjKKcoD7YpYb6lxuggZpI+R9jUx/NvG2qgFBad9yn01ZgaABC/i5rvgpWkuI+V6k/ACoVyRaYyLtOFtn73FRIG2VsGOFC0UQx7WDsBb3RV59ryK+n3TNPg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386532; bh=cN8ShmoxI65yHmoLfLBAylj5tbyZqwDoT/tXDnNMj2I=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=DtJECu6/vxMXIKvJIYpn3NLOrlQBWAuNwAj08tnpw+Cwh5CWEWv8Me2OJ80defG8tdF5XXmw4aoyX/NsraJmSPGsBAusfWYEhHXoT4piMBJPcRWWjUi1C9DB9fw8WDelyp1wIIYipl3ow872zgS2Wq/Uv14sHmAL6mojriq9U0EV4sZ3GKOVhkXXmchZc4T619SF9zU9K2ZHalfImLbmq1MM2bqx9xexQmQaqoB3NCmIDadfyVbybncJ/QAz3vkMpA+j3j1YHIzIDN+DGFrF1DxlT7D/Bb1RWYEO4TJMrSyjjaTOf82+G1oi2dyGVELL8oxeDaKVB2LHdfd+xh2QNQ== X-YMail-OSG: YDLfpBIVM1kCJ26EXAcrQeFbqcJn86F6QOTVHA.A1Ks87lZCc2cyUwuSyeGQf5i uDKPNeDeGdeusHC_m4h7XgFFL9wtqCoIhi3wPL_sh8y59PwlKzaKG_.Ktf97.WQaoOFroXVOQnPg n.OhLzKdr8UDKCGALzz4uB7YMd9j3R7TOTMFsz9F6swUm1FWNwxQUO5gMNTe7_45ivPQGTyNJu2q bwQkhsBy9ykRb4LBtExTDo3eJA4pcK8KG_EEB3DekRlW965mh84qCc68p5r1rnidtNwE6MMcMQtP uz9_ZW6bkE8x8np2eAHc6mjpqme2mshLbGRFCZ0.Ph38XGct1lRQOMFUcPOw5EX3EKY5OCEisaXi 4C8fWC8NY7Y5Gj_tEV8xX1x44d32MhLP.ShG_RG1VVuVCbORJIFPBG9n2LFyKnRTXO5wVs1vzLRJ sNKfccfWSNbEtC4YodvQjblwMmmC2OInTm6VMEXoJvck4YBtGklIQvfbZ_j5CK_znmDstEN30PWF EPEG.Zg4hCYmM_rUyrI8KocULz1bMHS5dflWfyJD2WO9kPuhVlAZxrT2w5KUC7F9AMUfTLctEBK_ 9r8CKa.fXurYVGkW827MQO6thjZ7nUrRB1.Z.IA5BJzcMKePub0gJ4D_L.PckkEU.WfLqFGRC_BQ O89c4zcCCUd.MvUzDYcqgZPNiTUbzk33IQi7jE7bwq04ZE7Lju3Bq_CY0B31_XZlcl8J0MtC6df6 u2Q1Ovds8emd4qXBGKKk2sFeFH.bUsX0W9topRLmrnXS.ZpciWMFBB0XXzoD8Didirmo8xTiMI8D Gmhjsb2OPja8RKgxhWI2BnY6D5uxnWO0.htTmVoewTjleMJL_3STCRHmbMxi.HD52wYdn0GXulw4 3fryMkeOVIKxipuLc2iCg_B0hyyPfUP4MeM5OCxhZ4dtL.dQCDk1LkOz2oqZBpGPPX3DpOObm1pa L0Vu5B3hjyjjv1iDlKq1W50hgYMsAC01vBs0i4GMhvbDXTzyiPKuwTONjAxbOpmwOfTSjAjlobgM ZwYuZ3fRrsbONbHwPS0ybZxYQeS2dA2IoQi0JK9L2_Gwu0fE5vfCpbAhPXPc5WAF15wiuctkpvf1 _f01aOjRJbHswXY5z0sACdTEFPUGmioSnlk3jPu4oUccbu8Ihg9p_rlwJEFDFgmZZMjJUdGwx5pd dNEiCaOnhuXIuXbT5GclH_w18Vq6KDGrhixTxvdESivJl.iRrV4SCvPrJmsP2a.ribw4bfV9NuG5 24sqZmRvqMWBPXeJnvSE0N.Moqvsnk14_0v6mbtPvOgjEyxFJDyFEZKwYQ5B5jMgm.399TQWAGKe MQq8qv3whpvxYW28OSz7BM3Vh0mr7dp9TsqV8K5DYhWjphuvzNGj44ILyDNkz_Sc2tZYo_BX3L3J MyJAU9ru4LEEYQFCzUVrGF.cOIK2weMgPRuXgNd6MuPZhOOzDcFAKyPo24ZYJsTifIRL.766x_G. wkwD.E_AZnkv4Fpc0y9OPCY_mTDBdrndQ5oS51ukPQRJd7TG7ptpvyG7Or9AdKlfnGMMfGD44fCb Q9bQmLtDc84LptpfpnQK1ueXzTlpcLPKGrTEL6pEkv0nGYdRXIjm0sE2wM9kF7IH1MI0bGhOZKUS __AwlVP2YnZ85bbAljRD5sie.FPbfiOne2G_Nm2X570Ik6fRPCW7PC0eivXvjhIS1SinaJkZAjRp m.VxvAbgSZRMA_zQOH1sfQpC2VvHrbBoxqGt8yY72.x5qOeG.UOlVxspeio3MJroruRl79sRVH_B xL8oyCzTuyMz8YNLvvsluGpZP0vPWQXDIex1s0emR8U3e1oGfkpP.gQa32kiqxZCKv.DaHIKowhD OtJgRbwzE9waSqxYhceh6GjSbx0tNwKazn47xbtXZLLLDbxWZFgfbl_KNDnMKGQKv66B7cvEMKHw D_Ujz52aIOEb8xdFynIo6Cq.VBM_pTcQoeA9NIo9mUWdlnrcI0hE53i6mIr_T.TV4aJyJLpPNbLc JHyTp91XTYPhEgIlnscQ0Lv1mv4VinAzsnuYAjgLdVgzD2bXLnxDI4NfWqroqnnXAA.NvDy8tLIL _V7ugqLvKQqaJQ3YP2r.dQRjpnshhsiAPD1WbfY0atMKDOugFu6pJ8uA7QsVvLDJhO2Me9JfRUvB k0TQql4aPDbOsb27ULGpK5gFRhcMqb0Xu9dqBzZW1hmnvvX.rh2Dz55ozOCWxUZgW4Urmw_2t3Jo lVVOtm724fokJuvIz1TEH8K2g91z3u8ImdPsWdV_Pav9BinAQhtO73B9UF4Dg.CiT2xoxwP1Yuj7 lsfColH9X8xrh7mz.KJFGek8- X-Sonic-MF: X-Sonic-ID: 509315b0-4d28-4580-b516-88fab8e69a45 Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:12 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:11 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 5/7] Smack: hooks for secctx_to_lsmprop and update_lsmprop Date: Wed, 2 Sep 2026 15:01:48 -0700 Message-ID: <20260902220150.18586-6-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index ff115068c5c0..fcfadd5d9994 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4909,6 +4909,37 @@ static int smack_lsmprop_to_secctx(struct lsm_prop *= prop, return smack_to_secctx(prop->smack.skp, cp); } =20 +/** + * smack_secctx_to_lsmprop - add the smack label to an lsmprop + * @secdata: smack label + * @seclen: how long label is + * @prop: where to put the result + * + * Exists for audit and networking code. + */ +static int smack_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + prop->smack.skp =3D smk_find_entry(secdata); + + return 0; +} + +/** + * smack_update_lsmprop - set the smack label in an lsmprop + * @dest: destination properties + * @src: source properties + * @lsmid: which LSM is relevant. + * + * Set the Smack entry in the @dest if appropriate. + */ +static void smack_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *s= rc, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SMACK || lsmid =3D=3D LSM_ID_UNDEF) + dest->smack.skp =3D src->smack.skp; +} + /** * smack_secctx_to_secid - return the secid for a smack label * @secdata: smack label @@ -5269,6 +5300,8 @@ static struct security_hook_list smack_hooks[] __ro_a= fter_init =3D { LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, smack_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, smack_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, smack_update_lsmprop), LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic306-28.consmr.mail.ne1.yahoo.com (sonic306-28.consmr.mail.ne1.yahoo.com [66.163.189.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3974480947 for ; Wed, 2 Sep 2026 22:02:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.90 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386549; cv=none; b=NhwmVlbQ75K10M+guI1xMuURQ9LuXPlxnINgUwpeZ9rMVQ99kx5DmL8sJk2Yap0v33WEwbISdpJmtrcpnvHdE1Ksr86r4UT0rj88r+tqZlwOPsCa0xktO5VaExV5NC2gNXHhxd/rFKNE9sbOKLo2bQqi8tciT/8c/lDcQnJG8zk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386549; c=relaxed/simple; bh=muebN+v6qk6ACGUSKBTi0IBPg9qD+4TGpA3UhEWJXTM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sQcYrZ8jttxND6zAHxZ6N102uPsgd/2X1FsWBA2RKqZdxjrq/SuosN6+x7FoMmi0eMA6E7z7icuTJmZLC8TKUotTjbM/6rzUPhXnMnbgEgTveV0oGbikQCBKKAzH9qtUcsM+dPS5mXpz/LeeIozGmjlt47u3vyTBJk0pyTr9u/Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=IIGu2lot; arc=none smtp.client-ip=66.163.189.90 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="IIGu2lot" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386536; bh=kihgJhG3NGCIZmRbXk8CDq6KsRQabfDfAuGQ1/19lsU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=IIGu2lotfxm95pQc4VkndM8SdfUUMIMBUpQbCb6FIgmpZR6X/sElZh9d3TbDmZiAoNQyyVTyTdE42NDVVomvDEeTTP8m1MzdntphwjJEn8Qf+gW6tTTg97uPxn1bsgC6JlTzYLBLl3lBgV4ZoJczYFqeQhix1ooKoQw64vY1/HIGu/RLKZgXH16x+3mnnvqdCfXer7eA9oILmPlKFnCIvdA5CUmqcPh1uSxlmgsDGf4aORTj0SJ/dRpGEqUUSKFVNBNGrTxraJ+mbC/vb/1FoO35+nOwDQZ3SqYSUSvn11y4fwoS56kYFhVUohSLWN3GOfYKDIQ3047794Oa16q1zw== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386536; bh=pbKP7c4pKCATgiLZO5dCoEuBFGn3ODDBqYQWJLbu9cS=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=AKV8qrTn73DgynDukQzpJculZ/jLGDHSPL5rXSEzV9ZLMCGa0vGyXgFL2p57z0Eq9a5MLde1ZsmprV5/QfJA4Ch6KWOLrb75Fxvl2oJUt6YAM8/BFQfVF+5mP2ZWhkHOG4NfWuPROvYsHuT3Wbxv2p3m1u78XdquoGgKDKueQEYoG0azUqeNtiwt3CUh8kxIXOHVsW3VcH/XA+uYO9Vne33l9MtYuupIEKKG4Hlod6SKOahCKEwyqh1/FUMRXpoBMD4U9Fy+qJd8T1LVOCVzzSu853Y52SCrXV8/TBJULfUWbO2q/a8Jh6QQ7P23bmaAUVHm4lD58NTpgzstXO2XXw== X-YMail-OSG: tSZpOnMVM1nOASBlswu3fDZ9aNHeGbodvoFoL5t.XShWlr79by912Z9GmmfgOH8 Tl9CNaegwIIwY7QDI3HK2rkeFUi7aNlKk_aDWbaHV3UH_IPr4aYqs342I8AM4pY7y7WVt6ssBJP3 9smzBG6H5hWVcKrvFw0_wjk2T84w_7h328MhcIqQyf1ORMmlY2BtZ70__92YKXHDd9GxW7jpe1OO BlH_fwrPHvgBAoTn1Qi9r3CCiwP_dUUGOrtiCOmOc5LvxZ0UBiw3Ws0LQ_loHd6fAEO881I00Xoa K1WYFXPV.sZ3iNlpZpQuQI8t0FLsV4fo9J0kwtIwidm3sRjWCmWhuXe3o7hy_rfqLTHeTGKZjPGL oiPmGzFkadeqKosS8eKmoHX_3N..rWgB3KCm_X2GglfbrWaCcHKapas1Zy_aF9SVat2d2btV2sIp 8fcktunM.p4.Ys6bkZn5o_u9xWiVtkpA6Cza27rgoCG9zYAmJdxby_0Twfc1QNmllm_gXVX1KBrA Ml0ybD1WmifGK9cJ3ELCGwGnoI45qRZ9uKCYTXnWkXrwA9r8kZQkc9e5O2OU6V810ALSi4ITiwRD YU88UX95kHhQAZxhy76GbbZ6HtIwojJEd5o1j0GKvsdbrFOL2hqtcSWlMYcASBA5bvFg0Cqc9SR8 rwdmNHg3WDCtk5E65hmt_bChS2b0eTqcCBzPFqg61jlayRNLbnalyLNogbSrllD._Tm2ffO0AQCL xu5vU.1hCX1AhWfXtATQuGqrCN_QXw7.h_Vl8NQVkSqrXDhdtEWVdXTCFRcVD2vhtmlQCv7t813Z EI26pLBntJx1lepGS0N0LQyVfQ1712vMAmFATqnv1dKGeJcazFyHACP9LMDtAN0yk0XecMLPH0X3 GxCr4Zex92ffY05vCoUSwj_JTc.aQpFWwnSJKGBkoj12wjOPF1qMnuJdX.lH489k4VBon24fyk8C b.jj_7W9cAC6yMzBuzwikwrsIhAFrUin2.KfA9wFAwwUtcZLEC8Z_iN6vhdwD_tN9mLq6cOZn6bM bsvhvxo6Xn0HN6u3_2uH7hPme5wkyWiuk58t8m2GjkiEBv6X3y4A826jdLQKck7qaFxlR8Bk5PDW ktJlb22TBauYcNwmQ5_nNjSq1DqSpWulnfh510feFnI5ITFafHWWwL7dhSVvM9im6sgiAjUgo4Jy Q853h5afwcbZcN.XozVXA_kDHEFw1RBafZD8zssb1LOc6XBOlR7d8ugdCDj4AEMcdDpPtXHzOVrk .Pyn7qFYw2Fm2oQ2JYtyaKxvRQwdRM6hr7_jipMr728XeAtBwRj2GFEGqw2B4lwdb_vzmlAh1HRQ 5s7O6K5DFmPX8EzQ1pWfNm01f0NkuzKk8cs_4LqPIhkeaTJGmh8V2X7SofoyDg4q7YzU9n3MxGRJ IgHcvL4ohhwzmBKhCYu7w7S5IWM8AA2mJOkHg1A6QHS8RmX0ApRfHjwoaqPiY05PE105Etre3SMK ebZjC.gQUP6L8F4bE8Qo.anlWY.4BlOK3_.OOZuSn0ZIpWttG3mY8gt.SvWbU76LY14Vq3P4ILNY gCcN4Y5M88Ic9yNydUaNo3LoTYzqLGEKm_HcVLgnSRH_c5Pn4BT1S.rjO60M5PQhBIVjIwyTfPF6 B6Ty9gumh1jss0cft8zMCCKaOU7WPpAoQ1FNUzUHqLPnuRGhUBCviM8QqHfKIRcw0Zah5q_fw7np qIm_nOCqGr_VdDgZlPdmQl5mdukM_AO7HVRv2fGMT1F_vlFNKMcCttVmVAjo5PFSKmXuN4TCw1.a x8fc915p9opheeJSzJbnMVvWCxMJVPrnaNqnyyc2NOa1MM7KGjseb2vyk3DMGOgkOJrEARXxe4Be VmTewE_bQ6ucJlHMW7u57wgyf3FGzAC0sVU18koNg5UiOX3pMOR_QaviCiRuwTSY3W5xM4OTZ4dz 8ygz7mmeFrbr1EbFOGr_sDeY_m27ZOFHDEi0FSbmDO3j5FZIpM6XdK03TxL6y15DDsbeIaLK8bs4 nFH0ylHebIZHlxFQjU8GzEv3i_seLXX2K6S_Tt2o9Jz1PJc9sPuJWHmKF4vM8G4ghQdnb.RZXorc liBJHvvHIbvcAzvamOL9m7bateb4rEK_CWBEjXesWdYxw4ny_tOlvRVuuVpZIyOq_34XiSwqWX2R lhWOSHpAoYCJLTkZL.7HmIS4Z7V82KuNpFTVbg7uTamGT.lOjdn3qq_Dv2thAI7V_mtNtBaiN3Og jcI98uYgNtZO8Ln6TBZWEo64iNovGSl7sT7GRQRK3pUAHJF96NTngZo.WoiMJ8nPgC5clgYX6wK. OOfGKWKmOQScvqPJYOMQj6Hg- X-Sonic-MF: X-Sonic-ID: cb6e4167-4664-4d7a-be4d-8ab0e8369463 Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:16 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:12 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop Date: Wed, 2 Sep 2026 15:01:49 -0700 Message-ID: <20260902220150.18586-7-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/apparmor/include/secid.h | 4 ++++ security/apparmor/lsm.c | 2 ++ security/apparmor/secid.c | 21 +++++++++++++++++++++ 3 files changed, 27 insertions(+) diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/= secid.h index 6025d3849cf8..ba7adf2fc09e 100644 --- a/security/apparmor/include/secid.h +++ b/security/apparmor/include/secid.h @@ -28,6 +28,10 @@ struct aa_label *aa_secid_to_label(u32 secid); int apparmor_secid_to_secctx(u32 secid, struct lsm_context *cp); int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp); int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop); +void apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void apparmor_release_secctx(struct lsm_context *cp); =20 =20 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 88d12e89d115..1f304b88eaf9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1766,6 +1766,8 @@ static struct security_hook_list apparmor_hooks[] __r= o_after_init =3D { LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, apparmor_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, apparmor_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, apparmor_update_lsmprop), LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), =20 #ifdef CONFIG_IO_URING diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 28caf66b9033..d35fdbf074e0 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -106,6 +106,27 @@ int apparmor_secctx_to_secid(const char *secdata, u32 = seclen, u32 *secid) return 0; } =20 +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + struct aa_label *label; + + label =3D aa_label_strn_parse(&root_ns->unconfined->label, secdata, + seclen, GFP_KERNEL, false, false); + if (IS_ERR(label)) + return PTR_ERR(label); + prop->apparmor.label =3D label; + + return 0; +} + +void apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_APPARMOR || lsmid =3D=3D LSM_ID_UNDEF) + dest->apparmor.label =3D src->apparmor.label; +} + void apparmor_release_secctx(struct lsm_context *cp) { if (cp->id =3D=3D LSM_ID_APPARMOR) { --=20 2.54.0 From nobody Sat Sep 26 09:16:54 2026 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0130A4A9D55 for ; Wed, 2 Sep 2026 22:02:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386549; cv=none; b=YM0v8Pvly8OD3mWfDbHBnA6NGJuyfwrAHTn+dGnETjJdQrYhgjucRiNS6drQVm9Hi4O+fubwEHd1yZeWH60Ff+LYCYkr3JD99HopabmiFx0BHu5sj+3xFy3mIVNPiVnzmU1FxbObmMLzKXQEd634q+n97GCD+jkNpACYW/QrFE4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788386549; c=relaxed/simple; bh=iRmlw8w8XT9vwtW4Z0Pldyb+T99fseiS6OsFqJB479c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Bc+Ryo2omYSR/LTNC1r6xZ23/cNSup3Sib31K0S+N5EF1Zg98meSHTkj7igrK9jcpbVPXsrtWq5InJtrK0HJqUUMHgW1SBPTgf/ykcSvU0jtQsr8Xp5NKH3tVgCHNmCZcAwi0FK3uknPK6QddIkYlJzf6/OYpohkSuCwUlAUYuA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=Yt8/2IOl; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="Yt8/2IOl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386538; bh=wT4UgdY5MDTOeJ6Ccerwu8nAX1sfYB5g8iAb35ivj50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=Yt8/2IOlBPZsl6JHe5Qi/HKk8zckskHhjJCs7yRJM9CHeCernEbgHg6MbO+dP1hKE225c+esqOZi1GCQ6UVzrZ6V7e8k2G1WfwYAaQYQggouevJEpSKsvVWFAhZSif4d25NgrzlQGq1DSwx9FbiQ0iAYr1s+ZM8u2B9NJV53f02XjG4anxAJiaZdcqszeQCL5c+U0DPMBxtsoR4K4V1O7AIVX1c1pwfdv77d9logO5RS6a89CGmthwD9+5Jp/CDihdF4zqY1fTyfbHaMjCCDkMSBrRDhxN7TOSkFgI3abzICAjIfggmUfoEJoCk40JCb6Gy344It26MM0bNaXXowrA== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788386538; bh=hkYtdEBctGjrFlwt72/XiIizrJD0L4XJ/fE/LlfrQsi=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=ng46LZNmvcKqJSPsHX5kBTzch5/Y+MbAFxNP3AQHE3/5v7/OeBfw4dmImw3ANDpzwVYDFbju5HMeAXRqxnApk5z1ntDqL0yzEYQefT4Zw7+90NfeEfDpq8oF6J4daGEPeVrNmqWHmWDzZx320rRTC1rWMdH4mH1mVMMrqVjuWqK41J2bS3vCO2I5oq3/DiYYnHxAGjszJOxhfg5HSUIvdzPANtipc3U7S3jkhd4j16m0OmsqdBNx5/tbDEANPx4z9Tt31Ssp6ErDmmhMn4SmL0PQliVSz5Ll1Kk2Cj4WLYeXnI7k+NArHAbum4ATL+/hflrNaVlWjdOUtPNC/dbsmA== X-YMail-OSG: O4Nco6gVM1maT00_1wYjfmWymB30XsOrgXFgFrIuOKqc1UQ.E.hT.1qy0ZoMwTg h5v_QXNn_r2k6uqmtlt6s_J2wrxsFVqTT59M1aCsG7Yq6Z1VMhxEU.jMTdBhwXWKb.drpDgD37EI G9eKQ6A_9gybPyc.X3SnVp_c.p7scaB08NINWkzNSXusDMRX4Nh3ON7Yadd_lRxoraRfs8frDVbI H5svNEqTmzirAZGWiXDveWI1FqscwyueKw0XPb7a3zdtCqwaBw2VShiBFfAQSkDFFmbZXJc24IYM eO3WiIz3DFTpkG_sWQC_ct6Nxw.By.iITtTxk4Vg4NPYhcor_hF5oHYzq9961NurioJu135Dkbq8 vHmomaXygjf2JCiA36u0lZ9e7xgacXovRFaM345z7g2GCL.wTZ8hxNv7cUh00hQ9863dlRSHAaju yWpNExFdobbn5LbJ0adi6vKyYQInqsGaB70f4XymMgrf7byZjnjl53yOCVJQJu1FCKFMA80EJxoC iBq_N4OM4b7BR6.4DXn7963fI0a30QZWoW0nPb1KotBn8fO2keF6EGMbtdq_UOJu4gN7GG2mNLxK fZqtPqlzw5CgP18GP1BxfrGyJT4MhxIWATWt85lBqXTUfm8v66Dn.ltgMIKzC_B1PO7B1qF1eLRa 5rpZN4mIhhZaVt_mhelmX9Af4QFs9AK2ThqU.IWiOjOJ3AdFh_w8_hn0D6msGfF_udfU4T9wGYAh MbjTWi2oXrDXHFV9iHLsdGAiHfMTEQXN7ou3wrW3z3HVcTWyxSIGBt83_f5nq8EBSBG_lJa4PV2A ylqTGvhgzWB6NkTV6FWCPZmsCMYOjMth2YeQXDptKjKWPuECvdb7Y05A_4KELfbgaNTPy88INeip pOdCpeLeidSFKafMxBby9GRVPpUXlX3Ns_qYuxxHYjhKc3Zec4UwgNLAiuGsZFd7haM4_U7efDKK 9O76tvyRkieJtaxz5YC9usHYpfNfJr7Oau3ABI14JRNgY5ce9xvMGx3LLmut6n3Gh..7VrdQTOzZ YiLoGRlNybSm0Arx86NE8Ug6VOcKUhUPcsbH.FSsVsufkI8H38j43_K2ykT6EMFyRiCQcXAaIIvJ tsei5rTPnL1Z.Cv7E3cVcTd54iIM7BogT8QWNE0_EkMkca1ef7BKJ3qb0gx_hK0FzRPPkg_nhxrq caOSpHRohq9xo9eE124JDjBGjsdmQk5IcRt9A1sKD_rZEdUg0ZShvw9r1PNizykF_mkOGwBIN_75 9TwaFALefH17LYXaqPhmARGiSZSq1RJJaopO6TnbcWtUzoFbKwUGRjGj54TWt1pce_HgXDSrhSuT B30x3BS7CZWDypUdQDLrVuf0NgjJ1QNSlN28nNCyrtdSko6C79F7ikRJF3h8aP.ZNRcXmbkG38MX cGkguvC6Ti2PkJ3In7iWcIxhOiEAH6t5Wl7lma3ALUE6PclV5J.UYTnh_VORxs3aLugjMQ2ik6Ic JjmLhBGW9WhHu7PIo9zx7DdBXIHGkr8FTGrfhjVYyaLxzzwnDgbQWwInKrXjon6SDkm97.Sw5A9. Z1gLBzI6tLNlMebxJBMdRVH28M2ClsVw1dn.HhFA1X7cTNGxwVhOoQM4B9bimMkalb1HznTMLiT3 Zvv6hMgYIp_oBpjG1FmyanMNN1g3WRyf3pitZeSzD_QpEUqrC1TKydtjt32MwSC2507dDDsUuetU l3AS1XsNgLTVuCdAEowvlLvUdChFTUX5es3AYfmstJZWFBBfUV3pH4qFNrJA69VdGxDjxPq4qj2E pnOA2HY8IFogf_0F.1i6PfjJI.zyOpixWueDeBJEXKiRqmzmn7WO7ERmjcMcApPMAH1zK6VIOGiO kayJQzlXYuVI3eUrGLbSrkKiLsYyhK8haHSCChVq5sSzI8XmVQxomeKv9skXVupyaUaQ03SJEetb 732z7SHRCPXvOo6SCeIk.BZSyFcIjl42FdznrZXyJNhWEj.Q87h967QLIGDYnSQ2i8NPpnEZ17yW 0f6_2y40pzpfk_6.gDIszVfFT_LmLDOCHjAl9Eo6uB40vdKvM3P673O0drjp4wZkL1DoyacjkFEq 1iQ1oCdBE04KKpIh7xPY_WUkgrednorNYdWYgFzP.vvgcjTbBWMGm6B7BUX5moeAqQtLQ97tKScX gU7cHKEFQiVso6.1SR883eAC.TEgfBd.OPdUC5KGN2LfHmiyif97iGAN2upvfyGeM9tosQoIHXgd Ti5ktqKJUe01Ei9ZAQJ2FvF9iS6u.GEw1Q4ZiYQZNkGE7fRm.3hSxQdu49F.YfbY9L4e4mN.7I8G CudvsMNqN4M_31I4xu5Zy.boVkF_eJdU- X-Sonic-MF: X-Sonic-ID: 17f4100f-a91d-48d9-a8d3-6a75cf04a491 Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Wed, 2 Sep 2026 22:02:18 +0000 Received: by hermes--production-gq1-678d9dd684-dljdn (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 39a905a7360d4d1389754a332443770a; Wed, 02 Sep 2026 22:02:13 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH v2 7/7] net, lsm: Change skb secmarks to x-array indexes Date: Wed, 2 Sep 2026 15:01:50 -0700 Message-ID: <20260902220150.18586-8-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260902220150.18586-1-casey@schaufler-ca.com> References: <20260902220150.18586-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Maintain a xarray of lsm_prop structures which represent the LSM security information passed via skb->secmark. Pass the xarray index of the appropriate lsm_prop (the secxa) instead of an LSM specific secid. Allow multiple LSMs to specify their components in xarray entries, or create new entries as necessary. Change uses of security_secctx_to_secid() to security_secctx_to_lsmprop() in the netfilter and iptables code. Change security_secmark_relabel_packet() to accept an lsm_prop pointer rather than a secid. Change secxa_set_secmark= () to update and create new entries as necessary. Update the SELinux, Smack and AppArmor hooks that use secmarks to expect a secxa xarray index instead of a secid. Signed-off-by: Casey Schaufler --- include/linux/lsm_hook_defs.h | 2 +- include/linux/lsm_secxa.h | 2 + include/linux/security.h | 4 +- net/netfilter/nfnetlink_queue.c | 12 +++++- net/netfilter/nft_meta.c | 15 ++++--- net/netfilter/xt_SECMARK.c | 16 +++++-- security/apparmor/net.c | 8 +++- security/lsm_secxa.c | 20 ++++++++- security/security.c | 6 +-- security/selinux/hooks.c | 71 +++++++++++++++++++++++++++----- security/smack/smack_lsm.c | 10 ++++- security/smack/smack_netfilter.c | 10 +++-- 12 files changed, 141 insertions(+), 35 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 679c40a8e127..8ecf07e0e3f0 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -371,7 +371,7 @@ LSM_HOOK(void, LSM_RET_VOID, inet_csk_clone, struct soc= k *newsk, const struct request_sock *req) LSM_HOOK(void, LSM_RET_VOID, inet_conn_established, struct sock *sk, struct sk_buff *skb) -LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid) +LSM_HOOK(int, 0, secmark_relabel_packet, struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void) LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock = *req, diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h index 84b06c093460..5be9d64e67e4 100644 --- a/include/linux/lsm_secxa.h +++ b/include/linux/lsm_secxa.h @@ -7,6 +7,8 @@ #ifndef __LINUX_LSM_SECXA_H #define __LINUX_LSM_SECXA_H =20 +#include + #ifdef CONFIG_SECURITY =20 struct lsm_prop; diff --git a/include/linux/security.h b/include/linux/security.h index 19adc19eb9af..ffbd1708065f 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1715,7 +1715,7 @@ void security_inet_csk_clone(struct sock *newsk, const struct request_sock *req); void security_inet_conn_established(struct sock *sk, struct sk_buff *skb); -int security_secmark_relabel_packet(u32 secid); +int security_secmark_relabel_packet(struct lsm_prop *prop); void security_secmark_refcount_inc(void); void security_secmark_refcount_dec(void); int security_tun_dev_alloc_security(void **security); @@ -1898,7 +1898,7 @@ static inline void security_inet_conn_established(str= uct sock *sk, { } =20 -static inline int security_secmark_relabel_packet(u32 secid) +static inline int security_secmark_relabel_packet(struct lsm_prop *prop) { return 0; } diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queu= e.c index b8aaf39cb4d8..ebab037edc6b 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -606,8 +607,15 @@ static int nfqnl_get_sk_secctx(struct sk_buff *skb, st= ruct lsm_context *ctx) { int seclen =3D 0; #if IS_ENABLED(CONFIG_NETWORK_SECMARK) - if (skb->secmark) - seclen =3D security_secid_to_secctx(skb->secmark, ctx); + struct lsm_prop *prop; + int rc; + + if (skb->secmark) { + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (rc) + return 0; + seclen =3D security_lsmprop_to_secctx(prop, ctx, LSM_ID_UNDEF); + } #endif return seclen; } diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index bd0f7a0931f4..664191dfa4b2 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -927,21 +927,24 @@ static const struct nla_policy nft_secmark_policy[NFT= A_SECMARK_MAX + 1] =3D { =20 static int nft_secmark_compute_secid(struct nft_secmark *priv) { - u32 tmp_secid =3D 0; + struct lsm_prop tmp_prop; + u32 secxa =3D 0; int err; =20 - err =3D security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid= ); + err =3D security_secctx_to_lsmprop(priv->ctx, strlen(priv->ctx), + &tmp_prop, LSM_ID_UNDEF); if (err) return err; =20 - if (!tmp_secid) - return -ENOENT; + err =3D secxa_from_lsmprop(&tmp_prop, &secxa); + if (err) + return err; =20 - err =3D security_secmark_relabel_packet(tmp_secid); + err =3D security_secmark_relabel_packet(&tmp_prop); if (err) return err; =20 - priv->secid =3D tmp_secid; + priv->secid =3D secxa; return 0; } =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index ea67aa92ddc2..05b023a7c576 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -43,13 +43,15 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark= _target_info_v1 *info) =20 static int checkentry_lsm(struct xt_secmark_target_info_v1 *info) { + struct lsm_prop prop; int err; =20 info->secctx[SECMARK_SECCTX_MAX - 1] =3D '\0'; info->secid =3D 0; =20 - err =3D security_secctx_to_secid(info->secctx, strlen(info->secctx), - &info->secid); + err =3D security_secctx_to_lsmprop(info->secctx, strlen(info->secctx), + &prop, LSM_ID_UNDEF); + if (err) { if (err =3D=3D -EINVAL) pr_info_ratelimited("invalid security context \'%s\'\n", @@ -57,18 +59,24 @@ static int checkentry_lsm(struct xt_secmark_target_info= _v1 *info) return err; } =20 - if (!info->secid) { + if (!lsmprop_is_set(&prop)) { pr_info_ratelimited("unable to map security context \'%s\'\n", info->secctx); return -ENOENT; } =20 - err =3D security_secmark_relabel_packet(info->secid); + err =3D security_secmark_relabel_packet(&prop); if (err) { pr_info_ratelimited("unable to obtain relabeling permission\n"); return err; } =20 + err =3D secxa_from_lsmprop(&prop, &info->secid); + if (err) { + pr_info_ratelimited("unable to obtain secmark\n"); + return err; + } + security_secmark_refcount_inc(); return 0; } diff --git a/security/apparmor/net.c b/security/apparmor/net.c index cf590dd08540..e26e15c2d947 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -8,6 +8,7 @@ * Copyright 2009-2017 Canonical Ltd. */ =20 +#include #include "include/af_unix.h" #include "include/apparmor.h" #include "include/audit.h" @@ -365,12 +366,17 @@ static int aa_secmark_perm(struct aa_profile *profile= , u32 request, u32 secid, struct apparmor_audit_data *ad) { int i, ret; + struct lsm_prop *prop; struct aa_perms perms =3D { }; struct aa_ruleset *rules =3D profile->label.rules[0]; =20 if (rules->secmark_count =3D=3D 0) return 0; =20 + ret =3D secxa_get_lsmprop(&prop, secid); + if (ret) + return ret; + for (i =3D 0; i < rules->secmark_count; i++) { if (!rules->secmark[i].secid) { ret =3D apparmor_secmark_init(&rules->secmark[i]); @@ -378,7 +384,7 @@ static int aa_secmark_perm(struct aa_profile *profile, = u32 request, u32 secid, return ret; } =20 - if (rules->secmark[i].secid =3D=3D secid || + if (rules->secmark[i].secid =3D=3D prop->apparmor.label->secid || rules->secmark[i].secid =3D=3D AA_SECID_WILDCARD) { if (rules->secmark[i].deny) perms.deny =3D ALL_PERMS_MASK; diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c index ccbe78095d70..f0702ac5601d 100644 --- a/security/lsm_secxa.c +++ b/security/lsm_secxa.c @@ -103,7 +103,25 @@ EXPORT_SYMBOL(secxa_from_lsmprop); */ void secxa_set_secmark(struct sk_buff *skb, u32 secxa) { - if (!skb->secmark) + struct lsm_prop *olp; + struct lsm_prop *nlp; + struct lsm_prop prop; + u32 tsecxa; + int rc; + + if (!skb->secmark) { skb->secmark =3D secxa; + return; + } + + olp =3D xa_load(&secxa_xa, skb->secmark); + nlp =3D xa_load(&secxa_xa, secxa); + + prop =3D *olp; + security_update_lsmprop(&prop, nlp, LSM_ID_UNDEF); + + rc =3D secxa_from_lsmprop(&prop, &tsecxa); + if (!rc) + skb->secmark =3D tsecxa; } EXPORT_SYMBOL(secxa_set_secmark); diff --git a/security/security.c b/security/security.c index 1dec0037370b..e80e7823ce14 100644 --- a/security/security.c +++ b/security/security.c @@ -4646,15 +4646,15 @@ EXPORT_SYMBOL(security_inet_conn_established); =20 /** * security_secmark_relabel_packet() - Check if setting a secmark is allow= ed - * @secid: new secmark value + * @lsmprop: new secmark value * * Check if the process should be allowed to relabel packets to @secid. * * Return: Returns 0 if permission is granted. */ -int security_secmark_relabel_packet(u32 secid) +int security_secmark_relabel_packet(struct lsm_prop *prop) { - return call_int_hook(secmark_relabel_packet, secid); + return call_int_hook(secmark_relabel_packet, prop); } EXPORT_SYMBOL(security_secmark_relabel_packet); =20 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 12614478b638..bf832eff0b92 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -94,6 +94,7 @@ #include #include #include +#include =20 #include "initcalls.h" #include "avc.h" @@ -5414,7 +5415,16 @@ static int selinux_sock_rcv_skb_compat(struct sock *= sk, struct sk_buff *skb, return err; =20 if (selinux_secmark_enabled()) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5483,7 +5493,15 @@ static int selinux_socket_sock_rcv_skb(struct sock *= sk, struct sk_buff *skb) } =20 if (secmark_active) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5885,10 +5903,10 @@ static void selinux_inet_conn_established(struct so= ck *sk, struct sk_buff *skb) selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); } =20 -static int selinux_secmark_relabel_packet(u32 sid) +static int selinux_secmark_relabel_packet(struct lsm_prop *lsmprop) { - return avc_has_perm(current_sid(), sid, SECCLASS_PACKET, PACKET__RELABELT= O, - NULL); + return avc_has_perm(current_sid(), lsmprop->selinux.secid, + SECCLASS_PACKET, PACKET__RELABELTO, NULL); } =20 static void selinux_secmark_refcount_inc(void) @@ -6016,10 +6034,21 @@ static unsigned int selinux_ip_forward(void *priv, = struct sk_buff *skb, } } =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) return NF_DROP; + } =20 if (netlbl_enabled()) /* we do this in the FORWARD path and not the POST_ROUTING @@ -6093,10 +6122,20 @@ static unsigned int selinux_ip_postroute_compat(str= uct sk_buff *skb, if (selinux_parse_skb(skb, &ad, NULL, 0, &proto)) return NF_DROP; =20 - if (selinux_secmark_enabled()) - if (avc_has_perm(sksec->sid, skb->secmark, + if (selinux_secmark_enabled()) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(sksec->sid, secmark, SECCLASS_PACKET, PACKET__SEND, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) return NF_DROP_ERR(-ECONNREFUSED); @@ -6215,10 +6254,20 @@ static unsigned int selinux_ip_postroute(void *priv, if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) return NF_DROP; =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, secmark_perm, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (peerlbl_active) { u32 if_sid; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index fcfadd5d9994..79140e6829a4 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -4189,10 +4190,17 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb= , struct sockaddr_in6 *sip) #ifdef CONFIG_NETWORK_SECMARK static struct smack_known *smack_from_skb(struct sk_buff *skb) { + struct lsm_prop *prop; + int rc; + if (skb =3D=3D NULL || skb->secmark =3D=3D 0) return NULL; =20 - return smack_from_secid(skb->secmark); + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (prop) + return prop->smack.skp; + + return NULL; } #else static inline struct smack_known *smack_from_skb(struct sk_buff *skb) diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index b363c42f252e..0378f74aa22b 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -24,13 +24,17 @@ static unsigned int smack_ip_output(void *priv, const struct nf_hook_state *state) { struct sock *sk =3D skb_to_full_sk(skb); + struct lsm_prop prop =3D { }; struct socket_smack *ssp; - struct smack_known *skp; + u32 secxa; + int rc; =20 if (sk) { ssp =3D smack_sock(sk); - skp =3D ssp->smk_out; - secxa_set_secmark(skb, skp->smk_secid); + prop.smack.skp =3D ssp->smk_out; + rc =3D secxa_from_lsmprop(&prop, &secxa); + if (!rc) + secxa_set_secmark(skb, secxa); } =20 return NF_ACCEPT; --=20 2.54.0