src/patches/suse-2.6.27.31/patches.apparmor/security-symlink.diff

   1 From: Tony Jones <tonyj@suse.de>
   2 Subject: Pass struct vfsmount to the inode_symlink LSM hook
   3
   4 This is needed for computing pathnames in the AppArmor LSM.
   5
   6 Signed-off-by: Tony Jones <tonyj@suse.de>
   7 Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
   8 Signed-off-by: John Johansen <jjohansen@suse.de>
   9
  10 ---
  11  fs/namei.c               |    2 +-
  12  include/linux/security.h |    8 +++++---
  13  security/capability.c    |    2 +-
  14  security/security.c      |    4 ++--
  15  security/selinux/hooks.c |    3 ++-
  16  5 files changed, 11 insertions(+), 8 deletions(-)
  17
  18 --- a/fs/namei.c
  19 +++ b/fs/namei.c
  20 @@ -2358,7 +2358,7 @@ int vfs_symlink(struct inode *dir, struc
  21         if (!dir->i_op || !dir->i_op->symlink)
  22                 return -EPERM;
  23
  24 -       error = security_inode_symlink(dir, dentry, oldname);
  25 +       error = security_inode_symlink(dir, dentry, mnt, oldname);
  26         if (error)
  27                 return error;
  28
  29 --- a/include/linux/security.h
  30 +++ b/include/linux/security.h
  31 @@ -355,6 +355,7 @@ static inline void security_free_mnt_opt
  32   *     Check the permission to create a symbolic link to a file.
  33   *     @dir contains the inode structure of parent directory of the symbolic link.
  34   *     @dentry contains the dentry structure of the symbolic link.
  35 + *     @mnt is the vfsmount corresponding to @dentry (may be NULL).
  36   *     @old_name contains the pathname of file.
  37   *     Return 0 if permission is granted.
  38   * @inode_mkdir:
  39 @@ -1363,8 +1364,8 @@ struct security_operations {
  40         int (*inode_link) (struct dentry *old_dentry,
  41                            struct inode *dir, struct dentry *new_dentry);
  42         int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
  43 -       int (*inode_symlink) (struct inode *dir,
  44 -                             struct dentry *dentry, const char *old_name);
  45 +       int (*inode_symlink) (struct inode *dir, struct dentry *dentry,
  46 +                             struct vfsmount *mnt, const char *old_name);
  47         int (*inode_mkdir) (struct inode *dir, struct dentry *dentry,
  48                             struct vfsmount *mnt, int mode);
  49         int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
  50 @@ -1634,7 +1635,7 @@ int security_inode_link(struct dentry *o
  51                          struct dentry *new_dentry);
  52  int security_inode_unlink(struct inode *dir, struct dentry *dentry);
  53  int security_inode_symlink(struct inode *dir, struct dentry *dentry,
  54 -                          const char *old_name);
  55 +                          struct vfsmount *mnt, const char *old_name);
  56  int security_inode_mkdir(struct inode *dir, struct dentry *dentry,
  57                          struct vfsmount *mnt, int mode);
  58  int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
  59 @@ -1999,6 +2000,7 @@ static inline int security_inode_unlink(
  60
  61  static inline int security_inode_symlink(struct inode *dir,
  62                                           struct dentry *dentry,
  63 +                                         struct vfsmount *mnt,
  64                                           const char *old_name)
  65  {
  66         return 0;
  67 --- a/security/capability.c
  68 +++ b/security/capability.c
  69 @@ -172,7 +172,7 @@ static int cap_inode_unlink(struct inode
  70  }
  71
  72  static int cap_inode_symlink(struct inode *inode, struct dentry *dentry,
  73 -                            const char *name)
  74 +                            struct vfsmount *mnt, const char *name)
  75  {
  76         return 0;
  77  }
  78 --- a/security/security.c
  79 +++ b/security/security.c
  80 @@ -382,11 +382,11 @@ int security_inode_unlink(struct inode *
  81  }
  82
  83  int security_inode_symlink(struct inode *dir, struct dentry *dentry,
  84 -                           const char *old_name)
  85 +                          struct vfsmount *mnt, const char *old_name)
  86  {
  87         if (unlikely(IS_PRIVATE(dir)))
  88                 return 0;
  89 -       return security_ops->inode_symlink(dir, dentry, old_name);
  90 +       return security_ops->inode_symlink(dir, dentry, mnt, old_name);
  91  }
  92
  93  int security_inode_mkdir(struct inode *dir, struct dentry *dentry,
  94 --- a/security/selinux/hooks.c
  95 +++ b/security/selinux/hooks.c
  96 @@ -2592,7 +2592,8 @@ static int selinux_inode_unlink(struct i
  97         return may_link(dir, dentry, MAY_UNLINK);
  98  }
  99
 100 -static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
 101 +static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry,
 102 +                                struct vfsmount *mnt, const char *name)
 103  {
 104         return may_create(dir, dentry, SECCLASS_LNK_FILE);
 105  }