Commit 1bc8c83a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'lsm-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm 

Pull lsm update from Paul Moore:
 "One minor LSM framework patch to move the selinux_netlink_send() hook
  under the CONFIG_SECURITY_NETWORK Kconfig knob"

* tag 'lsm-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: Move security_netlink_send to under CONFIG_SECURITY_NETWORK
parents 7af6e3fe 74e5b13a

include/linux/security.h

+6 −6
Original line number Diff line number Diff line
@@ -563,7 +563,6 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx, 
int security_getprocattr(struct task_struct *p, int lsmid, const char *name,

			 char **value);

int security_setprocattr(int lsmid, const char *name, void *value, size_t size);

int security_netlink_send(struct sock *sk, struct sk_buff *skb);

int security_ismaclabel(const char *name);

int security_secid_to_secctx(u32 secid, struct lsm_context *cp);

int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp);
@@ -1527,11 +1526,6 @@ static inline int security_setprocattr(int lsmid, char *name, void *value, 
	return -EINVAL;

}



static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)

{

	return 0;

}



static inline int security_ismaclabel(const char *name)

{

	return 0;
@@ -1629,6 +1623,7 @@ static inline int security_watch_key(struct key *key) 


#ifdef CONFIG_SECURITY_NETWORK



int security_netlink_send(struct sock *sk, struct sk_buff *skb);

int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);

int security_unix_may_send(struct socket *sock,  struct socket *other);

int security_socket_create(int family, int type, int protocol, int kern);
@@ -1684,6 +1679,11 @@ int security_sctp_assoc_established(struct sctp_association *asoc, 
int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);



#else	/* CONFIG_SECURITY_NETWORK */

static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)

{

	return 0;

}



static inline int security_unix_stream_connect(struct sock *sock,

					       struct sock *other,

					       struct sock *newsk)

security/security.c

+18 −18
Original line number Diff line number Diff line
@@ -4276,24 +4276,6 @@ int security_setprocattr(int lsmid, const char *name, void *value, size_t size) 
	return LSM_RET_DEFAULT(setprocattr);

}



/**

 * security_netlink_send() - Save info and check if netlink sending is allowed

 * @sk: sending socket

 * @skb: netlink message

 *

 * Save security information for a netlink message so that permission checking

 * can be performed when the message is processed.  The security information

 * can be saved using the eff_cap field of the netlink_skb_parms structure.

 * Also may be used to provide fine grained control over message transmission.

 *

 * Return: Returns 0 if the information was successfully saved and message is

 *         allowed to be transmitted.

 */

int security_netlink_send(struct sock *sk, struct sk_buff *skb)

{

	return call_int_hook(netlink_send, sk, skb);

}



/**

 * security_ismaclabel() - Check if the named attribute is a MAC label

 * @name: full extended attribute name
@@ -4483,6 +4465,24 @@ int security_watch_key(struct key *key) 
#endif /* CONFIG_KEY_NOTIFICATIONS */



#ifdef CONFIG_SECURITY_NETWORK

/**

 * security_netlink_send() - Save info and check if netlink sending is allowed

 * @sk: sending socket

 * @skb: netlink message

 *

 * Save security information for a netlink message so that permission checking

 * can be performed when the message is processed.  The security information

 * can be saved using the eff_cap field of the netlink_skb_parms structure.

 * Also may be used to provide fine grained control over message transmission.

 *

 * Return: Returns 0 if the information was successfully saved and message is

 *         allowed to be transmitted.

 */

int security_netlink_send(struct sock *sk, struct sk_buff *skb)

{

	return call_int_hook(netlink_send, sk, skb);

}



/**

 * security_unix_stream_connect() - Check if a AF_UNIX stream is allowed

 * @sock: originating sock