tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

SELinux: restore proper NetLabel caching behavior

A small fix to the SELinux/NetLabel glue code to ensure that the NetLabel
cache is utilized when possible. This was broken when the SELinux/NetLabel
glue code was reorganized in the last kernel release.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

authored by

Paul Moore and committed by
James Morris 9534f71c 1ed43950

+14 -4
+2
include/net/netlabel.h
··· 132 132 #define NETLBL_SECATTR_CACHE 0x00000002 133 133 #define NETLBL_SECATTR_MLS_LVL 0x00000004 134 134 #define NETLBL_SECATTR_MLS_CAT 0x00000008 135 + #define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ 136 + NETLBL_SECATTR_MLS_CAT) 135 137 struct netlbl_lsm_secattr { 136 138 u32 flags; 137 139
+12 -4
security/selinux/netlabel.c
··· 162 162 163 163 netlbl_secattr_init(&secattr); 164 164 rc = netlbl_skbuff_getattr(skb, &secattr); 165 - if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) 165 + if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) { 166 166 rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid); 167 - else 167 + if (rc == 0 && 168 + (secattr.flags & NETLBL_SECATTR_CACHEABLE) && 169 + (secattr.flags & NETLBL_SECATTR_CACHE)) 170 + netlbl_cache_add(skb, &secattr); 171 + } else 168 172 *sid = SECSID_NULL; 169 173 netlbl_secattr_destroy(&secattr); 170 174 ··· 311 307 312 308 netlbl_secattr_init(&secattr); 313 309 rc = netlbl_skbuff_getattr(skb, &secattr); 314 - if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) 310 + if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) { 315 311 rc = security_netlbl_secattr_to_sid(&secattr, 316 312 SECINITSID_NETMSG, 317 313 &nlbl_sid); 318 - else 314 + if (rc == 0 && 315 + (secattr.flags & NETLBL_SECATTR_CACHEABLE) && 316 + (secattr.flags & NETLBL_SECATTR_CACHE)) 317 + netlbl_cache_add(skb, &secattr); 318 + } else 319 319 nlbl_sid = SECINITSID_UNLABELED; 320 320 netlbl_secattr_destroy(&secattr); 321 321 if (rc != 0)