diff options
| author | Eugene Syromiatnikov <esyr@redhat.com> | 2021-09-12 15:22:34 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-25 10:18:02 +0300 |
| commit | 633be494c3ca66a6c36e61100ffa0bd3d2923954 (patch) | |
| tree | 9d1c3b811c24c23bc6e90cbbb08f93ef5db65452 /include/uapi | |
| parent | 61a4cc41e5c1b77d05a12798f8032050aa75f3c8 (diff) | |
| download | linux-633be494c3ca66a6c36e61100ffa0bd3d2923954.tar.xz | |
include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage
commit 844f7eaaed9267ae17d33778efe65548cc940205 upstream.
Commit 2d151d39073a ("xfrm: Add possibility to set the default to block
if we have no policy") broke ABI by changing the value of the XFRM_MSG_MAPPING
enum item, thus also evading the build-time check
in security/selinux/nlmsgtab.c:selinux_nlmsg_lookup for presence of proper
security permission checks in nlmsg_xfrm_perms. Fix it by placing
XFRM_MSG_SETDEFAULT/XFRM_MSG_GETDEFAULT to the end of the enum, right before
__XFRM_MSG_MAX, and updating the nlmsg_xfrm_perms accordingly.
Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
References: https://lore.kernel.org/netdev/20210901151402.GA2557@altlinux.org/
Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
Acked-by: Antony Antony <antony.antony@secunet.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/uapi')
| -rw-r--r-- | include/uapi/linux/xfrm.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h index 6bae68645148..65e13a099b1a 100644 --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h @@ -213,13 +213,13 @@ enum { XFRM_MSG_GETSPDINFO, #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO + XFRM_MSG_MAPPING, +#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING + XFRM_MSG_SETDEFAULT, #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT XFRM_MSG_GETDEFAULT, #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT - - XFRM_MSG_MAPPING, -#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING __XFRM_MSG_MAX }; #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1) |