From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2FB63BBFDA for ; Mon, 31 Aug 2026 22:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216503; cv=none; b=katS1c813aDaHSz6Z3Qx1frci6gLuTwVVJmRtvrRwOkPdE3BfOeO7HUEDYnclezwN0+wYG047hBzgv/9MjxBDwyFxpdv6FWCPxhI2Lzxd8QxSKVTkZjNJsJdpXoQIQ6laozdCRhQjU8l4ft1C6L+40PL9IJLPHXxmqe24zUYUSo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216503; c=relaxed/simple; bh=YePZ51dlYmZ/cucTyw+gosn8F7f35BMcwjmeoZtY7Bw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NbPfpPZ+KNWcm5nvHOtxblaTAsczY9sI/zSdMOy0gGqTfcV57hQq2MxXUzmP5eDRve6TgBcqIJ9ZSsRZ25fBztPKt6EYoTxkg3IUJeg3lknaJH4XA26AqOE2udnlcsEmhtUE1jnn55agaoyjCn7Z074DvfSrpwuFX3C5jezd9y4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=VVK4Chtt; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="VVK4Chtt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=yHlrmN78oxAAQbX+BTQB5IQgb1bzCbKp9XLNwOjJhUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=VVK4ChttkjF578FRREwpjOFf+VjqJVsv0qnniq7yCCb+WZPCF4xM7NuSQVtodqaBZHDK4qA0G6svdAAKmnUCkH7HVXeUbk2dK0LRBN3BDpO2qSRNZTr1q5p+BhVals7okAcHmFSdBLUCssBudA/kMLB/WgNx3HhEG78SnrmRktGwafavyJGBCZJUtxteNsXV1yHJiTfsqfqlHzLH2fHeaf7513w2aQXxMhAYbsT6jUYJYtDUEAh5TXpx3zMQG1UjAM+tAktAT6A5JJv+H0jrSkfiVLvykX/ngvKhbt6KA7HTA93TE34Q9K7Q5qVpap022d8vOMC7Z8kUdKIrlaEbog== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=2gTV4gHQkgEsR/tIwjZkTyBleyI/AHOnKurvh1Mmc54=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=O6p/VXFwVLnVQBsnO+52K9v9UHuDHCgP0Bhdi2VdCN0v91k+5QXAyrbrssLIV3Dpa9RdDHCa45IoCxTXDIQkyQt9AKBGaTSfkYZealDjV6BUhETTo0juWhYavWl5mUNAPUKXHGd3vErjBVsNIju2ohSHEJ4m6nenp/8YJ/aTR7jwfISgIkaaQqxwCxN1I/CNkn4qNLwq+tXGpKGLEc+kc4aR/rLLQc3jlq6CnAXaSpgJbV7AqmBdOXQMJA2OeNzzZqBlxsyzf8MWpOWirQEmJSUfPIwqdt9dRPJjnSirBJRlM5xBCGd0F+OHidFaOOCODkXtD4lrlabwv85K/SGsqw== X-YMail-OSG: wkr1C6gVM1kY1wwk9eGxXd0VD2TzsIQPmYa4pt.AdCUxBSOgguKzbdXHZ1WZ0.6 vcph3cb1d8AKu6soB4PLnJQ4MJv3uVnYDt6Svlqy06fi3sNEJg_o8qcTWlFgM.EXp7d6ewL_0epA .Zw5NkQ52bIQxFEA0Vff3X471.Zd0Orr7FlXMsGtv5sITzkTJ9RwUY1614vSkpN5Mmt0fliYcSdT CBwJlp7okGTvZ6cDonjA7K5nBQmYVXtfEHBgjH6VhKZVgImrk5HNHn6f.o8zdm_k49XLS5hW.dT0 xz8LNfjpccV22pG66zCnEkfM7_4gNVhTNWJKPymPAzRIFCiWIeN8jJETvgVQIfcD0WqxUcMeOzTU BqtlqYBT_Ck_TQkuAPzCD7SDq9khQGq0hFOZki4Q3e7tNpm8o_uvhppAoJtRd3.CeVS62CGyDV_x MME_ASqUIqASRlH5JShfj00TfLXCHTrqDcThZ8xsxmr7fSfki7SL3lLCb1VYEqF_8M6vWZrE0XQr _qYunTAYErgJ2tULZxlZWo6qKrvqqGbKyKCTuTApROKJXZK.A_U9KWjgadVwSseICj2vUHNr3jfo stBpXGYT83zObGC8kLgyFOmbPdRMogjqMW_AN8tCMi53otsnyU5OUeaCnYPsjnCm7xQw6dSiFWUR Dpa6G9O9RsU1dDo9oVmg.CXAbO8npZBXVOL6LuOOtin5d2CBoIsEih31b3ox9fEM3vU8k7RKURrl pwIcbMGtcvq2Zg5jWlP6AViYV6_wIforel31rJaF7HXdKiJnXaWxxmhU3CNBZvpI4g8Fd6sRpEHA pr1k13FD.I13AAVtahKPlqFYez0.9HViFzfr1vCzKUlDG_cjSw0g1yZuO6RrUkJMPCmYz0MvU8Zx YqqOKLFp1NoW5M5XzXrywWMm.TIYHF0Js_nMJIQyZThvS4RKy7yjG8uprkM1as6kqKZQRU72Q6Tf m_0cYaJhvGgxojlen8d_wWbjeV8E0Ltuv4Dc.KoBhmDnYm3coqpcJsKYty0qck9XCS.v_mefS7Ib Hp.vAY6anLZAH7HBXxzBg5uEyUlLPW607zs6dkNdEbEixEpCioLVAVNxViYQozHBUvuuzY35lqW7 UNh68PJNyOpmyu649LQDeTu7O_xaNC694gVWzgEJRtZM3hrUWVFpMZvMEBudP1HUziJlwC6nsS8D AozfVbCWUsU4uzU7ggpY6iQaDo7fDe7hAOC.wqZn_UwiftQYIqy.eo0Ed8UCD3kZAq_oTRlNi2cg L_46Cn.6UCGGkSviokUQVyufBy0Fau5A4LStfMqx1YUuvfw4Vuts5U_wYx4f.h7dSxTk3OxiQhCs j3zTsqahEK_FbQ_hWAvVV7_VAs34Oe6YsxsoszEZfhQvbjRlkJPSMU7lJkm5kS430xl2HcTSg3KC HUdBuBY2lCjJr92trnMXeLqwq3c76zes1e8D1tueQ9vq2qMvuEBa3gpmwdtoCLwoKr9IqyLlaeKe hor0VWx5WcZFJ_KoCST3bpeUhMfMD.Beiamm_ssbyAjzDwkiPgvDRiJ9CPy9r4hdPUq8JhaSvwun wowSwpq19M6Zim8FfFsbyazRPx7DCfO.8QpZTdr.oo7wEyTGs7diW3lqWGwKsPetHTIyIRfRa1yR G7G6wolWbiS58o4nOgYzoXt8MmKGyunFmzBCKbK2Er5mD5d3abPaPQvrsaF5OJAjSYraUNabNiYZ Jd..J3vlnbx3Xl_GoqqpEh_ra_7zYVUECqVYJUZUffVFr.hs7rWOJtuIwv7TRkOAmW8B8W5CpXak M3WGug32LVZthTwNzIhdzBHvpAHmZ08bfMRjXgWV0O6Z7V8w.Tv2HAsKSSvae_sm6razGAbgb6we 7plnSTP6Aad3tpBTp7RDK1nXTq9Xj_D.tNrfF2zv8.MZPwu36sQytXyv7nL3nkUAvftOGpWL7ow5 XANumG9_9eCV76I8gEBy2YlXqiAiTHFjQRlIUbGxo5HrmePAxxIM.L.QnzW7DYr5sr4D_JgiiND_ fmHz5pWJzbyLCRbFcaggSBShAR5.cALhakzYQ_3Pvh9pXYYalyRS2A4n5QOm2iN8x6rgo.p88Rq_ ZIDiHEyC0VUIoO4r4CUd4ZCcb7ugPV8LM9IF85Ek9u9jLxCLGzLEqwxsp17INiwQpf7KcLxOX1Xn n1Z_YehxdWSV_i3pV_UAAIA01dVv_C3tdD3umrWUvgAW3E64vQDq7fYzVWkQ0DJlbId9yaCAD308 ZINFg4L4iI1CpJNZr92bsGiRHOXbRsxpEGgnMJi8EtzAxgrtgXO9Vo7OC3eRW2pBmoIaxA4gPH3I _hbiVM6P.YEntmJJwTexB4CZt X-Sonic-MF: X-Sonic-ID: 194f1d79-40cb-4ef1-811f-9399768b077c Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:21 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:01 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 1/7] net, smack: Create a function to set secmarks Date: Mon, 31 Aug 2026 15:37:42 -0700 Message-ID: <20260831223748.4304-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Rather than open coding assignments to skb->secmark, use a helper function secxa_set_secmark(). This allows for a case where assigning a secmark is more complex than a simple assignment. The version of the function here does the legacy simple assignment. Change the functions that currently assign values to skb->secmark to use this function. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 28 ++++++++++++++++++++++++++++ net/netfilter/nft_meta.c | 5 +++-- net/netfilter/xt_CONNSECMARK.c | 3 ++- net/netfilter/xt_SECMARK.c | 3 ++- security/smack/smack_netfilter.c | 3 ++- 5 files changed, 37 insertions(+), 5 deletions(-) create mode 100644 include/linux/lsm_secxa.h diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h new file mode 100644 index 000000000000..926257d4730c --- /dev/null +++ b/include/linux/lsm_secxa.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * Copyright (C) 2026 Casey Schaufler + */ + +#ifndef __LINUX_LSM_SECXA_H +#define __LINUX_LSM_SECXA_H + +#ifdef CONFIG_NETWORK_SECMARK + +#include +#include + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + skb->secmark = secxa; +} +#else /* CONFIG_NETWORK_SECMARK */ + +struct sk_buff; + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ +} +#endif /* CONFIG_NETWORK_SECMARK */ + +#endif /* __LINUX_LSM_SECXA_H */ diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 0a43e0787a68..bd0f7a0931f4 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -502,7 +503,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, break; #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: - skb->secmark = value; + secxa_set_secmark(skb, value); break; #endif default: @@ -950,7 +951,7 @@ static void nft_secmark_obj_eval(struct nft_object *obj, struct nft_regs *regs, const struct nft_secmark *priv = nft_obj_data(obj); struct sk_buff *skb = pkt->skb; - skb->secmark = priv->secid; + secxa_set_secmark(skb, priv->secid); } static int nft_secmark_obj_init(const struct nft_ctx *ctx, diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e1..9d799d2459dc 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -14,6 +14,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -55,7 +56,7 @@ static void secmark_restore(struct sk_buff *skb) ct = nf_ct_get(skb, &ctinfo); if (ct && ct->secmark) - skb->secmark = ct->secmark; + secxa_set_secmark(skb, ct->secmark); } } diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9..ea67aa92ddc2 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -36,7 +37,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info) BUG(); } - skb->secmark = secmark; + secxa_set_secmark(skb, secmark); return XT_CONTINUE; } diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 17ba578b1308..b363c42f252e 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -29,7 +30,7 @@ static unsigned int smack_ip_output(void *priv, if (sk) { ssp = smack_sock(sk); skp = ssp->smk_out; - skb->secmark = skp->smk_secid; + secxa_set_secmark(skb, skp->smk_secid); } return NF_ACCEPT; -- 2.54.0