FAILED: patch "[PATCH] lsm: fix default return value of the socket_getpeersec_*()" failed to apply to 5.15-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 5a287d3d2b9de2b3e747132c615599907ba5c3c1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2024021957-substance-saloon-27a3@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
5a287d3d2b9d ("lsm: fix default return value of the socket_getpeersec_*() hooks") b10b9c342f75 ("lsm: make security_socket_getpeersec_stream() sockptr_t safe") 4ff09db1b79b ("bpf: net: Change sk_getsockopt() to take the sockptr_t argument") ba74a7608dc1 ("net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5a287d3d2b9de2b3e747132c615599907ba5c3c1 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <[email protected]>
Date: Fri, 26 Jan 2024 19:45:31 +0100
Subject: [PATCH] lsm: fix default return value of the socket_getpeersec_*()
hooks
For these hooks the true "neutral" value is -EOPNOTSUPP, which is currently what is returned when no LSM provides this hook and what LSMs return when there is no security context set on the socket. Correct the value in <linux/lsm_hooks.h> and adjust the dispatch functions in security/security.c to avoid issues when the BPF LSM is enabled.
include/linux/lsm_hook_defs.h +2 -2
@@ -315,9 +315,9 @@ LSM_HOOK(int, 0, socket_getsockopt, struct socket *sock, int level, int optname) LSM_HOOK(int, 0, socket_setsockopt, struct socket *sock, int level, int optname) LSM_HOOK(int, 0, socket_shutdown, struct socket *sock, int how) LSM_HOOK(int, 0, socket_sock_rcv_skb, struct sock *sk, struct sk_buff *skb) -LSM_HOOK(int, 0, socket_getpeersec_stream, struct socket *sock, +LSM_HOOK(int, -ENOPROTOOPT, socket_getpeersec_stream, struct socket *sock, sockptr_t optval, sockptr_t optlen, unsigned int len) -LSM_HOOK(int, 0, socket_getpeersec_dgram, struct socket *sock, +LSM_HOOK(int, -ENOPROTOOPT, socket_getpeersec_dgram, struct socket *sock, struct sk_buff *skb, u32 *secid) LSM_HOOK(int, 0, sk_alloc_security, struct sock *sk, int family, gfp_t priority) LSM_HOOK(void, LSM_RET_VOID, sk_free_security, struct sock *sk)
security/security.c +27 -4
@@ -4624,8 +4624,20 @@ EXPORT_SYMBOL(security_sock_rcv_skb);int security_socket_getpeersec_stream (struct socket *sock,sockptr_t optval,sockptr_t optlen,unsigned int len) { -return call_int_hook (socket_getpeersec_stream, -ENOPROTOOPT , sock, - optval, optlen, len); +struct security_hook_list *hp; +int rc; + +/* +* Only one module will provide a security context. +*/ +hlist_for_each_entry (hp, &security_hook_heads.socket_getpeersec_stream, + list) { + rc = hp->hook.socket_getpeersec_stream (sock, optval, optlen, + len); +if (rc !=LSM_RET_DEFAULT (socket_getpeersec_stream)) +return rc; + } +return LSM_RET_DEFAULT (socket_getpeersec_stream); }/**
@@ -4645,8 +4657,19 @@ int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,int security_socket_getpeersec_dgram (struct socket *sock,struct sk_buff *skb,u32 *secid) { -return call_int_hook (socket_getpeersec_dgram, -ENOPROTOOPT , sock, - skb, secid); +struct security_hook_list *hp; +int rc; + +/* +* Only one module will provide a security context. +*/ +hlist_for_each_entry (hp, &security_hook_heads.socket_getpeersec_dgram, + list) { + rc = hp->hook.socket_getpeersec_dgram (sock, skb, secid); +if (rc !=LSM_RET_DEFAULT (socket_getpeersec_dgram)) +return rc; + } +return LSM_RET_DEFAULT (socket_getpeersec_dgram); }EXPORT_SYMBOL (security_socket_getpeersec_dgram);