Re: [PATCH v6 04/11] LSM: syscalls for current process attributes

[Florian Weimer <fweimer@redhat.com>]

* Casey Schaufler:

> Create a system call lsm_get_self_attr() to provide the security
> module maintained attributes of the current process.

Is it really the current process, or the current thread?

> diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h
> index 523748cae615..7850fed28998 100644
> --- a/include/uapi/linux/lsm.h
> +++ b/include/uapi/linux/lsm.h
> @@ -9,6 +9,39 @@
>  #ifndef _UAPI_LINUX_LSM_H
>  #define _UAPI_LINUX_LSM_H
>  
> +#include <linux/types.h>
> +#include <linux/unistd.h>
> +
> +/**
> + * struct lsm_ctx - LSM context information
> + * @id: the LSM id number, see LSM_ID_XXX
> + * @flags: LSM specific flags
> + * @len: length of the lsm_ctx struct, @ctx and any other data or padding
> + * @ctx_len: the size of @ctx
> + * @ctx: the LSM context value
> + *
> + * The @len field MUST be equal to the size of the lsm_ctx struct
> + * plus any additional padding and/or data placed after @ctx.
> + *
> + * In all cases @ctx_len MUST be equal to the length of @ctx.
> + * If @ctx is a string value it should be nul terminated with
> + * @ctx_len equal to `strlen(@ctx) + 1`.  Binary values are
> + * supported.
> + *
> + * The @flags and @ctx fields SHOULD only be interpreted by the
> + * LSM specified by @id; they MUST be set to zero/0 when not used.
> + */
> +struct lsm_ctx {
> +	__u64	id;
> +	__u64	flags;
> +	__u64	len;
> +	__u64	ctx_len;
> +	__u8	ctx[];
> +};

The documentation seems to be written from the LSM point of view, not
the application point of view.  As far as I understand it, the LSM
writes to the ctx member, not the application.

Thanks,
Florian