Merge tag 'Smack-for-5.15' of git://github.com/cschaufler/smack-next

Pull smack updates from Casey Schaufler:
 "There is a variable used only during start-up that's now marked
  __initdata and a change where the code was working by sheer luck that
  is now done properly.

  Both have been in next for several weeks and pass the Smack testsuite"

* tag 'Smack-for-5.15' of git://github.com/cschaufler/smack-next:
  smack: mark 'smack_enabled' global variable as __initdata
  Smack: Fix wrong semantics in smk_access_entry()

diff --git a/security/smack/smack.h b/security/smack/smack.h
index c3cfbdf..99c3422 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -302,7 +302,7 @@ int smack_populate_secattr(struct smack_known *skp);
 /*
  * Shared data.
  */
-extern int smack_enabled;
+extern int smack_enabled __initdata;
 extern int smack_cipso_direct;
 extern int smack_cipso_mapped;
 extern struct smack_known *smack_net_ambient;

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 1f391f6..d2186e2 100644 (file)
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;
 int smk_access_entry(char *subject_label, char *object_label,
                        struct list_head *rule_list)
 {
-       int may = -ENOENT;
        struct smack_rule *srp;
 
        list_for_each_entry_rcu(srp, rule_list, list) {
                if (srp->smk_object->smk_known == object_label &&
                    srp->smk_subject->smk_known == subject_label) {
-                       may = srp->smk_access;
-                       break;
+                       int may = srp->smk_access;
+                       /*
+                        * MAY_WRITE implies MAY_LOCK.
+                        */
+                       if ((may & MAY_WRITE) == MAY_WRITE)
+                               may |= MAY_LOCK;
+                       return may;
                }
        }
 
-       /*
-        * MAY_WRITE implies MAY_LOCK.
-        */
-       if ((may & MAY_WRITE) == MAY_WRITE)
-               may |= MAY_LOCK;
-       return may;
+       return -ENOENT;
 }
 
 /**

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 223a6da..cacbe75 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -54,7 +54,7 @@
 static DEFINE_MUTEX(smack_ipv6_lock);
 static LIST_HEAD(smk_ipv6_port_list);
 struct kmem_cache *smack_rule_cache;
-int smack_enabled;
+int smack_enabled __initdata;
 
 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s}
 static struct {