lsm: Remove the socket_post_accept() hook

The socket_post_accept() hook is not currently used by any in-tree modules
and its existence continues to cause problems by confusing people about
what can be safely accomplished using this hook.  If a legitimate need for
this hook arises in the future it can always be reintroduced.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/include/linux/security.h b/include/linux/security.h
index 1f2ab6353c00a323198c0400d69aff158447e24e..54ed15799a8315fd1738390ef4c5666353ddc435 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -880,11 +880,6 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *     @sock contains the listening socket structure.
  *     @newsock contains the newly created server socket for connection.
  *     Return 0 if permission is granted.
- * @socket_post_accept:
- *     This hook allows a security module to copy security
- *     information into the newly created socket's inode.
- *     @sock contains the listening socket structure.
- *     @newsock contains the newly created server socket for connection.
  * @socket_sendmsg:
  *     Check permission before transmitting a message to another socket.
  *     @sock contains the socket structure.
@@ -1554,8 +1549,6 @@ struct security_operations {
                               struct sockaddr *address, int addrlen);
        int (*socket_listen) (struct socket *sock, int backlog);
        int (*socket_accept) (struct socket *sock, struct socket *newsock);
-       void (*socket_post_accept) (struct socket *sock,
-                                   struct socket *newsock);
        int (*socket_sendmsg) (struct socket *sock,
                               struct msghdr *msg, int size);
        int (*socket_recvmsg) (struct socket *sock,
@@ -2537,7 +2530,6 @@ int security_socket_bind(struct socket *sock, struct sockaddr *address, int addr
 int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
 int security_socket_listen(struct socket *sock, int backlog);
 int security_socket_accept(struct socket *sock, struct socket *newsock);
-void security_socket_post_accept(struct socket *sock, struct socket *newsock);
 int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
 int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
                            int size, int flags);
@@ -2616,11 +2608,6 @@ static inline int security_socket_accept(struct socket *sock,
        return 0;
 }
 
-static inline void security_socket_post_accept(struct socket *sock,
-                                              struct socket *newsock)
-{
-}
-
 static inline int security_socket_sendmsg(struct socket *sock,
                                          struct msghdr *msg, int size)
 {

diff --git a/net/socket.c b/net/socket.c
index 0b14b79c03aff9503f4c56f80b4a6e5850737ca8..91d0c0254ffe7113e98e90a24bd7a824424e9a7f 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1536,8 +1536,6 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
        fd_install(newfd, newfile);
        err = newfd;
 
-       security_socket_post_accept(sock, newsock);
-
 out_put:
        fput_light(sock->file, fput_needed);
 out:

diff --git a/security/capability.c b/security/capability.c
index c545bd1300b5f77d0278be05b546297141251d5d..21b6cead6a8ed38927abab1bd8cd9c491194c1bf 100644 (file)
--- a/security/capability.c
+++ b/security/capability.c
@@ -620,10 +620,6 @@ static int cap_socket_accept(struct socket *sock, struct socket *newsock)
        return 0;
 }
 
-static void cap_socket_post_accept(struct socket *sock, struct socket *newsock)
-{
-}
-
 static int cap_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
 {
        return 0;
@@ -1014,7 +1010,6 @@ void security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, socket_connect);
        set_to_cap_if_null(ops, socket_listen);
        set_to_cap_if_null(ops, socket_accept);
-       set_to_cap_if_null(ops, socket_post_accept);
        set_to_cap_if_null(ops, socket_sendmsg);
        set_to_cap_if_null(ops, socket_recvmsg);
        set_to_cap_if_null(ops, socket_getsockname);

diff --git a/security/security.c b/security/security.c
index c3586c0d97e2f17c672d1f2cfec8584b580ed5e6..206e53844d2f86b5658d9524b0af9d83ddd41c05 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -1007,11 +1007,6 @@ int security_socket_accept(struct socket *sock, struct socket *newsock)
        return security_ops->socket_accept(sock, newsock);
 }
 
-void security_socket_post_accept(struct socket *sock, struct socket *newsock)
-{
-       security_ops->socket_post_accept(sock, newsock);
-}
-
 int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
 {
        return security_ops->socket_sendmsg(sock, msg, size);