[PATCH v2 1/7] net, smack: Create a function to set secmarks

[John Johansen]

On 9/2/26 15:01, Casey Schaufler wrote:
> Rather than open coding assignments to skb->secmark, use a helper function
> secxa_set_secmark(). This allows for a case where assigning a secmark
> is more complex than a simple assignment. The version of the function
> here does the legacy simple assignment.
> 
> Change the functions that currently assign values to skb->secmark to
> use this function.
> 
> Signed-off-by: Casey Schaufler <casey at schaufler-ca.com>

looks good

Reviewed-by: John Johansen <john.johansen at canonical.com>

> ---
>   include/linux/lsm_secxa.h        | 28 ++++++++++++++++++++++++++++
>   net/netfilter/nft_meta.c         |  5 +++--
>   net/netfilter/xt_CONNSECMARK.c   |  3 ++-
>   net/netfilter/xt_SECMARK.c       |  3 ++-
>   security/smack/smack_netfilter.c |  3 ++-
>   5 files changed, 37 insertions(+), 5 deletions(-)
>   create mode 100644 include/linux/lsm_secxa.h
> 
> diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h
> new file mode 100644
> index 000000000000..926257d4730c
> --- /dev/null
> +++ b/include/linux/lsm_secxa.h
> @@ -0,0 +1,28 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +/*
> + * Copyright (C) 2026 Casey Schaufler <casey at schaufler-ca.com>
> + */
> +
> +#ifndef __LINUX_LSM_SECXA_H
> +#define __LINUX_LSM_SECXA_H
> +
> +#ifdef CONFIG_NETWORK_SECMARK
> +
> +#include <linux/security.h>
> +#include <linux/skbuff.h>
> +
> +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa)
> +{
> +	skb->secmark = secxa;
> +}
> +#else /* CONFIG_NETWORK_SECMARK */
> +
> +struct sk_buff;
> +
> +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa)
> +{
> +}
> +#endif /* CONFIG_NETWORK_SECMARK */
> +
> +#endif  /* __LINUX_LSM_SECXA_H */
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 0a43e0787a68..bd0f7a0931f4 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -17,6 +17,7 @@
>   #include <linux/random.h>
>   #include <linux/smp.h>
>   #include <linux/static_key.h>
> +#include <linux/lsm_secxa.h>
>   #include <net/dst.h>
>   #include <net/ip.h>
>   #include <net/sock.h>
> @@ -502,7 +503,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
>   		break;
>   #ifdef CONFIG_NETWORK_SECMARK
>   	case NFT_META_SECMARK:
> -		skb->secmark = value;
> +		secxa_set_secmark(skb, value);
>   		break;
>   #endif
>   	default:
> @@ -950,7 +951,7 @@ static void nft_secmark_obj_eval(struct nft_object *obj, struct nft_regs *regs,
>   	const struct nft_secmark *priv = nft_obj_data(obj);
>   	struct sk_buff *skb = pkt->skb;
>   
> -	skb->secmark = priv->secid;
> +	secxa_set_secmark(skb, priv->secid);
>   }
>   
>   static int nft_secmark_obj_init(const struct nft_ctx *ctx,
> diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
> index 1494b3ee30e1..9d799d2459dc 100644
> --- a/net/netfilter/xt_CONNSECMARK.c
> +++ b/net/netfilter/xt_CONNSECMARK.c
> @@ -14,6 +14,7 @@
>   #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
>   #include <linux/module.h>
>   #include <linux/skbuff.h>
> +#include <linux/lsm_secxa.h>
>   #include <linux/netfilter/x_tables.h>
>   #include <linux/netfilter/xt_CONNSECMARK.h>
>   #include <net/netfilter/nf_conntrack.h>
> @@ -55,7 +56,7 @@ static void secmark_restore(struct sk_buff *skb)
>   
>   		ct = nf_ct_get(skb, &ctinfo);
>   		if (ct && ct->secmark)
> -			skb->secmark = ct->secmark;
> +			secxa_set_secmark(skb, ct->secmark);
>   	}
>   }
>   
> diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
> index 5bc5ea505eb9..ea67aa92ddc2 100644
> --- a/net/netfilter/xt_SECMARK.c
> +++ b/net/netfilter/xt_SECMARK.c
> @@ -11,6 +11,7 @@
>   #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
>   #include <linux/module.h>
>   #include <linux/security.h>
> +#include <linux/lsm_secxa.h>
>   #include <linux/skbuff.h>
>   #include <linux/netfilter/x_tables.h>
>   #include <linux/netfilter/xt_SECMARK.h>
> @@ -36,7 +37,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info)
>   		BUG();
>   	}
>   
> -	skb->secmark = secmark;
> +	secxa_set_secmark(skb, secmark);
>   	return XT_CONTINUE;
>   }
>   
> diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c
> index 17ba578b1308..b363c42f252e 100644
> --- a/security/smack/smack_netfilter.c
> +++ b/security/smack/smack_netfilter.c
> @@ -14,6 +14,7 @@
>   #include <linux/netfilter_ipv4.h>
>   #include <linux/netfilter_ipv6.h>
>   #include <linux/netdevice.h>
> +#include <linux/lsm_secxa.h>
>   #include <net/inet_sock.h>
>   #include <net/net_namespace.h>
>   #include "smack.h"
> @@ -29,7 +30,7 @@ static unsigned int smack_ip_output(void *priv,
>   	if (sk) {
>   		ssp = smack_sock(sk);
>   		skp = ssp->smk_out;
> -		skb->secmark = skp->smk_secid;
> +		secxa_set_secmark(skb, skp->smk_secid);
>   	}
>   
>   	return NF_ACCEPT;