src/patches/suse-2.6.27.31/patches.apparmor/security-rename.diff

   1 From: Tony Jones <tonyj@suse.de>
   2 Subject: Pass struct vfsmount to the inode_rename LSM hook
   3
   4 This is needed for computing pathnames in the AppArmor LSM.
   5
   6 Signed-off-by: Tony Jones <tonyj@suse.de>
   7 Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
   8 Signed-off-by: John Johansen <jjohansen@suse.de>
   9
  10 ---
  11  fs/namei.c                 |    6 ++++--
  12  include/linux/security.h   |   13 ++++++++++---
  13  security/capability.c      |    3 ++-
  14  security/security.c        |    7 ++++---
  15  security/selinux/hooks.c   |    8 ++++++--
  16  security/smack/smack_lsm.c |    6 +++++-
  17  6 files changed, 31 insertions(+), 12 deletions(-)
  18
  19 --- a/fs/namei.c
  20 +++ b/fs/namei.c
  21 @@ -2563,7 +2563,8 @@ static int vfs_rename_dir(struct inode *
  22                         return error;
  23         }
  24
  25 -       error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
  26 +       error = security_inode_rename(old_dir, old_dentry, old_mnt,
  27 +                                     new_dir, new_dentry, new_mnt);
  28         if (error)
  29                 return error;
  30
  31 @@ -2597,7 +2598,8 @@ static int vfs_rename_other(struct inode
  32         struct inode *target;
  33         int error;
  34
  35 -       error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
  36 +       error = security_inode_rename(old_dir, old_dentry, old_mnt,
  37 +                                     new_dir, new_dentry, new_mnt);
  38         if (error)
  39                 return error;
  40
  41 --- a/include/linux/security.h
  42 +++ b/include/linux/security.h
  43 @@ -390,8 +390,10 @@ static inline void security_free_mnt_opt
  44   *     Check for permission to rename a file or directory.
  45   *     @old_dir contains the inode structure for parent of the old link.
  46   *     @old_dentry contains the dentry structure of the old link.
  47 + *     @old_mnt is the vfsmount corresponding to @old_dentry (may be NULL).
  48   *     @new_dir contains the inode structure for parent of the new link.
  49   *     @new_dentry contains the dentry structure of the new link.
  50 + *     @new_mnt is the vfsmount corresponding to @new_dentry (may be NULL).
  51   *     Return 0 if permission is granted.
  52   * @inode_readlink:
  53   *     Check the permission to read the symbolic link.
  54 @@ -1380,7 +1382,9 @@ struct security_operations {
  55         int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
  56                             struct vfsmount *mnt, int mode, dev_t dev);
  57         int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
  58 -                            struct inode *new_dir, struct dentry *new_dentry);
  59 +                            struct vfsmount *old_mnt,
  60 +                            struct inode *new_dir, struct dentry *new_dentry,
  61 +                            struct vfsmount *new_mnt);
  62         int (*inode_readlink) (struct dentry *dentry, struct vfsmount *mnt);
  63         int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
  64         int (*inode_permission) (struct inode *inode, int mask);
  65 @@ -1653,7 +1657,8 @@ int security_inode_rmdir(struct inode *d
  66  int security_inode_mknod(struct inode *dir, struct dentry *dentry,
  67                          struct vfsmount *mnt, int mode, dev_t dev);
  68  int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
  69 -                         struct inode *new_dir, struct dentry *new_dentry);
  70 +                         struct vfsmount *old_mnt, struct inode *new_dir,
  71 +                         struct dentry *new_dentry, struct vfsmount *new_mnt);
  72  int security_inode_readlink(struct dentry *dentry, struct vfsmount *mnt);
  73  int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd);
  74  int security_inode_permission(struct inode *inode, int mask);
  75 @@ -2045,8 +2050,10 @@ static inline int security_inode_mknod(s
  76
  77  static inline int security_inode_rename(struct inode *old_dir,
  78                                          struct dentry *old_dentry,
  79 +                                        struct vfsmount *old_mnt,
  80                                          struct inode *new_dir,
  81 -                                        struct dentry *new_dentry)
  82 +                                        struct dentry *new_dentry,
  83 +                                        struct vfsmount *new_mnt)
  84  {
  85         return 0;
  86  }
  87 --- a/security/capability.c
  88 +++ b/security/capability.c
  89 @@ -198,7 +198,8 @@ static int cap_inode_mknod(struct inode
  90  }
  91
  92  static int cap_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
  93 -                           struct inode *new_inode, struct dentry *new_dentry)
  94 +                           struct vfsmount *old_mnt, struct inode *new_inode,
  95 +                           struct dentry *new_dentry, struct vfsmount *new_mnt)
  96  {
  97         return 0;
  98  }
  99 --- a/security/security.c
 100 +++ b/security/security.c
 101 @@ -414,13 +414,14 @@ int security_inode_mknod(struct inode *d
 102  }
 103
 104  int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
 105 -                          struct inode *new_dir, struct dentry *new_dentry)
 106 +                         struct vfsmount *old_mnt, struct inode *new_dir,
 107 +                         struct dentry *new_dentry, struct vfsmount *new_mnt)
 108  {
 109          if (unlikely(IS_PRIVATE(old_dentry->d_inode) ||
 110              (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
 111                 return 0;
 112 -       return security_ops->inode_rename(old_dir, old_dentry,
 113 -                                          new_dir, new_dentry);
 114 +       return security_ops->inode_rename(old_dir, old_dentry, old_mnt,
 115 +                                          new_dir, new_dentry, new_mnt);
 116  }
 117
 118  int security_inode_readlink(struct dentry *dentry, struct vfsmount *mnt)
 119 --- a/security/selinux/hooks.c
 120 +++ b/security/selinux/hooks.c
 121 @@ -2628,8 +2628,12 @@ static int selinux_inode_mknod(struct in
 122         return may_create(dir, dentry, inode_mode_to_security_class(mode));
 123  }
 124
 125 -static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
 126 -                               struct inode *new_inode, struct dentry *new_dentry)
 127 +static int selinux_inode_rename(struct inode *old_inode,
 128 +                               struct dentry *old_dentry,
 129 +                               struct vfsmount *old_mnt,
 130 +                                struct inode *new_inode,
 131 +                               struct dentry *new_dentry,
 132 +                               struct vfsmount *new_mnt)
 133  {
 134         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
 135  }
 136 --- a/security/smack/smack_lsm.c
 137 +++ b/security/smack/smack_lsm.c
 138 @@ -509,8 +509,10 @@ static int smack_inode_rmdir(struct inod
 139   * smack_inode_rename - Smack check on rename
 140   * @old_inode: the old directory
 141   * @old_dentry: unused
 142 + * @old_mnt: unused
 143   * @new_inode: the new directory
 144   * @new_dentry: unused
 145 + * @new_mnt: unused
 146   *
 147   * Read and write access is required on both the old and
 148   * new directories.
 149 @@ -519,8 +521,10 @@ static int smack_inode_rmdir(struct inod
 150   */
 151  static int smack_inode_rename(struct inode *old_inode,
 152                               struct dentry *old_dentry,
 153 +                             struct vfsmount *old_mnt,
 154                               struct inode *new_inode,
 155 -                             struct dentry *new_dentry)
 156 +                             struct dentry *new_dentry,
 157 +                             struct vfsmount *new_mnt)
 158  {
 159         int rc;
 160         char *isp;