BACKPORT: Smack: Remove unnecessary smack_known_invalid

The invalid Smack label ("") and the Huh ("?") Smack label
serve the same purpose and having both is unnecessary.
While pulling out the invalid label it became clear that
the use of smack_from_secid() was inconsistent, so that
is repaired. The setting of inode labels to the invalid
label could never happen in a functional system, has
never been observed in the wild and is not what you'd
really want for a failure behavior in any case. That is
removed.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
(cherry-picked from upstream 152f91d4d11a30106b9cc0b27b47e0e80b633ee8)

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 845639925a67004878153ecebd680f9ebf9cff78..ade95d78e8cf6ea68b9e845c20a3acdf6a72f3a9 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -330,7 +330,6 @@ extern int smack_ptrace_rule;
 extern struct smack_known smack_known_floor;
 extern struct smack_known smack_known_hat;
 extern struct smack_known smack_known_huh;
-extern struct smack_known smack_known_invalid;
 extern struct smack_known smack_known_star;
 extern struct smack_known smack_known_web;
 

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index eae9e1df6af15e8cf18d76e6534e2c1e86a2c054..091897858499fc06cb9a826e15fe756ad06e8159 100644 (file)
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -36,11 +36,6 @@ struct smack_known smack_known_floor = {
        .smk_secid      = 5,
 };
 
-struct smack_known smack_known_invalid = {
-       .smk_known      = "",
-       .smk_secid      = 6,
-};
-
 struct smack_known smack_known_web = {
        .smk_known      = "@",
        .smk_secid      = 7,
@@ -616,7 +611,7 @@ struct smack_known *smack_from_secid(const u32 secid)
         * of a secid that is not on the list.
         */
        rcu_read_unlock();
-       return &smack_known_invalid;
+       return &smack_known_huh;
 }
 
 /*

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 1dd3956b7140a1847218971fefb6715dbd4a616e..0079d48dae06e1c72e14a10b45eabe1eba497f65 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1363,20 +1363,14 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
                skp = smk_import_entry(value, size);
                if (!IS_ERR(skp))
                        isp->smk_inode = skp;
-               else
-                       isp->smk_inode = &smack_known_invalid;
        } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
                skp = smk_import_entry(value, size);
                if (!IS_ERR(skp))
                        isp->smk_task = skp;
-               else
-                       isp->smk_task = &smack_known_invalid;
        } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
                skp = smk_import_entry(value, size);
                if (!IS_ERR(skp))
                        isp->smk_mmap = skp;
-               else
-                       isp->smk_mmap = &smack_known_invalid;
        }
 
        return;
@@ -2057,12 +2051,8 @@ static void smack_cred_transfer(struct cred *new, const struct cred *old)
 static int smack_kernel_act_as(struct cred *new, u32 secid)
 {
        struct task_smack *new_tsp = new->security;
-       struct smack_known *skp = smack_from_secid(secid);
-
-       if (skp == NULL)
-               return -EINVAL;
 
-       new_tsp->smk_task = skp;
+       new_tsp->smk_task = smack_from_secid(secid);
        return 0;
 }
 
@@ -3883,21 +3873,11 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
                        return &smack_known_web;
                return &smack_known_star;
        }
-       if ((sap->flags & NETLBL_SECATTR_SECID) != 0) {
+       if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
                /*
                 * Looks like a fallback, which gives us a secid.
                 */
-               skp = smack_from_secid(sap->attr.secid);
-               /*
-                * This has got to be a bug because it is
-                * impossible to specify a fallback without
-                * specifying the label, which will ensure
-                * it has a secid, and the only way to get a
-                * secid is from a fallback.
-                */
-               BUG_ON(skp == NULL);
-               return skp;
-       }
+               return smack_from_secid(sap->attr.secid);
        /*
         * Without guidance regarding the smack value
         * for the packet fall back on the network
@@ -4748,7 +4728,6 @@ static __init void init_smack_known_list(void)
        mutex_init(&smack_known_hat.smk_rules_lock);
        mutex_init(&smack_known_floor.smk_rules_lock);
        mutex_init(&smack_known_star.smk_rules_lock);
-       mutex_init(&smack_known_invalid.smk_rules_lock);
        mutex_init(&smack_known_web.smk_rules_lock);
        /*
         * Initialize rule lists
@@ -4757,7 +4736,6 @@ static __init void init_smack_known_list(void)
        INIT_LIST_HEAD(&smack_known_hat.smk_rules);
        INIT_LIST_HEAD(&smack_known_star.smk_rules);
        INIT_LIST_HEAD(&smack_known_floor.smk_rules);
-       INIT_LIST_HEAD(&smack_known_invalid.smk_rules);
        INIT_LIST_HEAD(&smack_known_web.smk_rules);
        /*
         * Create the known labels list
@@ -4766,7 +4744,6 @@ static __init void init_smack_known_list(void)
        smk_insert_entry(&smack_known_hat);
        smk_insert_entry(&smack_known_star);
        smk_insert_entry(&smack_known_floor);
-       smk_insert_entry(&smack_known_invalid);
        smk_insert_entry(&smack_known_web);
 }
 

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 12203eab7280cfd5a58f5e25551610e9ce7ba2fc..02b12f4564596801c6efb1bf8bb35a34a95f3588 100644 (file)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -3050,9 +3050,6 @@ static int __init init_smk_fs(void)
        if (err == 0 && rc < 0)
                err = rc;
        rc = smk_preset_netlabel(&smack_known_huh);
-       if (err == 0 && rc < 0)
-               err = rc;
-       rc = smk_preset_netlabel(&smack_known_invalid);
        if (err == 0 && rc < 0)
                err = rc;
        rc = smk_preset_netlabel(&smack_known_star);