Skip to content

Commit c53fa1e

Browse files
kaberdavem330
kaber
authored and
davem330
committed
netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms
Netlink message processing in the kernel is synchronous these days, the session information can be collected when needed. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 06dc94b commit c53fa1e

File tree

7 files changed

+49
-41
lines changed

7 files changed

+49
-41
lines changed

‎include/linux/netlink.h

-3
Original file line numberDiff line numberDiff line change
@@ -161,9 +161,6 @@ struct netlink_skb_parms {
161161
__u32 pid;
162162
__u32 dst_group;
163163
kernel_cap_t eff_cap;
164-
__u32 loginuid; /* Login (audit) uid */
165-
__u32 sessionid; /* Session id (audit) */
166-
__u32 sid; /* SELinux security id */
167164
};
168165

169166
#define NETLINK_CB(skb) (*(struct netlink_skb_parms*)&((skb)->cb))

‎kernel/audit.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -673,9 +673,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
673673

674674
pid = NETLINK_CREDS(skb)->pid;
675675
uid = NETLINK_CREDS(skb)->uid;
676-
loginuid = NETLINK_CB(skb).loginuid;
677-
sessionid = NETLINK_CB(skb).sessionid;
678-
sid = NETLINK_CB(skb).sid;
676+
loginuid = audit_get_loginuid(current);
677+
sessionid = audit_get_sessionid(current);
678+
security_task_getsecid(current, &sid);
679679
seq = nlh->nlmsg_seq;
680680
data = NLMSG_DATA(nlh);
681681

‎kernel/auditfilter.c

+7-3
Original file line numberDiff line numberDiff line change
@@ -1238,6 +1238,7 @@ static int audit_filter_user_rules(struct netlink_skb_parms *cb,
12381238
for (i = 0; i < rule->field_count; i++) {
12391239
struct audit_field *f = &rule->fields[i];
12401240
int result = 0;
1241+
u32 sid;
12411242

12421243
switch (f->type) {
12431244
case AUDIT_PID:
@@ -1250,19 +1251,22 @@ static int audit_filter_user_rules(struct netlink_skb_parms *cb,
12501251
result = audit_comparator(cb->creds.gid, f->op, f->val);
12511252
break;
12521253
case AUDIT_LOGINUID:
1253-
result = audit_comparator(cb->loginuid, f->op, f->val);
1254+
result = audit_comparator(audit_get_loginuid(current),
1255+
f->op, f->val);
12541256
break;
12551257
case AUDIT_SUBJ_USER:
12561258
case AUDIT_SUBJ_ROLE:
12571259
case AUDIT_SUBJ_TYPE:
12581260
case AUDIT_SUBJ_SEN:
12591261
case AUDIT_SUBJ_CLR:
1260-
if (f->lsm_rule)
1261-
result = security_audit_rule_match(cb->sid,
1262+
if (f->lsm_rule) {
1263+
security_task_getsecid(current, &sid);
1264+
result = security_audit_rule_match(sid,
12621265
f->type,
12631266
f->op,
12641267
f->lsm_rule,
12651268
NULL);
1269+
}
12661270
break;
12671271
}
12681272

‎net/netlabel/netlabel_user.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@
4949
static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
5050
struct netlbl_audit *audit_info)
5151
{
52-
audit_info->secid = NETLINK_CB(skb).sid;
53-
audit_info->loginuid = NETLINK_CB(skb).loginuid;
54-
audit_info->sessionid = NETLINK_CB(skb).sessionid;
52+
security_task_getsecid(current, &audit_info->secid);
53+
audit_info->loginuid = audit_get_loginuid(current);
54+
audit_info->sessionid = audit_get_sessionid(current);
5555
}
5656

5757
/* NetLabel NETLINK I/O functions */

‎net/netlink/af_netlink.c

-3
Original file line numberDiff line numberDiff line change
@@ -1362,9 +1362,6 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
13621362

13631363
NETLINK_CB(skb).pid = nlk->pid;
13641364
NETLINK_CB(skb).dst_group = dst_group;
1365-
NETLINK_CB(skb).loginuid = audit_get_loginuid(current);
1366-
NETLINK_CB(skb).sessionid = audit_get_sessionid(current);
1367-
security_task_getsecid(current, &(NETLINK_CB(skb).sid));
13681365
memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
13691366

13701367
/* What can I do? Netlink is asynchronous, so that

‎net/xfrm/xfrm_user.c

+32-24
Original file line numberDiff line numberDiff line change
@@ -497,9 +497,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
497497
struct xfrm_state *x;
498498
int err;
499499
struct km_event c;
500-
uid_t loginuid = NETLINK_CB(skb).loginuid;
501-
u32 sessionid = NETLINK_CB(skb).sessionid;
502-
u32 sid = NETLINK_CB(skb).sid;
500+
uid_t loginuid = audit_get_loginuid(current);
501+
u32 sessionid = audit_get_sessionid(current);
502+
u32 sid;
503503

504504
err = verify_newsa_info(p, attrs);
505505
if (err)
@@ -515,6 +515,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
515515
else
516516
err = xfrm_state_update(x);
517517

518+
security_task_getsecid(current, &sid);
518519
xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
519520

520521
if (err < 0) {
@@ -575,9 +576,9 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
575576
int err = -ESRCH;
576577
struct km_event c;
577578
struct xfrm_usersa_id *p = nlmsg_data(nlh);
578-
uid_t loginuid = NETLINK_CB(skb).loginuid;
579-
u32 sessionid = NETLINK_CB(skb).sessionid;
580-
u32 sid = NETLINK_CB(skb).sid;
579+
uid_t loginuid = audit_get_loginuid(current);
580+
u32 sessionid = audit_get_sessionid(current);
581+
u32 sid;
581582

582583
x = xfrm_user_state_lookup(net, p, attrs, &err);
583584
if (x == NULL)
@@ -602,6 +603,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
602603
km_state_notify(x, &c);
603604

604605
out:
606+
security_task_getsecid(current, &sid);
605607
xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
606608
xfrm_state_put(x);
607609
return err;
@@ -1265,9 +1267,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
12651267
struct km_event c;
12661268
int err;
12671269
int excl;
1268-
uid_t loginuid = NETLINK_CB(skb).loginuid;
1269-
u32 sessionid = NETLINK_CB(skb).sessionid;
1270-
u32 sid = NETLINK_CB(skb).sid;
1270+
uid_t loginuid = audit_get_loginuid(current);
1271+
u32 sessionid = audit_get_sessionid(current);
1272+
u32 sid;
12711273

12721274
err = verify_newpolicy_info(p);
12731275
if (err)
@@ -1286,6 +1288,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
12861288
* a type XFRM_MSG_UPDPOLICY - JHS */
12871289
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
12881290
err = xfrm_policy_insert(p->dir, xp, excl);
1291+
security_task_getsecid(current, &sid);
12891292
xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
12901293

12911294
if (err) {
@@ -1522,10 +1525,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
15221525
NETLINK_CB(skb).pid);
15231526
}
15241527
} else {
1525-
uid_t loginuid = NETLINK_CB(skb).loginuid;
1526-
u32 sessionid = NETLINK_CB(skb).sessionid;
1527-
u32 sid = NETLINK_CB(skb).sid;
1528+
uid_t loginuid = audit_get_loginuid(current);
1529+
u32 sessionid = audit_get_sessionid(current);
1530+
u32 sid;
15281531

1532+
security_task_getsecid(current, &sid);
15291533
xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
15301534
sid);
15311535

@@ -1553,9 +1557,9 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
15531557
struct xfrm_audit audit_info;
15541558
int err;
15551559

1556-
audit_info.loginuid = NETLINK_CB(skb).loginuid;
1557-
audit_info.sessionid = NETLINK_CB(skb).sessionid;
1558-
audit_info.secid = NETLINK_CB(skb).sid;
1560+
audit_info.loginuid = audit_get_loginuid(current);
1561+
audit_info.sessionid = audit_get_sessionid(current);
1562+
security_task_getsecid(current, &audit_info.secid);
15591563
err = xfrm_state_flush(net, p->proto, &audit_info);
15601564
if (err) {
15611565
if (err == -ESRCH) /* empty table */
@@ -1720,9 +1724,9 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
17201724
if (err)
17211725
return err;
17221726

1723-
audit_info.loginuid = NETLINK_CB(skb).loginuid;
1724-
audit_info.sessionid = NETLINK_CB(skb).sessionid;
1725-
audit_info.secid = NETLINK_CB(skb).sid;
1727+
audit_info.loginuid = audit_get_loginuid(current);
1728+
audit_info.sessionid = audit_get_sessionid(current);
1729+
security_task_getsecid(current, &audit_info.secid);
17261730
err = xfrm_policy_flush(net, type, &audit_info);
17271731
if (err) {
17281732
if (err == -ESRCH) /* empty table */
@@ -1789,9 +1793,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
17891793

17901794
err = 0;
17911795
if (up->hard) {
1792-
uid_t loginuid = NETLINK_CB(skb).loginuid;
1793-
uid_t sessionid = NETLINK_CB(skb).sessionid;
1794-
u32 sid = NETLINK_CB(skb).sid;
1796+
uid_t loginuid = audit_get_loginuid(current);
1797+
u32 sessionid = audit_get_sessionid(current);
1798+
u32 sid;
1799+
1800+
security_task_getsecid(current, &sid);
17951801
xfrm_policy_delete(xp, p->dir);
17961802
xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
17971803

@@ -1830,9 +1836,11 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
18301836
km_state_expired(x, ue->hard, current->pid);
18311837

18321838
if (ue->hard) {
1833-
uid_t loginuid = NETLINK_CB(skb).loginuid;
1834-
uid_t sessionid = NETLINK_CB(skb).sessionid;
1835-
u32 sid = NETLINK_CB(skb).sid;
1839+
uid_t loginuid = audit_get_loginuid(current);
1840+
u32 sessionid = audit_get_sessionid(current);
1841+
u32 sid;
1842+
1843+
security_task_getsecid(current, &sid);
18361844
__xfrm_state_delete(x);
18371845
xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
18381846
}

‎security/selinux/hooks.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -4669,6 +4669,7 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
46694669
{
46704670
int err;
46714671
struct common_audit_data ad;
4672+
u32 sid;
46724673

46734674
err = cap_netlink_recv(skb, capability);
46744675
if (err)
@@ -4677,8 +4678,9 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
46774678
COMMON_AUDIT_DATA_INIT(&ad, CAP);
46784679
ad.u.cap = capability;
46794680

4680-
return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4681-
SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4681+
security_task_getsecid(current, &sid);
4682+
return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4683+
CAP_TO_MASK(capability), &ad);
46824684
}
46834685

46844686
static int ipc_alloc_security(struct task_struct *task,

0 commit comments

Comments
 (0)