From patchwork Fri Oct 5 16:11:47 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 148217 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp637621lji; Fri, 5 Oct 2018 09:12:19 -0700 (PDT) X-Google-Smtp-Source: ACcGV60ND4QB3zGUkPxttO+80eg35qqPqLzuJtRXnhVrfUBCQbhPRO/b+1YSUoO2hn5D6J2O8lFS X-Received: by 2002:a17:902:6f16:: with SMTP id w22-v6mr12212897plk.261.1538755939417; Fri, 05 Oct 2018 09:12:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1538755939; cv=none; d=google.com; s=arc-20160816; b=cFlSQh2nNv3fMMuq2HHB8V9tveOcLnKK/tICOnLEm00/BbJTwpLMnGbzqgpK6HvqsK awKBobvMtpCgkv6/ZyCSNkgpkCfenNOky9FkiTBPl1oB07/BLwGE2M+jdP7P2vNkWcmQ DCYxsEla3okkt9VP+vIcppyrdxeX2LCN1gwx6hFedhK2JtcVOzA316hqUE7+eX9O709B sjlU3eYqd8QgUb3jgqqCT/6ngGpVP5zi2fq8Djl1JHsyZcTfGBnd6CCcfbOEiOk9EcHR 8XF2A+fXvFvy3eyWSbAPdyzhEjgFrHzqIBdeREIqtengcxB9Qa2lCJ8rgh/NP0RpnwJM dlpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from; bh=lG7DKAFinkaxTaj0jOAk0Vo1C/3bmTwuxOQBZ6imt2k=; b=ryLOYXQ3kpQqeM27N999xDXvV27MaOrrCshS784mZXn56VmCwvc/nwSil5XSHXX2EA CCcr3zIaf818oF3G7fWFbAMrhoXF6BeNkfTFozD7UxyEfJ+SsYOu+bgZ1TOWGN86ELiA oGxkbCxbckchdPGAxuZ1VH+M698WGmzB9JCTo9b2jPNPbUzvfpFJOia9lmhMFexWEKlb S1YOaO2XzB/BRZhyujR9oEazhyP2Egq3h2+Kf4w279LI21uLCwkloFfu25C75jRDdbMf L+SqJ4J6aGsBWut0V46NR30VYxWLX1OfRASh8Ub79Lw/8DSF1SaFaYMXeSYNQgPTsDkc ifrA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p18-v6si8600720plr.423.2018.10.05.09.12.19; Fri, 05 Oct 2018 09:12:19 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728789AbeJEXLi (ORCPT + 32 others); Fri, 5 Oct 2018 19:11:38 -0400 Received: from mout.kundenserver.de ([212.227.126.135]:60597 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727878AbeJEXLi (ORCPT ); Fri, 5 Oct 2018 19:11:38 -0400 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MYNeM-1gCQyQ3his-00VLdR; Fri, 05 Oct 2018 18:12:08 +0200 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MYNeM-1gCQyQ3his-00VLdR; Fri, 05 Oct 2018 18:12:08 +0200 From: Arnd Bergmann To: John Johansen , James Morris , "Serge E. Hallyn" Cc: Arnd Bergmann , David Howells , Jann Horn , Matthew Garrett , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] apparmor: add #ifdef checks for secmark filtering Date: Fri, 5 Oct 2018 18:11:47 +0200 Message-Id: <20181005161206.727098-1-arnd@arndb.de> X-Mailer: git-send-email 2.18.0 X-Provags-ID: V03:K1:M0zCqPWFVcOcannDUuDOwgjJPuoxDACZDZgPCSEac5NqWsHTsnQ 5cLvwEfc5dqqDCJn+KUuBx+2+8hR1QKx1VuPDioqGjr8bSlSLsbM/pkw4baQpJDsvQx0ObM nV9Bn4Efv8DDhQUjHASr5FUqSA+GiPf2Zd3RnUMeM7x0ee0j4G1/ZoeRSYbjb2Ftx70Y4Y9 MnUX3MshiavQME6bJystA== X-UI-Out-Filterresults: notjunk:1; V01:K0:/ulGstPc9Ak=:VvsvVRm7tiz75wDNKFPRbH Rad4logNWV8ZYqjG4jOCO69Aurf5F/stq6D3myd5dNsHoOLBWHxTTfhXicYzQGEUD4A3YHicI V1k0mQEbZm1NDUkz6phGW8nImYcQ+RISegp7d/pD/aR9n/Iv83wY9+KMYvz2992uHvr1D9soz 1jYI36qt5qj0dbHFW2qAq75V2hwfHe6W5It9g00BWHL1d3ryj6PRGpbAIZgXOBo2YsQ/wJkVB FgAyffDg23wfLXSb0D60U0eD0t6f09qeIquH6OFfiTvT9OpykEpouB8zUHiGS/wbdhxdZC+Z5 BeVpOggUNf/U2aNiD4h3EtdKOwrmsJLSmR83cyEfDtWP2ZrIT1S+fTxzx5uDti8QkY7zb4SEq cP43FHQ45QX4cArg/JmSzjS0rNUy9elvwT8DIDRFf2zFnjm/UoQVHy3DrBQKearOoLDv4Y/nw 6dbYOofXle7sLWNQVStUVZdpoMmCprAjlon4tgmo59Dq/k5ev4tGfAfyq8YWSbtEAYkKyG0BL z2pxpmSBXfKTNkpQhNnootn6R3v2lmTKEmgdj0rHs+t16HfQGXDOr79dXTHq8wAFwLeofxjEe wwhCooD/tFfH6XgUM6jJvZCQzjrDui5UrMYr7aNgbBD2r3GlWAWp+1Hg6taU5FPAPL7WhjhGk Q6Yr0vvUMVeh5qKgM0HnLmyq3bLgjHuhGvZTHbZ+c0ZkuZqKQLCJDfgxqeZQe/N824cM= Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The newly added code fails to build when either SECMARK or NETFILTER are disabled: security/apparmor/lsm.c: In function 'apparmor_socket_sock_rcv_skb': security/apparmor/lsm.c:1138:12: error: 'struct sk_buff' has no member named 'secmark'; did you mean 'mark'? security/apparmor/lsm.c:1671:21: error: 'struct nf_hook_state' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] Add a set of #ifdef checks around it to only enable the code that we can compile and that makes sense in that configuration. Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Arnd Bergmann --- security/apparmor/lsm.c | 10 ++++++++++ security/apparmor/net.c | 2 ++ 2 files changed, 12 insertions(+) -- 2.18.0 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 53201013c40e..b74b724d3e84 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1123,6 +1123,7 @@ static int apparmor_socket_shutdown(struct socket *sock, int how) return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock); } +#ifdef CONFIG_NETWORK_SECMARK /** * apparmor_socket_sock_recv_skb - check perms before associating skb to sk * @@ -1141,6 +1142,7 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, skb->secmark, sk); } +#endif static struct aa_label *sk_peer_label(struct sock *sk) @@ -1235,6 +1237,7 @@ static void apparmor_sock_graft(struct sock *sk, struct socket *parent) ctx->label = aa_get_current_label(); } +#ifdef CONFIG_NETWORK_SECMARK static int apparmor_inet_conn_request(struct sock *sk, struct sk_buff *skb, struct request_sock *req) { @@ -1246,6 +1249,7 @@ static int apparmor_inet_conn_request(struct sock *sk, struct sk_buff *skb, return apparmor_secmark_check(ctx->label, OP_CONNECT, AA_MAY_CONNECT, skb->secmark, sk); } +#endif static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), @@ -1304,13 +1308,17 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), +#ifdef CONFIG_NETWORK_SECMARK LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), +#endif LSM_HOOK_INIT(socket_getpeersec_stream, apparmor_socket_getpeersec_stream), LSM_HOOK_INIT(socket_getpeersec_dgram, apparmor_socket_getpeersec_dgram), LSM_HOOK_INIT(sock_graft, apparmor_sock_graft), +#ifdef CONFIG_NETWORK_SECMARK LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request), +#endif LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), LSM_HOOK_INIT(cred_free, apparmor_cred_free), @@ -1666,6 +1674,7 @@ static inline int apparmor_init_sysctl(void) } #endif /* CONFIG_SYSCTL */ +#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK) static unsigned int apparmor_ip_postroute(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) @@ -1754,6 +1763,7 @@ static int __init apparmor_nf_ip_init(void) return 0; } __initcall(apparmor_nf_ip_init); +#endif static int __init apparmor_init(void) { diff --git a/security/apparmor/net.c b/security/apparmor/net.c index f9a678ce994f..c07fde444792 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -190,6 +190,7 @@ int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request, return aa_label_sk_perm(label, op, request, sock->sk); } +#ifdef CONFIG_NETWORK_SECMARK static int apparmor_secmark_init(struct aa_secmark *secmark) { struct aa_label *label; @@ -254,3 +255,4 @@ int apparmor_secmark_check(struct aa_label *label, char *op, u32 request, aa_secmark_perm(profile, request, secid, &sa, sk)); } +#endif