1 files changed, 10 insertions, 41 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 169cf5b3334b..239b13b442e7 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -210,12 +210,9 @@ static void cred_init_security(void)
         struct cred *cred = (struct cred *) current->real_cred;
         struct task_security_struct *tsec;
 
-        tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
-        if (!tsec)
-                panic("SELinux:  Failed to initialize initial task.\n");
-
+        lsm_early_cred(cred);
+        tsec = selinux_cred(cred);
         tsec->osid = tsec->sid = SECINITSID_KERNEL;
-        cred->security = tsec;
 }
 
 /*
@@ -3686,46 +3683,15 @@ static int selinux_task_alloc(struct task_struct *task,
 }
 
 /*
- * allocate the SELinux part of blank credentials
- */
-static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
-{
-        struct task_security_struct *tsec;
-
-        tsec = kzalloc(sizeof(struct task_security_struct), gfp);
-        if (!tsec)
-                return -ENOMEM;
-
-        cred->security = tsec;
-        return 0;
-}
-
-/*
- * detach and free the LSM part of a set of credentials
- */
-static void selinux_cred_free(struct cred *cred)
-{
-        struct task_security_struct *tsec = selinux_cred(cred);
-
-        kfree(tsec);
-}
-
-/*
  * prepare a new set of credentials for modification
  */
 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
                                 gfp_t gfp)
 {
-        const struct task_security_struct *old_tsec;
-        struct task_security_struct *tsec;
-
-        old_tsec = selinux_cred(old);
-
-        tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
-        if (!tsec)
-                return -ENOMEM;
+        const struct task_security_struct *old_tsec = selinux_cred(old);
+        struct task_security_struct *tsec = selinux_cred(new);
 
-        new->security = tsec;
+        *tsec = *old_tsec;
         return 0;
 }
 
@@ -6678,6 +6644,10 @@ static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
 }
 #endif
 
+struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
+        .lbs_cred = sizeof(struct task_security_struct),
+};
+
 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
@@ -6761,8 +6731,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(file_open, selinux_file_open),
 
         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
-        LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
-        LSM_HOOK_INIT(cred_free, selinux_cred_free),
         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
@@ -6981,6 +6949,7 @@ DEFINE_LSM(selinux) = {
         .name = "selinux",
         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
         .enabled = &selinux_enabled,
+        .blobs = &selinux_blob_sizes,
         .init = selinux_init,
 };