1 From: Tony Jones <tonyj@suse.de>
2 Subject: Pass struct vfsmount to the inode_create LSM hook
4 This is needed for computing pathnames in the AppArmor LSM.
6 Signed-off-by: Tony Jones <tonyj@suse.de>
7 Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
8 Signed-off-by: John Johansen <jjohansen@suse.de>
12 include/linux/security.h | 9 ++++++---
13 security/capability.c | 2 +-
14 security/security.c | 5 +++--
15 security/selinux/hooks.c | 3 ++-
16 5 files changed, 13 insertions(+), 8 deletions(-)
20 @@ -1543,7 +1543,7 @@ int vfs_create(struct inode *dir, struct
21 return -EACCES; /* shouldn't it be ENOSYS? */
24 - error = security_inode_create(dir, dentry, mode);
25 + error = security_inode_create(dir, dentry, nd ? nd->path.mnt : NULL, mode);
29 --- a/include/linux/security.h
30 +++ b/include/linux/security.h
31 @@ -337,6 +337,7 @@ static inline void security_free_mnt_opt
32 * Check permission to create a regular file.
33 * @dir contains inode structure of the parent of the new file.
34 * @dentry contains the dentry structure for the file to be created.
35 + * @mnt is the vfsmount corresponding to @dentry (may be NULL).
36 * @mode contains the file mode of the file to be created.
37 * Return 0 if permission is granted.
39 @@ -1354,8 +1355,8 @@ struct security_operations {
40 void (*inode_free_security) (struct inode *inode);
41 int (*inode_init_security) (struct inode *inode, struct inode *dir,
42 char **name, void **value, size_t *len);
43 - int (*inode_create) (struct inode *dir,
44 - struct dentry *dentry, int mode);
45 + int (*inode_create) (struct inode *dir, struct dentry *dentry,
46 + struct vfsmount *mnt, int mode);
47 int (*inode_link) (struct dentry *old_dentry,
48 struct inode *dir, struct dentry *new_dentry);
49 int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
50 @@ -1622,7 +1623,8 @@ int security_inode_alloc(struct inode *i
51 void security_inode_free(struct inode *inode);
52 int security_inode_init_security(struct inode *inode, struct inode *dir,
53 char **name, void **value, size_t *len);
54 -int security_inode_create(struct inode *dir, struct dentry *dentry, int mode);
55 +int security_inode_create(struct inode *dir, struct dentry *dentry,
56 + struct vfsmount *mnt, int mode);
57 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
58 struct dentry *new_dentry);
59 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
60 @@ -1968,6 +1970,7 @@ static inline int security_inode_init_se
62 static inline int security_inode_create(struct inode *dir,
63 struct dentry *dentry,
64 + struct vfsmount *mnt,
68 --- a/security/capability.c
69 +++ b/security/capability.c
70 @@ -155,7 +155,7 @@ static int cap_inode_init_security(struc
73 static int cap_inode_create(struct inode *inode, struct dentry *dentry,
75 + struct vfsmount *mnt, int mask)
79 --- a/security/security.c
80 +++ b/security/security.c
81 @@ -358,11 +358,12 @@ int security_inode_init_security(struct
83 EXPORT_SYMBOL(security_inode_init_security);
85 -int security_inode_create(struct inode *dir, struct dentry *dentry, int mode)
86 +int security_inode_create(struct inode *dir, struct dentry *dentry,
87 + struct vfsmount *mnt, int mode)
89 if (unlikely(IS_PRIVATE(dir)))
91 - return security_ops->inode_create(dir, dentry, mode);
92 + return security_ops->inode_create(dir, dentry, mnt, mode);
95 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
96 --- a/security/selinux/hooks.c
97 +++ b/security/selinux/hooks.c
98 @@ -2566,7 +2566,8 @@ static int selinux_inode_init_security(s
102 -static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
103 +static int selinux_inode_create(struct inode *dir, struct dentry *dentry,
104 + struct vfsmount *mnt, int mask)
106 return may_create(dir, dentry, SECCLASS_FILE);