xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

selinux: add gfp argument to security_xfrm_policy_alloc and fix callers

Browse Source 
security_xfrm_policy_alloc can be called in atomic context so the
allocation should be done with GFP_ATOMIC. Add an argument to let the
callers choose the appropriate way. In order to do so a gfp argument
needs to be added to the method xfrm_policy_alloc_security in struct
security_operations and to the internal function
selinux_xfrm_alloc_user. After that switch to GFP_ATOMIC in the atomic
callers and leave GFP_KERNEL as before for the rest.
The path that needed the gfp argument addition is:
security_xfrm_policy_alloc -> security_ops.xfrm_policy_alloc_security ->
all users of xfrm_policy_alloc_security (e.g. selinux_xfrm_policy_alloc) ->
selinux_xfrm_alloc_user (here the allocation used to be GFP_KERNEL only)

Now adding a gfp argument to selinux_xfrm_alloc_user requires us to also
add it to security_context_to_sid which is used inside and prior to this
patch did only GFP_KERNEL allocation. So add gfp argument to
security_context_to_sid and adjust all of its callers as well.

CC: Paul Moore <paul@paul-moore.com>
CC: Dave Jones <davej@redhat.com>
CC: Steffen Klassert <steffen.klassert@secunet.com>
CC: Fan Du <fan.du@windriver.com>
CC: David S. Miller <davem@davemloft.net>
CC: LSM list <linux-security-module@vger.kernel.org>
CC: SELinux list <selinux@tycho.nsa.gov>

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Nikolay Aleksandrov
2014-03-07 12:44:19 +01:00
committed by Steffen Klassert
parent 87536a81e1
commit 52a4c6404f
11 changed files with 59 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
security/selinux/selinuxfs.c
View File

@@ -576,7 +576,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
if (length)
goto out;
length = security_context_to_sid(buf, size, &sid);
length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
if (length)
goto out;
@@ -731,11 +731,13 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out;
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
GFP_KERNEL);
if (length)
goto out;
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
GFP_KERNEL);
if (length)
goto out;
@@ -817,11 +819,13 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
objname = namebuf;
}
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
GFP_KERNEL);
if (length)
goto out;
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
GFP_KERNEL);
if (length)
goto out;
@@ -878,11 +882,13 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out;
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
GFP_KERNEL);
if (length)
goto out;
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
GFP_KERNEL);
if (length)
goto out;
@@ -934,7 +940,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s", con, user) != 2)
goto out;
length = security_context_to_sid(con, strlen(con) + 1, &sid);
length = security_context_to_sid(con, strlen(con) + 1, &sid, GFP_KERNEL);
if (length)
goto out;
@@ -994,11 +1000,13 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out;
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
GFP_KERNEL);
if (length)
goto out;
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
GFP_KERNEL);
if (length)
goto out;