Smack: fix netfilter Makefile entry

PATCH In review Arnd Bergmann 4 participants 6 messages Jan 28, 2015 – Jan 29, 2015

Subsystems (2)

Security (LSM) Smack security module

lore

Share & tools

lore

Arnd Bergmann

author

2015-01-28 16:12 UTC #0 lore raw

PATCH 1/1 Smack: fix netfilter Makefile entry

The newly added Smack support for netfilter secmark has its own Kconfig symbol, but the actual implementation is conditionally built on another symbol.

It is possible for CONFIG_NETFILTER and SECURITY_SMACK to both be enabled, but NETWORK_SECMARK to be disabled, in which case we get a build error:

../security/smack/smack_netfilter.c: In function 'smack_ipv6_output':
../security/smack/smack_netfilter.c:36:6: error: 'struct sk_buff' has no member named 'secmark'

   skb->secmark = skp->smk_secid;
      ^
../security/smack/smack_netfilter.c: In function 'smack_ipv4_output':
../security/smack/smack_netfilter.c:55:6: error: 'struct sk_buff' has no member named 'secmark'
   skb->secmark = skp->smk_secid;
      ^

This changes the Makefile to use the correct Kconfig symbol.

Signed-off-by Arnd Bergmann <[email protected]>

Fixes 69f287ae6fc83 ("Smack: secmark support for netfilter")

security/smack/Makefile +1 -1

index 616cf93b368e..d4a376c84050 100644
@@ -5,4 +5,4 @@
 obj-$(CONFIG_SECURITY_SMACK) := smack.o
 
 smack-y := smack_lsm.o smack_access.o smackfs.o
-smack-$(CONFIG_NETFILTER) += smack_netfilter.o
+smack-$(SECURITY_SMACK_NETFILTER) += smack_netfilter.o

Casey Schaufler

maintainer

2015-01-28 16:27 UTC #1 lore raw

Quoted 3 lines · Arnd Bergmann

The newly added Smack support for netfilter secmark has its own Kconfig symbol, but the actual implementation is conditionally built on another symbol.

A patch for this problem, 82b0b2c2b1e64ad6c5309a9eeba806af9812666b is already available in:

git://git.gitorious.org/smack-next/kernel.git smack-for-3.20-rebased

A pull request has sent to James Morris for inclusion in the security tree.

Quoted 31 lines

It is possible for CONFIG_NETFILTER and SECURITY_SMACK to both be enabled, but NETWORK_SECMARK to be disabled, in which case we get a build error:
../security/smack/smack_netfilter.c: In function 'smack_ipv6_output':
../security/smack/smack_netfilter.c:36:6: error: 'struct sk_buff' has no member named 'secmark'
   skb->secmark = skp->smk_secid;
      ^
../security/smack/smack_netfilter.c: In function 'smack_ipv4_output':
../security/smack/smack_netfilter.c:55:6: error: 'struct sk_buff' has no member named 'secmark'
   skb->secmark = skp->smk_secid;
      ^
This changes the Makefile to use the correct Kconfig symbol.
Signed-off-by Arnd Bergmann <[email protected]>
Fixes 69f287ae6fc83 ("Smack: secmark support for netfilter")
security/smack/Makefile +1 -1
index 616cf93b368e..d4a376c84050 100644
@@ -5,4 +5,4 @@
 obj-$(CONFIG_SECURITY_SMACK) := smack.o
 
 smack-y := smack_lsm.o smack_access.o smackfs.o
-smack-$(CONFIG_NETFILTER) += smack_netfilter.o
+smack-$(SECURITY_SMACK_NETFILTER) += smack_netfilter.o

Arnd Bergmann

author

2015-01-28 16:29 UTC #2 lore raw

Quoted 11 lines · On Wednesday 28 January 2015 08:27:20 Casey Schaufler wrote:

Quoted 3 lines · Arnd Bergmann
The newly added Smack support for netfilter secmark has its own Kconfig symbol, but the actual implementation is conditionally built on another symbol.
A patch for this problem, 82b0b2c2b1e64ad6c5309a9eeba806af9812666b is already available in:
git://git.gitorious.org/smack-next/kernel.git smack-for-3.20-rebased
A pull request has sent to James Morris for inclusion in the security tree.

Ok, thanks!

Arnd

Sergei Shtylyov

2015-01-28 18:18 UTC #3 lore raw

In reply to Arnd Bergmann

Hello.

Quoted 27 lines · Arnd Bergmann

The newly added Smack support for netfilter secmark has its own Kconfig symbol, but the actual implementation is conditionally built on another symbol.
It is possible for CONFIG_NETFILTER and SECURITY_SMACK to both be enabled, but NETWORK_SECMARK to be disabled, in which case we get a build error:
../security/smack/smack_netfilter.c: In function 'smack_ipv6_output':
../security/smack/smack_netfilter.c:36:6: error: 'struct sk_buff' has no member named 'secmark'
    skb->secmark = skp->smk_secid;
       ^
../security/smack/smack_netfilter.c: In function 'smack_ipv4_output':
../security/smack/smack_netfilter.c:55:6: error: 'struct sk_buff' has no member named 'secmark'
    skb->secmark = skp->smk_secid;
       ^
This changes the Makefile to use the correct Kconfig symbol.
Signed-off-by Arnd Bergmann <[email protected]>
Fixes 69f287ae6fc83 ("Smack: secmark support for netfilter")
security/smack/Makefile +0 -0
index 616cf93b368e..d4a376c84050 100644

security/smack/Makefile line 8

Quoted 5 lines

security/smack/Makefile +1 -1

@@ -5,4 +5,4 @@
  obj-$(CONFIG_SECURITY_SMACK) := smack.o
 
  smack-y := smack_lsm.o smack_access.o smackfs.o
-smack-$(CONFIG_NETFILTER) += smack_netfilter.o
+smack-$(SECURITY_SMACK_NETFILTER) += smack_netfilter.o

CONFIG_ missing?

WBR, Sergei

Arnd Bergmann

author

2015-01-28 19:23 UTC #4 lore raw

Quoted 7 lines · On Wednesday 28 January 2015 21:18:11 Sergei Shtylyov wrote:

Quoted 7 lines

security/smack/Makefile +0 -0

index 616cf93b368e..d4a376c84050 100644
@@ -5,4 +5,4 @@
  obj-$(CONFIG_SECURITY_SMACK) := smack.o

Quoted 5 lines

security/smack/Makefile line 8
Quoted 3 lines
security/smack/Makefile +1 -1
  smack-y := smack_lsm.o smack_access.o smackfs.o
-smack-$(CONFIG_NETFILTER) += smack_netfilter.o
+smack-$(SECURITY_SMACK_NETFILTER) += smack_netfilter.o
CONFIG_ missing?

Yes, you are right. Anyway, as another fix is already queued, it doesn't matter any more.

Arnd

Paul Bolle

2015-01-29 00:36 UTC #5 lore raw

In reply to Arnd Bergmann

Quoted 27 lines · Arnd Bergmann

The newly added Smack support for netfilter secmark has its own Kconfig symbol, but the actual implementation is conditionally built on another symbol.
It is possible for CONFIG_NETFILTER and SECURITY_SMACK to both be enabled, but NETWORK_SECMARK to be disabled, in which case we get a build error:
../security/smack/smack_netfilter.c: In function 'smack_ipv6_output':
../security/smack/smack_netfilter.c:36:6: error: 'struct sk_buff' has no member named 'secmark'
   skb->secmark = skp->smk_secid;
      ^
../security/smack/smack_netfilter.c: In function 'smack_ipv4_output':
../security/smack/smack_netfilter.c:55:6: error: 'struct sk_buff' has no member named 'secmark'
   skb->secmark = skp->smk_secid;
      ^
This changes the Makefile to use the correct Kconfig symbol.
Signed-off-by Arnd Bergmann <[email protected]>
Fixes 69f287ae6fc83 ("Smack: secmark support for netfilter")
security/smack/Makefile +0 -0
index 616cf93b368e..d4a376c84050 100644

security/smack/Makefile line 8

Quoted 5 lines

security/smack/Makefile +1 -1

@@ -5,4 +5,4 @@
 obj-$(CONFIG_SECURITY_SMACK) := smack.o
 
 smack-y := smack_lsm.o smack_access.o smackfs.o
-smack-$(CONFIG_NETFILTER) += smack_netfilter.o
+smack-$(SECURITY_SMACK_NETFILTER) += smack_netfilter.o

You probably wanted to use:
CONFIG_SECURITY_SMACK_NETFILTER

Paul Bolle