From 3f8660dcc1ab4b85258617322757f36531be7e24 Mon Sep 17 00:00:00 2001 From: Casey Schaufler Date: Sun, 20 Aug 2023 14:45:09 -0700 Subject: [PATCH] UBUNTU: SAUCE: apparmor4.0.0 [29/90]: LSM stacking v39: LSM: secctx provider check on release BugLink: http://bugs.launchpad.net/bugs/2028253 Verify that the LSM releasing the secctx is the LSM that allocated it. This was not necessary when only one LSM could create a secctx, but once there can be more than one it is. Signed-off-by: Casey Schaufler (cherry picked from commit 2e26924a9155d6e5d5de80f66e77192b951e0a99 https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next) Signed-off-by: Paolo Pisati --- security/apparmor/secid.c | 10 ++-------- security/selinux/hooks.c | 10 ++-------- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index f19846b9a40a..2985ce3c5ae1 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -142,14 +142,8 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) void apparmor_release_secctx(struct lsmcontext *cp) { - /* - * stacking scaffolding: - * When it is possible for more than one LSM to provide a - * release hook, do this check: - * if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF) - */ - - kfree(cp->context); + if (cp->id == LSM_ID_APPARMOR) + kfree(cp->context); } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 08649a7711e0..a7e2e9a9a744 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6672,14 +6672,8 @@ static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) static void selinux_release_secctx(struct lsmcontext *cp) { - /* - * stacking scaffolding: - * When it is possible for more than one LSM to provide a - * release hook, do this check: - * if (cp->id == LSM_ID_SELINUX || cp->id == LSM_ID_UNDEF) - */ - - kfree(cp->context); + if (cp->id == LSM_ID_SELINUX) + kfree(cp->context); } static void selinux_inode_invalidate_secctx(struct inode *inode)