Merge tag 'selinux-pr-20201214' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull selinux updates from Paul Moore:
 "While we have a small number of SELinux patches for v5.11, there are a
  few changes worth highlighting:

   - Change the LSM network hooks to pass flowi_common structs instead
     of the parent flowi struct as the LSMs do not currently need the
     full flowi struct and they do not have enough information to use it
     safely (missing information on the address family).

     This patch was discussed both with Herbert Xu (representing team
     netdev) and James Morris (representing team
     LSMs-other-than-SELinux).

   - Fix how we handle errors in inode_doinit_with_dentry() so that we
     attempt to properly label the inode on following lookups instead of
     continuing to treat it as unlabeled.

   - Tweak the kernel logic around allowx, auditallowx, and dontauditx
     SELinux policy statements such that the auditx/dontauditx are
     effective even without the allowx statement.

  Everything passes our test suite"

* tag 'selinux-pr-20201214' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
  selinux: Fix fall-through warnings for Clang
  selinux: drop super_block backpointer from superblock_security_struct
  selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  selinux: allow dontauditx and auditallowx rules to take effect without allowx
  selinux: fix error initialization in inode_doinit_with_dentry()

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
index 95ab871..a0e0d8a 100644 (file)
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
@@ -1145,7 +1145,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
                fl6.daddr = ip6h->saddr;
                fl6.fl6_dport = inet_rsk(oreq)->ir_rmt_port;
                fl6.fl6_sport = htons(inet_rsk(oreq)->ir_num);
-               security_req_classify_flow(oreq, flowi6_to_flowi(&fl6));
+               security_req_classify_flow(oreq, flowi6_to_flowi_common(&fl6));
                dst = ip6_dst_lookup_flow(sock_net(lsk), lsk, &fl6, NULL);
                if (IS_ERR(dst))
                        goto free_sk;

diff --git a/drivers/net/wireguard/socket.c b/drivers/net/wireguard/socket.c
index c33e2c8..410b318 100644 (file)
--- a/drivers/net/wireguard/socket.c
+++ b/drivers/net/wireguard/socket.c
@@ -49,7 +49,7 @@ static int send4(struct wg_device *wg, struct sk_buff *skb,
                rt = dst_cache_get_ip4(cache, &fl.saddr);
 
        if (!rt) {
-               security_sk_classify_flow(sock, flowi4_to_flowi(&fl));
+               security_sk_classify_flow(sock, flowi4_to_flowi_common(&fl));
                if (unlikely(!inet_confirm_addr(sock_net(sock), NULL, 0,
                                                fl.saddr, RT_SCOPE_HOST))) {
                        endpoint->src4.s_addr = 0;
@@ -129,7 +129,7 @@ static int send6(struct wg_device *wg, struct sk_buff *skb,
                dst = dst_cache_get_ip6(cache, &fl.saddr);
 
        if (!dst) {
-               security_sk_classify_flow(sock, flowi6_to_flowi(&fl));
+               security_sk_classify_flow(sock, flowi6_to_flowi_common(&fl));
                if (unlikely(!ipv6_addr_any(&fl.saddr) &&
                             !ipv6_chk_addr(sock_net(sock), &fl.saddr, NULL, 0))) {
                        endpoint->src6 = fl.saddr = in6addr_any;

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index acc0494..7aaa753 100644 (file)
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -311,7 +311,7 @@ LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid)
 LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void)
 LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void)
 LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock *req,
-        struct flowi *fl)
+        struct flowi_common *flic)
 LSM_HOOK(int, 0, tun_dev_alloc_security, void **security)
 LSM_HOOK(void, LSM_RET_VOID, tun_dev_free_security, void *security)
 LSM_HOOK(int, 0, tun_dev_create, void)
@@ -351,7 +351,7 @@ LSM_HOOK(int, 0, xfrm_state_delete_security, struct xfrm_state *x)
 LSM_HOOK(int, 0, xfrm_policy_lookup, struct xfrm_sec_ctx *ctx, u32 fl_secid,
         u8 dir)
 LSM_HOOK(int, 1, xfrm_state_pol_flow_match, struct xfrm_state *x,
-        struct xfrm_policy *xp, const struct flowi *fl)
+        struct xfrm_policy *xp, const struct flowi_common *flic)
 LSM_HOOK(int, 0, xfrm_decode_session, struct sk_buff *skb, u32 *secid,
         int ckall)
 #endif /* CONFIG_SECURITY_NETWORK_XFRM */

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index c503f7a..a19adef 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1105,7 +1105,7 @@
  * @xfrm_state_pol_flow_match:
  *     @x contains the state to match.
  *     @xp contains the policy to check for a match.
- *     @fl contains the flow to check for a match.
+ *     @flic contains the flowi_common struct to check for a match.
  *     Return 1 if there is a match.
  * @xfrm_decode_session:
  *     @skb points to skb to decode.

diff --git a/include/linux/security.h b/include/linux/security.h
index 77c7fe5..c35ea0f 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -168,7 +168,7 @@ struct sk_buff;
 struct sock;
 struct sockaddr;
 struct socket;
-struct flowi;
+struct flowi_common;
 struct dst_entry;
 struct xfrm_selector;
 struct xfrm_policy;
@@ -1356,8 +1356,9 @@ int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u
 int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
 void security_sk_free(struct sock *sk);
 void security_sk_clone(const struct sock *sk, struct sock *newsk);
-void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
-void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
+void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic);
+void security_req_classify_flow(const struct request_sock *req,
+                               struct flowi_common *flic);
 void security_sock_graft(struct sock*sk, struct socket *parent);
 int security_inet_conn_request(const struct sock *sk,
                        struct sk_buff *skb, struct request_sock *req);
@@ -1508,11 +1509,13 @@ static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
 {
 }
 
-static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
+static inline void security_sk_classify_flow(struct sock *sk,
+                                            struct flowi_common *flic)
 {
 }
 
-static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+static inline void security_req_classify_flow(const struct request_sock *req,
+                                             struct flowi_common *flic)
 {
 }
 
@@ -1639,9 +1642,9 @@ void security_xfrm_state_free(struct xfrm_state *x);
 int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                       struct xfrm_policy *xp,
-                                      const struct flowi *fl);
+                                      const struct flowi_common *flic);
 int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
-void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
+void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
 
 #else  /* CONFIG_SECURITY_NETWORK_XFRM */
 
@@ -1693,7 +1696,8 @@ static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_s
 }
 
 static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                       struct xfrm_policy *xp, const struct flowi *fl)
+                                                    struct xfrm_policy *xp,
+                                                    const struct flowi_common *flic)
 {
        return 1;
 }
@@ -1703,7 +1707,8 @@ static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
        return 0;
 }
 
-static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
+static inline void security_skb_classify_flow(struct sk_buff *skb,
+                                             struct flowi_common *flic)
 {
 }
 

diff --git a/include/net/flow.h b/include/net/flow.h
index b2531df..39d0ced 100644 (file)
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -195,11 +195,21 @@ static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)
        return container_of(fl4, struct flowi, u.ip4);
 }
 
+static inline struct flowi_common *flowi4_to_flowi_common(struct flowi4 *fl4)
+{
+       return &(flowi4_to_flowi(fl4)->u.__fl_common);
+}
+
 static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
 {
        return container_of(fl6, struct flowi, u.ip6);
 }
 
+static inline struct flowi_common *flowi6_to_flowi_common(struct flowi6 *fl6)
+{
+       return &(flowi6_to_flowi(fl6)->u.__fl_common);
+}
+
 static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
 {
        return container_of(fldn, struct flowi, u.dn);

diff --git a/include/net/route.h b/include/net/route.h
index ff021ca..2e6c0e1 100644 (file)
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -165,7 +165,7 @@ static inline struct rtable *ip_route_output_ports(struct net *net, struct flowi
                           sk ? inet_sk_flowi_flags(sk) : 0,
                           daddr, saddr, dport, sport, sock_net_uid(net, sk));
        if (sk)
-               security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+               security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
        return ip_route_output_flow(net, fl4, sk);
 }
 
@@ -322,7 +322,7 @@ static inline struct rtable *ip_route_connect(struct flowi4 *fl4,
                ip_rt_put(rt);
                flowi4_update_output(fl4, oif, tos, fl4->daddr, fl4->saddr);
        }
-       security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+       security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
        return ip_route_output_flow(net, fl4, sk);
 }
 
@@ -338,7 +338,7 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable
                flowi4_update_output(fl4, sk->sk_bound_dev_if,
                                     RT_CONN_FLAGS(sk), fl4->daddr,
                                     fl4->saddr);
-               security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+               security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
                return ip_route_output_flow(sock_net(sk), fl4, sk);
        }
        return rt;

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b0b6e6a..2455b0c 100644 (file)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -464,7 +464,7 @@ static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk,
                .fl4_dport = dccp_hdr(skb)->dccph_sport,
        };
 
-       security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
+       security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_flow(net, &fl4, sk);
        if (IS_ERR(rt)) {
                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 78ee1b5..1f73603 100644 (file)
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -203,7 +203,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req
        fl6.flowi6_oif = ireq->ir_iif;
        fl6.fl6_dport = ireq->ir_rmt_port;
        fl6.fl6_sport = htons(ireq->ir_num);
-       security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+       security_req_classify_flow(req, flowi6_to_flowi_common(&fl6));
 
 
        rcu_read_lock();
@@ -279,7 +279,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
        fl6.flowi6_oif = inet6_iif(rxskb);
        fl6.fl6_dport = dccp_hdr(skb)->dccph_dport;
        fl6.fl6_sport = dccp_hdr(skb)->dccph_sport;
-       security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
+       security_skb_classify_flow(rxskb, flowi6_to_flowi_common(&fl6));
 
        /* sk = NULL, but it is safe for now. RST socket required. */
        dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
@@ -907,7 +907,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        fl6.flowi6_oif = sk->sk_bound_dev_if;
        fl6.fl6_dport = usin->sin6_port;
        fl6.fl6_sport = inet->inet_sport;
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
        final_p = fl6_update_dst(&fl6, opt, &final);

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 005faea..396b492 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -447,7 +447,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
        fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
        fl4.flowi4_proto = IPPROTO_ICMP;
        fl4.flowi4_oif = l3mdev_master_ifindex(skb->dev);
-       security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
+       security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                goto out_unlock;
@@ -503,7 +503,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
        route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
        fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
 
-       security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
+       security_skb_classify_flow(skb_in, flowi4_to_flowi_common(fl4));
        rt = ip_route_output_key_hash(net, fl4, skb_in);
        if (IS_ERR(rt))
                return rt;

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index f60869a..fd8b880 100644 (file)
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -602,7 +602,7 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
                           (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
                           ireq->ir_loc_addr, ireq->ir_rmt_port,
                           htons(ireq->ir_num), sk->sk_uid);
-       security_req_classify_flow(req, flowi4_to_flowi(fl4));
+       security_req_classify_flow(req, flowi4_to_flowi_common(fl4));
        rt = ip_route_output_flow(net, fl4, sk);
        if (IS_ERR(rt))
                goto no_route;
@@ -640,7 +640,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
                           (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
                           ireq->ir_loc_addr, ireq->ir_rmt_port,
                           htons(ireq->ir_num), sk->sk_uid);
-       security_req_classify_flow(req, flowi4_to_flowi(fl4));
+       security_req_classify_flow(req, flowi4_to_flowi_common(fl4));
        rt = ip_route_output_flow(net, fl4, sk);
        if (IS_ERR(rt))
                goto no_route;

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 879b76a..89fff5f 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1700,7 +1700,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
                           daddr, saddr,
                           tcp_hdr(skb)->source, tcp_hdr(skb)->dest,
                           arg->uid);
-       security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
+       security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                return;

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 248856b..8b943f8 100644 (file)
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -778,7 +778,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        fl4.fl4_icmp_type = user_icmph.type;
        fl4.fl4_icmp_code = user_icmph.code;
 
-       security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
+       security_sk_classify_flow(sk, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_flow(net, &fl4, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 7d26e0f..50a7317 100644 (file)
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -640,7 +640,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                        goto done;
        }
 
-       security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
+       security_sk_classify_flow(sk, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_flow(net, &fl4, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 00dc3f9..33792cf 100644 (file)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -418,7 +418,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
                           inet_sk_flowi_flags(sk),
                           opt->srr ? opt->faddr : ireq->ir_rmt_addr,
                           ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid);
-       security_req_classify_flow(req, flowi4_to_flowi(&fl4));
+       security_req_classify_flow(req, flowi4_to_flowi_common(&fl4));
        rt = ip_route_output_key(sock_net(sk), &fl4);
        if (IS_ERR(rt)) {
                reqsk_free(req);

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index dece195..7103b0a 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1196,7 +1196,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                                   faddr, saddr, dport, inet->inet_sport,
                                   sk->sk_uid);
 
-               security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+               security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
                rt = ip_route_output_flow(net, fl4, sk);
                if (IS_ERR(rt)) {
                        err = PTR_ERR(rt);

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index a7e3d17..8e9c3e9 100644 (file)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -819,7 +819,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                fl6.fl6_dport = inet->inet_dport;
                fl6.fl6_sport = inet->inet_sport;
                fl6.flowi6_uid = sk->sk_uid;
-               security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+               security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
                rcu_read_lock();
                final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt),

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index cc8ad7d..206f663 100644 (file)
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -60,7 +60,7 @@ static void ip6_datagram_flow_key_init(struct flowi6 *fl6, struct sock *sk)
        if (!fl6->flowi6_oif && ipv6_addr_is_multicast(&fl6->daddr))
                fl6->flowi6_oif = np->mcast_oif;
 
-       security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
 }
 
 int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr)

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 8956144..f3d0586 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -573,7 +573,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
        fl6.fl6_icmp_code = code;
        fl6.flowi6_uid = sock_net_uid(net, NULL);
        fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
-       security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
+       security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));
 
        np = inet6_sk(sk);
 
@@ -755,7 +755,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
        fl6.flowi6_mark = mark;
        fl6.flowi6_uid = sock_net_uid(net, NULL);
-       security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
+       security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));
 
        local_bh_disable();
        sk = icmpv6_xmit_lock(net);
@@ -1008,7 +1008,7 @@ void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
        fl6->fl6_icmp_type      = type;
        fl6->fl6_icmp_code      = 0;
        fl6->flowi6_oif         = oif;
-       security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
 }
 
 static void __net_exit icmpv6_sk_exit(struct net *net)

diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index e315526..5a9f4d7 100644 (file)
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -46,7 +46,7 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk,
        fl6->fl6_dport = ireq->ir_rmt_port;
        fl6->fl6_sport = htons(ireq->ir_num);
        fl6->flowi6_uid = sk->sk_uid;
-       security_req_classify_flow(req, flowi6_to_flowi(fl6));
+       security_req_classify_flow(req, flowi6_to_flowi_common(fl6));
 
        dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
        if (IS_ERR(dst))
@@ -95,7 +95,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
        fl6->fl6_sport = inet->inet_sport;
        fl6->fl6_dport = inet->inet_dport;
        fl6->flowi6_uid = sk->sk_uid;
-       security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
 
        rcu_read_lock();
        final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);

diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 570d1d7..dffeaaa 100644 (file)
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -314,7 +314,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 
        fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
        fl6.flowi6_mark = IP6_REPLY_MARK(net, oldskb->mark);
-       security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
+       security_skb_classify_flow(oldskb, flowi6_to_flowi_common(&fl6));
        dst = ip6_route_output(net, NULL, &fl6);
        if (dst->error) {
                dst_release(dst);

diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 6caa062..6ac88fe 100644 (file)
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -111,7 +111,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        fl6.flowi6_uid = sk->sk_uid;
        fl6.fl6_icmp_type = user_icmph.icmp6_type;
        fl6.fl6_icmp_code = user_icmph.icmp6_code;
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        ipcm6_init_sk(&ipc6, np);
        ipc6.sockc.mark = sk->sk_mark;

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6e4ab80..1f56d9a 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -915,7 +915,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                fl6.flowi6_oif = np->mcast_oif;
        else if (!fl6.flowi6_oif)
                fl6.flowi6_oif = np->ucast_oif;
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        if (hdrincl)
                fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH;

diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 9b6cae1..e8cfb9e 100644 (file)
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -233,7 +233,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                fl6.fl6_dport = ireq->ir_rmt_port;
                fl6.fl6_sport = inet_sk(sk)->inet_sport;
                fl6.flowi6_uid = sk->sk_uid;
-               security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+               security_req_classify_flow(req, flowi6_to_flowi_common(&fl6));
 
                dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
                if (IS_ERR(dst))

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e254569..0e1509b 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -278,7 +278,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
        final_p = fl6_update_dst(&fl6, opt, &final);
 
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
        if (IS_ERR(dst)) {
@@ -965,7 +965,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
        fl6.fl6_dport = t1->dest;
        fl6.fl6_sport = t1->source;
        fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
-       security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
+       security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));
 
        /* Pass a socket to ip6_dst_lookup either it is for RST
         * Underlying function will use this to retrieve the network

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9008f57..b9f3dfd 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1498,7 +1498,7 @@ do_udp_sendmsg:
        } else if (!fl6.flowi6_oif)
                fl6.flowi6_oif = np->ucast_oif;
 
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        if (ipc6.tclass < 0)
                ipc6.tclass = np->tclass;

diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index e5e5036..96f9757 100644 (file)
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -606,7 +606,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        else if (!fl6.flowi6_oif)
                fl6.flowi6_oif = np->ucast_oif;
 
-       security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+       security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));
 
        if (ipc6.tclass < 0)
                ipc6.tclass = np->tclass;

diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index d7d34a6..b100c04 100644 (file)
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -849,7 +849,7 @@ synproxy_send_tcp_ipv6(struct net *net,
        fl6.fl6_sport = nth->source;
        fl6.fl6_dport = nth->dest;
        security_skb_classify_flow((struct sk_buff *)skb,
-                                  flowi6_to_flowi(&fl6));
+                                  flowi6_to_flowi_common(&fl6));
        err = nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
        if (err) {
                goto free_nskb;

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 2f15178..d01ca1a 100644 (file)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1021,7 +1021,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
                if ((x->sel.family &&
                     (x->sel.family != family ||
                      !xfrm_selector_match(&x->sel, fl, family))) ||
-                   !security_xfrm_state_pol_flow_match(x, pol, fl))
+                   !security_xfrm_state_pol_flow_match(x, pol,
+                                                       &fl->u.__fl_common))
                        return;
 
                if (!*best ||
@@ -1036,7 +1037,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
                if ((!x->sel.family ||
                     (x->sel.family == family &&
                      xfrm_selector_match(&x->sel, fl, family))) &&
-                   security_xfrm_state_pol_flow_match(x, pol, fl))
+                   security_xfrm_state_pol_flow_match(x, pol,
+                                                      &fl->u.__fl_common))
                        *error = -ESRCH;
        }
 }

diff --git a/security/security.c b/security/security.c
index fe33c0a..7b09cfb 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -2208,15 +2208,16 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
 }
 EXPORT_SYMBOL(security_sk_clone);
 
-void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
+void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic)
 {
-       call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
+       call_void_hook(sk_getsecid, sk, &flic->flowic_secid);
 }
 EXPORT_SYMBOL(security_sk_classify_flow);
 
-void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+void security_req_classify_flow(const struct request_sock *req,
+                               struct flowi_common *flic)
 {
-       call_void_hook(req_classify_flow, req, fl);
+       call_void_hook(req_classify_flow, req, flic);
 }
 EXPORT_SYMBOL(security_req_classify_flow);
 
@@ -2408,7 +2409,7 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                       struct xfrm_policy *xp,
-                                      const struct flowi *fl)
+                                      const struct flowi_common *flic)
 {
        struct security_hook_list *hp;
        int rc = LSM_RET_DEFAULT(xfrm_state_pol_flow_match);
@@ -2424,7 +2425,7 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
         */
        hlist_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
                                list) {
-               rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
+               rc = hp->hook.xfrm_state_pol_flow_match(x, xp, flic);
                break;
        }
        return rc;
@@ -2435,9 +2436,9 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
        return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
 }
 
-void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
+void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic)
 {
-       int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
+       int rc = call_int_hook(xfrm_decode_session, 0, skb, &flic->flowic_secid,
                                0);
 
        BUG_ON(rc);

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6fa5930..644b17e 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -600,7 +600,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 {
        const struct cred *cred = current_cred();
        struct superblock_security_struct *sbsec = sb->s_security;
-       struct dentry *root = sbsec->sb->s_root;
+       struct dentry *root = sb->s_root;
        struct selinux_mnt_opts *opts = mnt_opts;
        struct inode_security_struct *root_isec;
        u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
@@ -1080,7 +1080,7 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
                        return rc;
        }
        if (sbsec->flags & ROOTCONTEXT_MNT) {
-               struct dentry *root = sbsec->sb->s_root;
+               struct dentry *root = sb->s_root;
                struct inode_security_struct *isec = backing_inode_security(root);
                seq_putc(m, ',');
                seq_puts(m, ROOTCONTEXT_STR);
@@ -1451,7 +1451,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                         * inode_doinit with a dentry, before these inodes could
                         * be used again by userspace.
                         */
-                       goto out;
+                       goto out_invalid;
                }
 
                rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1508,7 +1508,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                         * could be used again by userspace.
                         */
                        if (!dentry)
-                               goto out;
+                               goto out_invalid;
                        rc = selinux_genfs_get_sid(dentry, sclass,
                                                   sbsec->flags, &sid);
                        if (rc) {
@@ -1533,11 +1533,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 out:
        spin_lock(&isec->lock);
        if (isec->initialized == LABEL_PENDING) {
-               if (!sid || rc) {
+               if (rc) {
                        isec->initialized = LABEL_INVALID;
                        goto out_unlock;
                }
-
                isec->initialized = LABEL_INITIALIZED;
                isec->sid = sid;
        }
@@ -1545,6 +1544,15 @@ out:
 out_unlock:
        spin_unlock(&isec->lock);
        return rc;
+
+out_invalid:
+       spin_lock(&isec->lock);
+       if (isec->initialized == LABEL_PENDING) {
+               isec->initialized = LABEL_INVALID;
+               isec->sid = sid;
+       }
+       spin_unlock(&isec->lock);
+       return 0;
 }
 
 /* Convert a Linux signal to an access vector. */
@@ -2560,7 +2568,6 @@ static int selinux_sb_alloc_security(struct super_block *sb)
        mutex_init(&sbsec->lock);
        INIT_LIST_HEAD(&sbsec->isec_head);
        spin_lock_init(&sbsec->isec_lock);
-       sbsec->sb = sb;
        sbsec->sid = SECINITSID_UNLABELED;
        sbsec->def_sid = SECINITSID_FILE;
        sbsec->mntpoint_sid = SECINITSID_UNLABELED;
@@ -4029,6 +4036,7 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
        switch (id) {
        case LOADING_MODULE:
                rc = selinux_kernel_module_from_file(NULL);
+               break;
        default:
                break;
        }
@@ -5429,9 +5437,9 @@ static void selinux_secmark_refcount_dec(void)
 }
 
 static void selinux_req_classify_flow(const struct request_sock *req,
-                                     struct flowi *fl)
+                                     struct flowi_common *flic)
 {
-       fl->flowi_secid = req->secid;
+       flic->flowic_secid = req->secid;
 }
 
 static int selinux_tun_dev_alloc_security(void **security)

diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 330b7b6..ca4d7ab 100644 (file)
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -61,7 +61,6 @@ struct file_security_struct {
 };
 
 struct superblock_security_struct {
-       struct super_block *sb;         /* back pointer to sb object */
        u32 sid;                        /* SID of file system superblock */
        u32 def_sid;                    /* default SID for labeling */
        u32 mntpoint_sid;               /* SECURITY_FS_USE_MNTPOINT context for files */

diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index a0b4653..0a6f34a 100644 (file)
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -26,7 +26,7 @@ int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                      struct xfrm_policy *xp,
-                                     const struct flowi *fl);
+                                     const struct flowi_common *flic);
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 extern atomic_t selinux_xfrm_refcount;

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 9704c8a..597b797 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -596,9 +596,7 @@ void services_compute_xperms_drivers(
                                        node->datum.u.xperms->driver);
        }
 
-       /* If no ioctl commands are allowed, ignore auditallow and auditdeny */
-       if (node->key.specified & AVTAB_XPERMS_ALLOWED)
-               xperms->len = 1;
+       xperms->len = 1;
 }
 
 /*

diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 7314196..c367d36 100644 (file)
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -175,9 +175,10 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  */
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                      struct xfrm_policy *xp,
-                                     const struct flowi *fl)
+                                     const struct flowi_common *flic)
 {
        u32 state_sid;
+       u32 flic_sid;
 
        if (!xp->security)
                if (x->security)
@@ -196,17 +197,17 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                return 0;
 
        state_sid = x->security->ctx_sid;
+       flic_sid = flic->flowic_secid;
 
-       if (fl->flowi_secid != state_sid)
+       if (flic_sid != state_sid)
                return 0;
 
        /* We don't need a separate SA Vs. policy polmatch check since the SA
         * is now of the same label as the flow and a flow Vs. policy polmatch
         * check had already happened in selinux_xfrm_policy_lookup() above. */
-       return (avc_has_perm(&selinux_state,
-                            fl->flowi_secid, state_sid,
-                           SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
-                           NULL) ? 0 : 1);
+       return (avc_has_perm(&selinux_state, flic_sid, state_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
+                            NULL) ? 0 : 1);
 }
 
 static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb)