src/patches/suse-2.6.27.39/patches.apparmor/security-mkdir.diff

   1 From: Tony Jones <tonyj@suse.de>
   2 Subject: Pass struct vfsmount to the inode_mkdir LSM hook
   3
   4 This is needed for computing pathnames in the AppArmor LSM.
   5
   6 Signed-off-by: Tony Jones <tonyj@suse.de>
   7 Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
   8 Signed-off-by: John Johansen <jjohansen@suse.de>
   9
  10 ---
  11  fs/namei.c               |    2 +-
  12  include/linux/security.h |    8 ++++++--
  13  security/capability.c    |    2 +-
  14  security/security.c      |    5 +++--
  15  security/selinux/hooks.c |    3 ++-
  16  5 files changed, 13 insertions(+), 7 deletions(-)
  17
  18 --- a/fs/namei.c
  19 +++ b/fs/namei.c
  20 @@ -2089,7 +2089,7 @@ int vfs_mkdir(struct inode *dir, struct
  21                 return -EPERM;
  22
  23         mode &= (S_IRWXUGO|S_ISVTX);
  24 -       error = security_inode_mkdir(dir, dentry, mode);
  25 +       error = security_inode_mkdir(dir, dentry, mnt, mode);
  26         if (error)
  27                 return error;
  28
  29 --- a/include/linux/security.h
  30 +++ b/include/linux/security.h
  31 @@ -362,6 +362,7 @@ static inline void security_free_mnt_opt
  32   *     associated with inode strcture @dir.
  33   *     @dir containst the inode structure of parent of the directory to be created.
  34   *     @dentry contains the dentry structure of new directory.
  35 + *     @mnt is the vfsmount corresponding to @dentry (may be NULL).
  36   *     @mode contains the mode of new directory.
  37   *     Return 0 if permission is granted.
  38   * @inode_rmdir:
  39 @@ -1363,7 +1364,8 @@ struct security_operations {
  40         int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
  41         int (*inode_symlink) (struct inode *dir,
  42                               struct dentry *dentry, const char *old_name);
  43 -       int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
  44 +       int (*inode_mkdir) (struct inode *dir, struct dentry *dentry,
  45 +                           struct vfsmount *mnt, int mode);
  46         int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
  47         int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
  48                             int mode, dev_t dev);
  49 @@ -1632,7 +1634,8 @@ int security_inode_link(struct dentry *o
  50  int security_inode_unlink(struct inode *dir, struct dentry *dentry);
  51  int security_inode_symlink(struct inode *dir, struct dentry *dentry,
  52                            const char *old_name);
  53 -int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode);
  54 +int security_inode_mkdir(struct inode *dir, struct dentry *dentry,
  55 +                        struct vfsmount *mnt, int mode);
  56  int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
  57  int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev);
  58  int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
  59 @@ -2001,6 +2004,7 @@ static inline int security_inode_symlink
  60
  61  static inline int security_inode_mkdir(struct inode *dir,
  62                                         struct dentry *dentry,
  63 +                                       struct vfsmount *mnt,
  64                                         int mode)
  65  {
  66         return 0;
  67 --- a/security/capability.c
  68 +++ b/security/capability.c
  69 @@ -178,7 +178,7 @@ static int cap_inode_symlink(struct inod
  70  }
  71
  72  static int cap_inode_mkdir(struct inode *inode, struct dentry *dentry,
  73 -                          int mask)
  74 +                          struct vfsmount *mnt, int mask)
  75  {
  76         return 0;
  77  }
  78 --- a/security/security.c
  79 +++ b/security/security.c
  80 @@ -386,11 +386,12 @@ int security_inode_symlink(struct inode
  81         return security_ops->inode_symlink(dir, dentry, old_name);
  82  }
  83
  84 -int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode)
  85 +int security_inode_mkdir(struct inode *dir, struct dentry *dentry,
  86 +                        struct vfsmount *mnt, int mode)
  87  {
  88         if (unlikely(IS_PRIVATE(dir)))
  89                 return 0;
  90 -       return security_ops->inode_mkdir(dir, dentry, mode);
  91 +       return security_ops->inode_mkdir(dir, dentry, mnt, mode);
  92  }
  93
  94  int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
  95 --- a/security/selinux/hooks.c
  96 +++ b/security/selinux/hooks.c
  97 @@ -2597,7 +2597,8 @@ static int selinux_inode_symlink(struct
  98         return may_create(dir, dentry, SECCLASS_LNK_FILE);
  99  }
 100
 101 -static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
 102 +static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry,
 103 +                              struct vfsmount *mnt, int mask)
 104  {
 105         return may_create(dir, dentry, SECCLASS_DIR);
 106  }