lsm: secctx provider check on release

Verify that the LSM releasing the secctx is the LSM that
allocated it. This was not necessary when only one LSM could
create a secctx, but once there can be more than one it is.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index b08969ec34b752e490041ce4b5ddd15f2a7c51ae..28caf66b9033549b8a1fbc2f0e8ae4d49b1ba7e9 100644 (file)
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -108,14 +108,11 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 
 void apparmor_release_secctx(struct lsm_context *cp)
 {
-       /*
-        * stacking scaffolding:
-        * When it is possible for more than one LSM to provide a
-        * release hook, do this check:
-        * if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF)
-        */
-
-       kfree(cp->context);
+       if (cp->id == LSM_ID_APPARMOR) {
+               kfree(cp->context);
+               cp->context = NULL;
+               cp->id = LSM_ID_UNDEF;
+       }
 }
 
 /**

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4f8d37ae769ae879b3a120661f04c51234090189..a2e72f1212a3a4169281f8b8234f831d7f0ff74b 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6672,14 +6672,11 @@ static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 
 static void selinux_release_secctx(struct lsm_context *cp)
 {
-       /*
-        * stacking scaffolding:
-        * When it is possible for more than one LSM to provide a
-        * release hook, do this check:
-        * if (cp->id == LSM_ID_SELINUX || cp->id == LSM_ID_UNDEF)
-        */
-
-       kfree(cp->context);
+       if (cp->id == LSM_ID_SELINUX) {
+               kfree(cp->context);
+               cp->context = NULL;
+               cp->id = LSM_ID_UNDEF;
+       }
 }
 
 static void selinux_inode_invalidate_secctx(struct inode *inode)