linux-stable/net/netlabel/netlabel_user.h
Paul Moore 6326948f94 lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()
The security_task_getsecid_subj() LSM hook invites misuse by allowing
callers to specify a task even though the hook is only safe when the
current task is referenced.  Fix this by removing the task_struct
argument to the hook, requiring LSM implementations to use the
current task.  While we are changing the hook declaration we also
rename the function to security_current_getsecid_subj() in an effort
to reinforce that the hook captures the subjective credentials of the
current task and not an arbitrary task on the system.

Reviewed-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
2021-11-22 17:52:47 -05:00

49 lines
1.2 KiB
C

/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
* NetLabel NETLINK Interface
*
* This file defines the NETLINK interface for the NetLabel system. The
* NetLabel system manages static and dynamic label mappings for network
* protocols such as CIPSO and RIPSO.
*
* Author: Paul Moore <paul@paul-moore.com>
*/
/*
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
*/
#ifndef _NETLABEL_USER_H
#define _NETLABEL_USER_H
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/capability.h>
#include <linux/audit.h>
#include <net/netlink.h>
#include <net/genetlink.h>
#include <net/netlabel.h>
/* NetLabel NETLINK helper functions */
/**
* netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg
* @audit_info: NetLabel audit information
*/
static inline void netlbl_netlink_auditinfo(struct netlbl_audit *audit_info)
{
security_current_getsecid_subj(&audit_info->secid);
audit_info->loginuid = audit_get_loginuid(current);
audit_info->sessionid = audit_get_sessionid(current);
}
/* NetLabel NETLINK I/O functions */
int netlbl_netlink_init(void);
/* NetLabel Audit Functions */
struct audit_buffer *netlbl_audit_start_common(int type,
struct netlbl_audit *audit_info);
#endif