Pull SELinux updates from Paul Moore: "Six SELinux patches, all are simple and easily understood, but a list of the highlights is below: - Use 'grep -E' instead of 'egrep' in the SELinux policy install script. Fun fact, this seems to be GregKH's *second* dedicated SELinux patch since we transitioned to git (ignoring merges, the SPDX stuff, and a trivial fs reference removal when lustre was yanked); the first was back in 2011 when selinuxfs was placed in /sys/fs/selinux. Oh, the memories ... - Convert the SELinux policy boolean values to use signed integer types throughout the SELinux kernel code. Prior to this we were using a mix of signed and unsigned integers which was probably okay in this particular case, but it is definitely not a good idea in general. - Remove a reference to the SELinux runtime disable functionality in /etc/selinux/config as we are in the process of deprecating that. See [1] for more background on this if you missed the previous notes on the deprecation. - Minor cleanups: remove unneeded variables and function parameter constification" Link: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable [1] * tag 'selinux-pr-20221003' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: remove runtime disable message in the install_policy.sh script selinux: use "grep -E" instead of "egrep" selinux: remove the unneeded result variable selinux: declare read-only parameters const selinux: use int arrays for boolean values selinux: remove an unneeded variable in sel_make_class_dir_entries()
Unified · Split
| @@ -31,8 +31,7 @@ fi · 30 unmodified lines | ||
| 31 | 31 | if selinuxenabled; then |
| 32 | 32 | echo "SELinux is already enabled" |
| 33 | 33 | echo "This prevents safely relabeling all files." |
| 34 | − echo "Boot with selinux=0 on the kernel command-line or" | |
| 35 | − echo "SELINUX=disabled in /etc/selinux/config." | |
| 34 | + echo "Boot with selinux=0 on the kernel command-line." | |
| 36 | 35 | exit 1 |
| 37 | 36 | fi |
| 38 | 37 | |
| @@ -78,7 +77,7 @@ cd /etc/selinux/dummy/contexts/files · 39 unmodified lines | ||
| 78 | 77 | $SF -F file_contexts / |
| 79 | 78 | |
| 80 | 79 | mounts=`cat /proc/$$/mounts | \ |
| 81 | − egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ | |
| 80 | + grep -E "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ | |
| 82 | 81 | awk '{ print $2 '}` |
| 83 | 82 | $SF -F file_contexts $mounts |
| 84 | 83 | |
| @@ -5987,7 +5987,6 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) · 5986 unmodified lines | ||
| 5987 | 5987 | struct ipc_security_struct *isec; |
| 5988 | 5988 | struct common_audit_data ad; |
| 5989 | 5989 | u32 sid = current_sid(); |
| 5990 | − int rc; | |
| 5991 | 5990 | |
| 5992 | 5991 | isec = selinux_ipc(msq); |
| 5993 | 5992 | ipc_init_security(isec, SECCLASS_MSGQ); |
| @@ -5995,10 +5994,9 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) · 1 unmodified line | ||
| 5995 | 5994 | ad.type = LSM_AUDIT_DATA_IPC; |
| 5996 | 5995 | ad.u.ipc_id = msq->key; |
| 5997 | 5996 | |
| 5998 | − rc = avc_has_perm(&selinux_state, | |
| 5999 | − sid, isec->sid, SECCLASS_MSGQ, | |
| 6000 | − MSGQ__CREATE, &ad); | |
| 6001 | − return rc; | |
| 5997 | + return avc_has_perm(&selinux_state, | |
| 5998 | + sid, isec->sid, SECCLASS_MSGQ, | |
| 5999 | + MSGQ__CREATE, &ad); | |
| 6002 | 6000 | } |
| 6003 | 6001 | |
| 6004 | 6002 | static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg) |
| @@ -6126,7 +6124,6 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) · 121 unmodified lines | ||
| 6126 | 6124 | struct ipc_security_struct *isec; |
| 6127 | 6125 | struct common_audit_data ad; |
| 6128 | 6126 | u32 sid = current_sid(); |
| 6129 | − int rc; | |
| 6130 | 6127 | |
| 6131 | 6128 | isec = selinux_ipc(shp); |
| 6132 | 6129 | ipc_init_security(isec, SECCLASS_SHM); |
| @@ -6134,10 +6131,9 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) · 1 unmodified line | ||
| 6134 | 6131 | ad.type = LSM_AUDIT_DATA_IPC; |
| 6135 | 6132 | ad.u.ipc_id = shp->key; |
| 6136 | 6133 | |
| 6137 | − rc = avc_has_perm(&selinux_state, | |
| 6138 | − sid, isec->sid, SECCLASS_SHM, | |
| 6139 | − SHM__CREATE, &ad); | |
| 6140 | − return rc; | |
| 6134 | + return avc_has_perm(&selinux_state, | |
| 6135 | + sid, isec->sid, SECCLASS_SHM, | |
| 6136 | + SHM__CREATE, &ad); | |
| 6141 | 6137 | } |
| 6142 | 6138 | |
| 6143 | 6139 | static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg) |
| @@ -6211,7 +6207,6 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) · 67 unmodified lines | ||
| 6211 | 6207 | struct ipc_security_struct *isec; |
| 6212 | 6208 | struct common_audit_data ad; |
| 6213 | 6209 | u32 sid = current_sid(); |
| 6214 | − int rc; | |
| 6215 | 6210 | |
| 6216 | 6211 | isec = selinux_ipc(sma); |
| 6217 | 6212 | ipc_init_security(isec, SECCLASS_SEM); |
| @@ -6219,10 +6214,9 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) · 1 unmodified line | ||
| 6219 | 6214 | ad.type = LSM_AUDIT_DATA_IPC; |
| 6220 | 6215 | ad.u.ipc_id = sma->key; |
| 6221 | 6216 | |
| 6222 | − rc = avc_has_perm(&selinux_state, | |
| 6223 | − sid, isec->sid, SECCLASS_SEM, | |
| 6224 | − SEM__CREATE, &ad); | |
| 6225 | − return rc; | |
| 6217 | + return avc_has_perm(&selinux_state, | |
| 6218 | + sid, isec->sid, SECCLASS_SEM, | |
| 6219 | + SEM__CREATE, &ad); | |
| 6226 | 6220 | } |
| 6227 | 6221 | |
| 6228 | 6222 | static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg) |
| @@ -71,7 +71,7 @@ struct selinux_fs_info { · 70 unmodified lines | ||
| 71 | 71 | struct dentry *bool_dir; |
| 72 | 72 | unsigned int bool_num; |
| 73 | 73 | char **bool_pending_names; |
| 74 | − unsigned int *bool_pending_values; | |
| 74 | + int *bool_pending_values; | |
| 75 | 75 | struct dentry *class_dir; |
| 76 | 76 | unsigned long last_class_ino; |
| 77 | 77 | bool policy_opened; |
| @@ -356,7 +356,7 @@ static const struct file_operations sel_policyvers_ops = { · 278 unmodified lines | ||
| 356 | 356 | /* declaration for sel_write_load */ |
| 357 | 357 | static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir, |
| 358 | 358 | unsigned int *bool_num, char ***bool_pending_names, |
| 359 | − unsigned int **bool_pending_values); | |
| 359 | + int **bool_pending_values); | |
| 360 | 360 | static int sel_make_classes(struct selinux_policy *newpolicy, |
| 361 | 361 | struct dentry *class_dir, |
| 362 | 362 | unsigned long *last_class_ino); |
| @@ -527,7 +527,7 @@ static const struct file_operations sel_policy_ops = { · 164 unmodified lines | ||
| 527 | 527 | }; |
| 528 | 528 | |
| 529 | 529 | static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names, |
| 530 | − unsigned int *bool_values) | |
| 530 | + int *bool_values) | |
| 531 | 531 | { |
| 532 | 532 | u32 i; |
| 533 | 533 | |
| @@ -545,7 +545,7 @@ static int sel_make_policy_nodes(struct selinux_fs_info *fsi, · 11 unmodified lines | ||
| 545 | 545 | struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir, *old_dentry; |
| 546 | 546 | unsigned int tmp_bool_num, old_bool_num; |
| 547 | 547 | char **tmp_bool_names, **old_bool_names; |
| 548 | − unsigned int *tmp_bool_values, *old_bool_values; | |
| 548 | + int *tmp_bool_values, *old_bool_values; | |
| 549 | 549 | unsigned long tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */ |
| 550 | 550 | |
| 551 | 551 | tmp_parent = sel_make_disconnected_dir(fsi->sb, &tmp_ino); |
| @@ -1423,7 +1423,7 @@ static void sel_remove_entries(struct dentry *de) · 871 unmodified lines | ||
| 1423 | 1423 | |
| 1424 | 1424 | static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir, |
| 1425 | 1425 | unsigned int *bool_num, char ***bool_pending_names, |
| 1426 | − unsigned int **bool_pending_values) | |
| 1426 | + int **bool_pending_values) | |
| 1427 | 1427 | { |
| 1428 | 1428 | int ret; |
| 1429 | 1429 | ssize_t len; |
| @@ -1917,7 +1917,6 @@ static int sel_make_class_dir_entries(struct selinux_policy *newpolicy, · 487 unmodified lines | ||
| 1917 | 1917 | struct selinux_fs_info *fsi = sb->s_fs_info; |
| 1918 | 1918 | struct dentry *dentry = NULL; |
| 1919 | 1919 | struct inode *inode = NULL; |
| 1920 | − int rc; | |
| 1921 | 1920 | |
| 1922 | 1921 | dentry = d_alloc_name(dir, "index"); |
| 1923 | 1922 | if (!dentry) |
| @@ -1937,9 +1936,7 @@ static int sel_make_class_dir_entries(struct selinux_policy *newpolicy, · 13 unmodified lines | ||
| 1937 | 1936 | if (IS_ERR(dentry)) |
| 1938 | 1937 | return PTR_ERR(dentry); |
| 1939 | 1938 | |
| 1940 | − rc = sel_make_perm_files(newpolicy, classname, index, dentry); | |
| 1941 | − | |
| 1942 | − return rc; | |
| 1939 | + return sel_make_perm_files(newpolicy, classname, index, dentry); | |
| 1943 | 1940 | } |
| 1944 | 1941 | |
| 1945 | 1942 | static int sel_make_classes(struct selinux_policy *newpolicy, |
| @@ -38,7 +38,7 @@ static inline void mls_context_init(struct context *c) · 37 unmodified lines | ||
| 38 | 38 | memset(&c->range, 0, sizeof(c->range)); |
| 39 | 39 | } |
| 40 | 40 | |
| 41 | −static inline int mls_context_cpy(struct context *dst, struct context *src) | |
| 41 | +static inline int mls_context_cpy(struct context *dst, const struct context *src) | |
| 42 | 42 | { |
| 43 | 43 | int rc; |
| 44 | 44 | |
| @@ -58,7 +58,7 @@ out: · 13 unmodified lines | ||
| 58 | 58 | /* |
| 59 | 59 | * Sets both levels in the MLS range of 'dst' to the low level of 'src'. |
| 60 | 60 | */ |
| 61 | −static inline int mls_context_cpy_low(struct context *dst, struct context *src) | |
| 61 | +static inline int mls_context_cpy_low(struct context *dst, const struct context *src) | |
| 62 | 62 | { |
| 63 | 63 | int rc; |
| 64 | 64 | |
| @@ -78,7 +78,7 @@ out: · 13 unmodified lines | ||
| 78 | 78 | /* |
| 79 | 79 | * Sets both levels in the MLS range of 'dst' to the high level of 'src'. |
| 80 | 80 | */ |
| 81 | −static inline int mls_context_cpy_high(struct context *dst, struct context *src) | |
| 81 | +static inline int mls_context_cpy_high(struct context *dst, const struct context *src) | |
| 82 | 82 | { |
| 83 | 83 | int rc; |
| 84 | 84 | |
| @@ -97,9 +97,10 @@ out: · 12 unmodified lines | ||
| 97 | 97 | |
| 98 | 98 | |
| 99 | 99 | static inline int mls_context_glblub(struct context *dst, |
| 100 | − struct context *c1, struct context *c2) | |
| 100 | + const struct context *c1, const struct context *c2) | |
| 101 | 101 | { |
| 102 | − struct mls_range *dr = &dst->range, *r1 = &c1->range, *r2 = &c2->range; | |
| 102 | + struct mls_range *dr = &dst->range; | |
| 103 | + const struct mls_range *r1 = &c1->range, *r2 = &c2->range; | |
| 103 | 104 | int rc = 0; |
| 104 | 105 | |
| 105 | 106 | if (r1->level[1].sens < r2->level[0].sens || |
| @@ -127,7 +128,7 @@ out: · 21 unmodified lines | ||
| 127 | 128 | return rc; |
| 128 | 129 | } |
| 129 | 130 | |
| 130 | −static inline int mls_context_cmp(struct context *c1, struct context *c2) | |
| 131 | +static inline int mls_context_cmp(const struct context *c1, const struct context *c2) | |
| 131 | 132 | { |
| 132 | 133 | return ((c1->range.level[0].sens == c2->range.level[0].sens) && |
| 133 | 134 | ebitmap_cmp(&c1->range.level[0].cat, &c2->range.level[0].cat) && |
| @@ -147,7 +148,7 @@ static inline void context_init(struct context *c) · 13 unmodified lines | ||
| 147 | 148 | memset(c, 0, sizeof(*c)); |
| 148 | 149 | } |
| 149 | 150 | |
| 150 | −static inline int context_cpy(struct context *dst, struct context *src) | |
| 151 | +static inline int context_cpy(struct context *dst, const struct context *src) | |
| 151 | 152 | { |
| 152 | 153 | int rc; |
| 153 | 154 | |
| @@ -180,7 +181,7 @@ static inline void context_destroy(struct context *c) · 26 unmodified lines | ||
| 180 | 181 | mls_context_destroy(c); |
| 181 | 182 | } |
| 182 | 183 | |
| 183 | −static inline int context_cmp(struct context *c1, struct context *c2) | |
| 184 | +static inline int context_cmp(const struct context *c1, const struct context *c2) | |
| 184 | 185 | { |
| 185 | 186 | if (c1->len && c2->len) |
| 186 | 187 | return (c1->len == c2->len && !strcmp(c1->str, c2->str)); |
| @@ -28,9 +28,9 @@ · 27 unmodified lines | ||
| 28 | 28 | |
| 29 | 29 | static struct kmem_cache *ebitmap_node_cachep __ro_after_init; |
| 30 | 30 | |
| 31 | −int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2) | |
| 31 | +int ebitmap_cmp(const struct ebitmap *e1, const struct ebitmap *e2) | |
| 32 | 32 | { |
| 33 | − struct ebitmap_node *n1, *n2; | |
| 33 | + const struct ebitmap_node *n1, *n2; | |
| 34 | 34 | |
| 35 | 35 | if (e1->highbit != e2->highbit) |
| 36 | 36 | return 0; |
| @@ -50,9 +50,10 @@ int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2) · 13 unmodified lines | ||
| 50 | 50 | return 1; |
| 51 | 51 | } |
| 52 | 52 | |
| 53 | −int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src) | |
| 53 | +int ebitmap_cpy(struct ebitmap *dst, const struct ebitmap *src) | |
| 54 | 54 | { |
| 55 | − struct ebitmap_node *n, *new, *prev; | |
| 55 | + struct ebitmap_node *new, *prev; | |
| 56 | + const struct ebitmap_node *n; | |
| 56 | 57 | |
| 57 | 58 | ebitmap_init(dst); |
| 58 | 59 | n = src->node; |
| @@ -78,7 +79,7 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src) · 19 unmodified lines | ||
| 78 | 79 | return 0; |
| 79 | 80 | } |
| 80 | 81 | |
| 81 | −int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2) | |
| 82 | +int ebitmap_and(struct ebitmap *dst, const struct ebitmap *e1, const struct ebitmap *e2) | |
| 82 | 83 | { |
| 83 | 84 | struct ebitmap_node *n; |
| 84 | 85 | int bit, rc; |
| @@ -217,9 +218,9 @@ netlbl_import_failure: · 132 unmodified lines | ||
| 217 | 218 | * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed |
| 218 | 219 | * last_e2bit. |
| 219 | 220 | */ |
| 220 | −int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit) | |
| 221 | +int ebitmap_contains(const struct ebitmap *e1, const struct ebitmap *e2, u32 last_e2bit) | |
| 221 | 222 | { |
| 222 | − struct ebitmap_node *n1, *n2; | |
| 223 | + const struct ebitmap_node *n1, *n2; | |
| 223 | 224 | int i; |
| 224 | 225 | |
| 225 | 226 | if (e1->highbit < e2->highbit) |
| @@ -258,9 +259,9 @@ int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit) · 32 unmodified lines | ||
| 258 | 259 | return 1; |
| 259 | 260 | } |
| 260 | 261 | |
| 261 | −int ebitmap_get_bit(struct ebitmap *e, unsigned long bit) | |
| 262 | +int ebitmap_get_bit(const struct ebitmap *e, unsigned long bit) | |
| 262 | 263 | { |
| 263 | − struct ebitmap_node *n; | |
| 264 | + const struct ebitmap_node *n; | |
| 264 | 265 | |
| 265 | 266 | if (e->highbit < bit) |
| 266 | 267 | return 0; |
| @@ -467,7 +468,7 @@ bad: · 200 unmodified lines | ||
| 467 | 468 | goto out; |
| 468 | 469 | } |
| 469 | 470 | |
| 470 | −int ebitmap_write(struct ebitmap *e, void *fp) | |
| 471 | +int ebitmap_write(const struct ebitmap *e, void *fp) | |
| 471 | 472 | { |
| 472 | 473 | struct ebitmap_node *n; |
| 473 | 474 | u32 count; |
| @@ -44,7 +44,7 @@ struct ebitmap { · 43 unmodified lines | ||
| 44 | 44 | |
| 45 | 45 | #define ebitmap_length(e) ((e)->highbit) |
| 46 | 46 | |
| 47 | −static inline unsigned int ebitmap_start_positive(struct ebitmap *e, | |
| 47 | +static inline unsigned int ebitmap_start_positive(const struct ebitmap *e, | |
| 48 | 48 | struct ebitmap_node **n) |
| 49 | 49 | { |
| 50 | 50 | unsigned int ofs; |
| @@ -62,7 +62,7 @@ static inline void ebitmap_init(struct ebitmap *e) · 11 unmodified lines | ||
| 62 | 62 | memset(e, 0, sizeof(*e)); |
| 63 | 63 | } |
| 64 | 64 | |
| 65 | −static inline unsigned int ebitmap_next_positive(struct ebitmap *e, | |
| 65 | +static inline unsigned int ebitmap_next_positive(const struct ebitmap *e, | |
| 66 | 66 | struct ebitmap_node **n, |
| 67 | 67 | unsigned int bit) |
| 68 | 68 | { |
| @@ -85,7 +85,7 @@ static inline unsigned int ebitmap_next_positive(struct ebitmap *e, · 16 unmodified lines | ||
| 85 | 85 | #define EBITMAP_NODE_OFFSET(node, bit) \ |
| 86 | 86 | (((bit) - (node)->startbit) % EBITMAP_UNIT_SIZE) |
| 87 | 87 | |
| 88 | −static inline int ebitmap_node_get_bit(struct ebitmap_node *n, | |
| 88 | +static inline int ebitmap_node_get_bit(const struct ebitmap_node *n, | |
| 89 | 89 | unsigned int bit) |
| 90 | 90 | { |
| 91 | 91 | unsigned int index = EBITMAP_NODE_INDEX(n, bit); |
| @@ -122,15 +122,15 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n, · 30 unmodified lines | ||
| 122 | 122 | (bit) < ebitmap_length(e); \ |
| 123 | 123 | (bit) = ebitmap_next_positive(e, &(n), bit)) \ |
| 124 | 124 | |
| 125 | −int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2); | |
| 126 | −int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src); | |
| 127 | −int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2); | |
| 128 | −int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit); | |
| 129 | −int ebitmap_get_bit(struct ebitmap *e, unsigned long bit); | |
| 125 | +int ebitmap_cmp(const struct ebitmap *e1, const struct ebitmap *e2); | |
| 126 | +int ebitmap_cpy(struct ebitmap *dst, const struct ebitmap *src); | |
| 127 | +int ebitmap_and(struct ebitmap *dst, const struct ebitmap *e1, const struct ebitmap *e2); | |
| 128 | +int ebitmap_contains(const struct ebitmap *e1, const struct ebitmap *e2, u32 last_e2bit); | |
| 129 | +int ebitmap_get_bit(const struct ebitmap *e, unsigned long bit); | |
| 130 | 130 | int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value); |
| 131 | 131 | void ebitmap_destroy(struct ebitmap *e); |
| 132 | 132 | int ebitmap_read(struct ebitmap *e, void *fp); |
| 133 | −int ebitmap_write(struct ebitmap *e, void *fp); | |
| 133 | +int ebitmap_write(const struct ebitmap *e, void *fp); | |
| 134 | 134 | u32 ebitmap_hash(const struct ebitmap *e, u32 hash); |
| 135 | 135 | |
| 136 | 136 | #ifdef CONFIG_NETLABEL |
| @@ -27,13 +27,13 @@ struct mls_range { · 26 unmodified lines | ||
| 27 | 27 | struct mls_level level[2]; /* low == level[0], high == level[1] */ |
| 28 | 28 | }; |
| 29 | 29 | |
| 30 | −static inline int mls_level_eq(struct mls_level *l1, struct mls_level *l2) | |
| 30 | +static inline int mls_level_eq(const struct mls_level *l1, const struct mls_level *l2) | |
| 31 | 31 | { |
| 32 | 32 | return ((l1->sens == l2->sens) && |
| 33 | 33 | ebitmap_cmp(&l1->cat, &l2->cat)); |
| 34 | 34 | } |
| 35 | 35 | |
| 36 | −static inline int mls_level_dom(struct mls_level *l1, struct mls_level *l2) | |
| 36 | +static inline int mls_level_dom(const struct mls_level *l1, const struct mls_level *l2) | |
| 37 | 37 | { |
| 38 | 38 | return ((l1->sens >= l2->sens) && |
| 39 | 39 | ebitmap_contains(&l1->cat, &l2->cat, 0)); |