diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2014-04-18 03:23:46 -0400 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2014-04-22 04:47:53 -0400 |
| commit | f1370cc4a01e61007ab3020c761cef6b88ae3729 (patch) | |
| tree | bee103f4c6398b978b47b1b6bba8e097c1e332aa /net/key | |
| parent | 5a9d19ab76f98b7cdc97ba9724be01deba791bc0 (diff) | |
xfrm: Remove useless secid field from xfrm_audit.
It seems to me that commit ab5f5e8b "[XFRM]: xfrm audit calls" is doing
something strange at xfrm_audit_helper_usrinfo().
If secid != 0 && security_secid_to_secctx(secid) != 0, the caller calls
audit_log_task_context() which basically does
secid != 0 && security_secid_to_secctx(secid) == 0 case
except that secid is obtained from current thread's context.
Oh, what happens if secid passed to xfrm_audit_helper_usrinfo() was
obtained from other thread's context? It might audit current thread's
context rather than other thread's context if security_secid_to_secctx()
in xfrm_audit_helper_usrinfo() failed for some reason.
Then, are all the caller of xfrm_audit_helper_usrinfo() passing either
secid obtained from current thread's context or secid == 0?
It seems to me that they are.
If I didn't miss something, we don't need to pass secid to
xfrm_audit_helper_usrinfo() because audit_log_task_context() will
obtain secid from current thread's context.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/key')
| -rw-r--r-- | net/key/af_key.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c index f3c83073afc4..d66ff72adefb 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c | |||
| @@ -1478,7 +1478,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, const struct sadb_msg | |||
| 1478 | 1478 | ||
| 1479 | xfrm_audit_state_add(x, err ? 0 : 1, | 1479 | xfrm_audit_state_add(x, err ? 0 : 1, |
| 1480 | audit_get_loginuid(current), | 1480 | audit_get_loginuid(current), |
| 1481 | audit_get_sessionid(current), 0); | 1481 | audit_get_sessionid(current)); |
| 1482 | 1482 | ||
| 1483 | if (err < 0) { | 1483 | if (err < 0) { |
| 1484 | x->km.state = XFRM_STATE_DEAD; | 1484 | x->km.state = XFRM_STATE_DEAD; |
| @@ -1534,7 +1534,7 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, const struct sadb_ | |||
| 1534 | out: | 1534 | out: |
| 1535 | xfrm_audit_state_delete(x, err ? 0 : 1, | 1535 | xfrm_audit_state_delete(x, err ? 0 : 1, |
| 1536 | audit_get_loginuid(current), | 1536 | audit_get_loginuid(current), |
| 1537 | audit_get_sessionid(current), 0); | 1537 | audit_get_sessionid(current)); |
| 1538 | xfrm_state_put(x); | 1538 | xfrm_state_put(x); |
| 1539 | 1539 | ||
| 1540 | return err; | 1540 | return err; |
| @@ -1735,7 +1735,6 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m | |||
| 1735 | 1735 | ||
| 1736 | audit_info.loginuid = audit_get_loginuid(current); | 1736 | audit_info.loginuid = audit_get_loginuid(current); |
| 1737 | audit_info.sessionid = audit_get_sessionid(current); | 1737 | audit_info.sessionid = audit_get_sessionid(current); |
| 1738 | audit_info.secid = 0; | ||
| 1739 | err = xfrm_state_flush(net, proto, &audit_info); | 1738 | err = xfrm_state_flush(net, proto, &audit_info); |
| 1740 | err2 = unicast_flush_resp(sk, hdr); | 1739 | err2 = unicast_flush_resp(sk, hdr); |
| 1741 | if (err || err2) { | 1740 | if (err || err2) { |
| @@ -2290,7 +2289,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_ | |||
| 2290 | 2289 | ||
| 2291 | xfrm_audit_policy_add(xp, err ? 0 : 1, | 2290 | xfrm_audit_policy_add(xp, err ? 0 : 1, |
| 2292 | audit_get_loginuid(current), | 2291 | audit_get_loginuid(current), |
| 2293 | audit_get_sessionid(current), 0); | 2292 | audit_get_sessionid(current)); |
| 2294 | 2293 | ||
| 2295 | if (err) | 2294 | if (err) |
| 2296 | goto out; | 2295 | goto out; |
| @@ -2374,7 +2373,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa | |||
| 2374 | 2373 | ||
| 2375 | xfrm_audit_policy_delete(xp, err ? 0 : 1, | 2374 | xfrm_audit_policy_delete(xp, err ? 0 : 1, |
| 2376 | audit_get_loginuid(current), | 2375 | audit_get_loginuid(current), |
| 2377 | audit_get_sessionid(current), 0); | 2376 | audit_get_sessionid(current)); |
| 2378 | 2377 | ||
| 2379 | if (err) | 2378 | if (err) |
| 2380 | goto out; | 2379 | goto out; |
| @@ -2624,7 +2623,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_ | |||
| 2624 | if (delete) { | 2623 | if (delete) { |
| 2625 | xfrm_audit_policy_delete(xp, err ? 0 : 1, | 2624 | xfrm_audit_policy_delete(xp, err ? 0 : 1, |
| 2626 | audit_get_loginuid(current), | 2625 | audit_get_loginuid(current), |
| 2627 | audit_get_sessionid(current), 0); | 2626 | audit_get_sessionid(current)); |
| 2628 | 2627 | ||
| 2629 | if (err) | 2628 | if (err) |
| 2630 | goto out; | 2629 | goto out; |
| @@ -2738,7 +2737,6 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad | |||
| 2738 | 2737 | ||
| 2739 | audit_info.loginuid = audit_get_loginuid(current); | 2738 | audit_info.loginuid = audit_get_loginuid(current); |
| 2740 | audit_info.sessionid = audit_get_sessionid(current); | 2739 | audit_info.sessionid = audit_get_sessionid(current); |
| 2741 | audit_info.secid = 0; | ||
| 2742 | err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); | 2740 | err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); |
| 2743 | err2 = unicast_flush_resp(sk, hdr); | 2741 | err2 = unicast_flush_resp(sk, hdr); |
| 2744 | if (err || err2) { | 2742 | if (err || err2) { |