Andrew Lukoshko
0eab958d1f
Add the RHEL 211.21.1..211.22.1 backports (1288-1351) from centos-stream-10 and upstream stable, on top of 211.20.1. Bump pkgrelease and specrelease to 211.22.1. (The redhat/ automotive rebuild-changelog tooling change is omitted: it patches redhat/scripts not present in this build base and does not affect the kernel.)
123 lines
3.7 KiB
Diff
123 lines
3.7 KiB
Diff
From 6a5de58e1181a41f95ac002a27d95f1dbf5933c9 Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
|
Date: Fri, 29 May 2026 17:24:58 +0200
|
|
Subject: [PATCH] lsm: split the notifier code out into lsm_notifier.c
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-179440
|
|
CVE: CVE-2026-46054
|
|
|
|
commit a5e7c17c810052e94dae36f1a976a052f4490458
|
|
Author: Paul Moore <paul@paul-moore.com>
|
|
Date: Mon Feb 10 19:20:58 2025 -0500
|
|
|
|
lsm: split the notifier code out into lsm_notifier.c
|
|
|
|
In an effort to decompose security/security.c somewhat to make it less
|
|
twisted and unwieldy, pull out the LSM notifier code into a new file
|
|
as it is fairly well self-contained.
|
|
|
|
No code changes.
|
|
|
|
Reviewed-by: Kees Cook <kees@kernel.org>
|
|
Reviewed-by: John Johansen <john.johansen@canonical.com>
|
|
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
|
|
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
|
|
Signed-off-by: Paul Moore <paul@paul-moore.com>
|
|
|
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
|
|
|
diff --git a/security/Makefile b/security/Makefile
|
|
index cc0982214b84..c7a3f1cb2fd5 100644
|
|
--- a/security/Makefile
|
|
+++ b/security/Makefile
|
|
@@ -11,7 +11,7 @@ obj-$(CONFIG_SECURITY) += lsm_syscalls.o
|
|
obj-$(CONFIG_MMU) += min_addr.o
|
|
|
|
# Object file lists
|
|
-obj-$(CONFIG_SECURITY) += security.o
|
|
+obj-$(CONFIG_SECURITY) += security.o lsm_notifier.o
|
|
obj-$(CONFIG_SECURITYFS) += inode.o
|
|
obj-$(CONFIG_SECURITY_SELINUX) += selinux/
|
|
obj-$(CONFIG_SECURITY_SMACK) += smack/
|
|
diff --git a/security/lsm_notifier.c b/security/lsm_notifier.c
|
|
new file mode 100644
|
|
index 000000000000..c92fad5d57d4
|
|
--- /dev/null
|
|
+++ b/security/lsm_notifier.c
|
|
@@ -0,0 +1,31 @@
|
|
+// SPDX-License-Identifier: GPL-2.0-or-later
|
|
+/*
|
|
+ * LSM notifier functions
|
|
+ *
|
|
+ */
|
|
+
|
|
+#include <linux/notifier.h>
|
|
+#include <linux/security.h>
|
|
+
|
|
+static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);
|
|
+
|
|
+int call_blocking_lsm_notifier(enum lsm_event event, void *data)
|
|
+{
|
|
+ return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,
|
|
+ event, data);
|
|
+}
|
|
+EXPORT_SYMBOL(call_blocking_lsm_notifier);
|
|
+
|
|
+int register_blocking_lsm_notifier(struct notifier_block *nb)
|
|
+{
|
|
+ return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,
|
|
+ nb);
|
|
+}
|
|
+EXPORT_SYMBOL(register_blocking_lsm_notifier);
|
|
+
|
|
+int unregister_blocking_lsm_notifier(struct notifier_block *nb)
|
|
+{
|
|
+ return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,
|
|
+ nb);
|
|
+}
|
|
+EXPORT_SYMBOL(unregister_blocking_lsm_notifier);
|
|
diff --git a/security/security.c b/security/security.c
|
|
index 4535ba7d0208..9a5f9a2f8ff3 100644
|
|
--- a/security/security.c
|
|
+++ b/security/security.c
|
|
@@ -91,8 +91,6 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
|
|
[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
|
|
};
|
|
|
|
-static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);
|
|
-
|
|
static struct kmem_cache *lsm_file_cache;
|
|
static struct kmem_cache *lsm_inode_cache;
|
|
|
|
@@ -649,27 +647,6 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
|
|
}
|
|
}
|
|
|
|
-int call_blocking_lsm_notifier(enum lsm_event event, void *data)
|
|
-{
|
|
- return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,
|
|
- event, data);
|
|
-}
|
|
-EXPORT_SYMBOL(call_blocking_lsm_notifier);
|
|
-
|
|
-int register_blocking_lsm_notifier(struct notifier_block *nb)
|
|
-{
|
|
- return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,
|
|
- nb);
|
|
-}
|
|
-EXPORT_SYMBOL(register_blocking_lsm_notifier);
|
|
-
|
|
-int unregister_blocking_lsm_notifier(struct notifier_block *nb)
|
|
-{
|
|
- return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,
|
|
- nb);
|
|
-}
|
|
-EXPORT_SYMBOL(unregister_blocking_lsm_notifier);
|
|
-
|
|
/**
|
|
* lsm_blob_alloc - allocate a composite blob
|
|
* @dest: the destination for the blob
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|