Smack: Abstract use of ipc security blobs

Don't use the ipc->security pointer directly.
Don't use the msg_msg->security pointer directly.
Provide helper functions that provides the security blob pointers.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/security/smack/smack.h b/security/smack/smack.h
index bf0abc35ca1c21740fe03ae180e1bd0e4eeb6280..0adddbeecc6239c2e07eb063878fef9131c405b0 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -24,6 +24,7 @@
 #include <linux/list.h>
 #include <linux/rculist.h>
 #include <linux/lsm_audit.h>
+#include <linux/msg.h>
 
 /*
  * Use IPv6 port labeling if IPv6 is enabled and secmarks
@@ -373,6 +374,16 @@ static inline struct inode_smack *smack_inode(const struct inode *inode)
        return inode->i_security + smack_blob_sizes.lbs_inode;
 }
 
+static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
+{
+       return (struct smack_known **)&msg->security;
+}
+
+static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
+{
+       return (struct smack_known **)&ipc->security;
+}
+
 /*
  * Is the directory transmuting?
  */

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 804897c82810cedf72b45d931625081ece4e3d00..154521b6843b41775c0830e189262e9d61a24931 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2834,7 +2834,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg)
  */
 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)
 {
-       return (struct smack_known *)isp->security;
+       struct smack_known **blob = smack_ipc(isp);
+
+       return *blob;
 }
 
 /**
@@ -2845,9 +2847,9 @@ static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)
  */
 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp)
 {
-       struct smack_known *skp = smk_of_current();
+       struct smack_known **blob = smack_ipc(isp);
 
-       isp->security = skp;
+       *blob = smk_of_current();
        return 0;
 }
 
@@ -3159,7 +3161,8 @@ static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg
  */
 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
 {
-       struct smack_known *iskp = ipp->security;
+       struct smack_known **blob = smack_ipc(ipp);
+       struct smack_known *iskp = *blob;
        int may = smack_flags_to_may(flag);
        struct smk_audit_info ad;
        int rc;
@@ -3180,7 +3183,8 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
  */
 static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
 {
-       struct smack_known *iskp = ipp->security;
+       struct smack_known **blob = smack_ipc(ipp);
+       struct smack_known *iskp = *blob;
 
        *secid = iskp->smk_secid;
 }