lsm: add backing_file LSM hooks

Stacked filesystems such as overlayfs do not currently provide the
necessary mechanisms for LSMs to properly enforce access controls on the
mmap() and mprotect() operations.  In order to resolve this gap, a LSM
security blob is being added to the backing_file struct and the following
new LSM hooks are being created:

 security_backing_file_alloc()
 security_backing_file_free()
 security_mmap_backing_file()

The first two hooks are to manage the lifecycle of the LSM security blob
in the backing_file struct, while the third provides a new mmap() access
control point for the underlying backing file.  It is also expected that
LSMs will likely want to update their security_file_mprotect() callback
to address issues with their mprotect() controls, but that does not
require a change to the security_file_mprotect() LSM hook.

There are a three other small changes to support these new LSM hooks:
* Pass the user file associated with a backing file down to
alloc_empty_backing_file() so it can be included in the
security_backing_file_alloc() hook.
* Add getter and setter functions for the backing_file struct LSM blob
as the backing_file struct remains private to fs/file_table.c.
* Constify the file struct field in the LSM common_audit_data struct to
better support LSMs that need to pass a const file struct pointer into
the common LSM audit code.

Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL()
and supplying a fixup.

Cc: stable@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-unionfs@vger.kernel.org
Cc: linux-erofs@lists.ozlabs.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/fs/backing-file.c b/fs/backing-file.c
index 45da8600d56440da83b51700263e98c05b762fe3..1f3bbfc758823fa024958f2efda5778f1d502c0c 100644 (file)
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -12,6 +12,7 @@
 #include <linux/backing-file.h>
 #include <linux/splice.h>
 #include <linux/mm.h>
+#include <linux/security.h>
 
 #include "internal.h"
 
@@ -29,14 +30,15 @@
  * returned file into a container structure that also stores the stacked
  * file's path, which can be retrieved using backing_file_user_path().
  */
-struct file *backing_file_open(const struct path *user_path, int flags,
+struct file *backing_file_open(const struct file *user_file, int flags,
                               const struct path *real_path,
                               const struct cred *cred)
 {
+       const struct path *user_path = &user_file->f_path;
        struct file *f;
        int error;
 
-       f = alloc_empty_backing_file(flags, cred);
+       f = alloc_empty_backing_file(flags, cred, user_file);
        if (IS_ERR(f))
                return f;
 
@@ -52,15 +54,16 @@ struct file *backing_file_open(const struct path *user_path, int flags,
 }
 EXPORT_SYMBOL_GPL(backing_file_open);
 
-struct file *backing_tmpfile_open(const struct path *user_path, int flags,
+struct file *backing_tmpfile_open(const struct file *user_file, int flags,
                                  const struct path *real_parentpath,
                                  umode_t mode, const struct cred *cred)
 {
        struct mnt_idmap *real_idmap = mnt_idmap(real_parentpath->mnt);
+       const struct path *user_path = &user_file->f_path;
        struct file *f;
        int error;
 
-       f = alloc_empty_backing_file(flags, cred);
+       f = alloc_empty_backing_file(flags, cred, user_file);
        if (IS_ERR(f))
                return f;
 
@@ -336,8 +339,13 @@ int backing_file_mmap(struct file *file, struct vm_area_struct *vma,
 
        vma_set_file(vma, file);
 
-       scoped_with_creds(ctx->cred)
+       scoped_with_creds(ctx->cred) {
+               ret = security_mmap_backing_file(vma, file, user_file);
+               if (ret)
+                       return ret;
+
                ret = vfs_mmap(vma->vm_file, vma);
+       }
 
        if (ctx->accessed)
                ctx->accessed(user_file);

diff --git a/fs/erofs/ishare.c b/fs/erofs/ishare.c
index ce980320a8b99605496b2853687145bf41644aeb..a1efc46d5987c88580a2b0c4af610c08e53ef117 100644 (file)
--- a/fs/erofs/ishare.c
+++ b/fs/erofs/ishare.c
@@ -4,6 +4,7 @@
  */
 #include <linux/xxhash.h>
 #include <linux/mount.h>
+#include <linux/security.h>
 #include "internal.h"
 #include "xattr.h"
 
@@ -102,7 +103,8 @@ static int erofs_ishare_file_open(struct inode *inode, struct file *file)
 
        if (file->f_flags & O_DIRECT)
                return -EINVAL;
-       realfile = alloc_empty_backing_file(O_RDONLY|O_NOATIME, current_cred());
+       realfile = alloc_empty_backing_file(O_RDONLY|O_NOATIME, current_cred(),
+                                           file);
        if (IS_ERR(realfile))
                return PTR_ERR(realfile);
        ihold(sharedinode);
@@ -146,8 +148,14 @@ static ssize_t erofs_ishare_file_read_iter(struct kiocb *iocb,
 static int erofs_ishare_mmap(struct file *file, struct vm_area_struct *vma)
 {
        struct file *realfile = file->private_data;
+       int err;
 
        vma_set_file(vma, realfile);
+
+       err = security_mmap_backing_file(vma, realfile, file);
+       if (err)
+               return err;
+
        return generic_file_readonly_mmap(file, vma);
 }
 

diff --git a/fs/file_table.c b/fs/file_table.c
index 3b3792903185ca198f4b4f4729904b8963b00b3c..d19d879b6efc1daf6b60815061c8753964cbc2ca 100644 (file)
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -50,6 +50,9 @@ struct backing_file {
                struct path user_path;
                freeptr_t bf_freeptr;
        };
+#ifdef CONFIG_SECURITY
+       void *security;
+#endif
 };
 
 #define backing_file(f) container_of(f, struct backing_file, file)
@@ -66,8 +69,21 @@ void backing_file_set_user_path(struct file *f, const struct path *path)
 }
 EXPORT_SYMBOL_GPL(backing_file_set_user_path);
 
+#ifdef CONFIG_SECURITY
+void *backing_file_security(const struct file *f)
+{
+       return backing_file(f)->security;
+}
+
+void backing_file_set_security(struct file *f, void *security)
+{
+       backing_file(f)->security = security;
+}
+#endif /* CONFIG_SECURITY */
+
 static inline void backing_file_free(struct backing_file *ff)
 {
+       security_backing_file_free(&ff->file);
        path_put(&ff->user_path);
        kmem_cache_free(bfilp_cachep, ff);
 }
@@ -288,10 +304,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred)
        return f;
 }
 
-static int init_backing_file(struct backing_file *ff)
+static int init_backing_file(struct backing_file *ff,
+                            const struct file *user_file)
 {
        memset(&ff->user_path, 0, sizeof(ff->user_path));
-       return 0;
+       backing_file_set_security(&ff->file, NULL);
+       return security_backing_file_alloc(&ff->file, user_file);
 }
 
 /*
@@ -301,7 +319,8 @@ static int init_backing_file(struct backing_file *ff)
  * This is only for kernel internal use, and the allocate file must not be
  * installed into file tables or such.
  */
-struct file *alloc_empty_backing_file(int flags, const struct cred *cred)
+struct file *alloc_empty_backing_file(int flags, const struct cred *cred,
+                                     const struct file *user_file)
 {
        struct backing_file *ff;
        int error;
@@ -318,7 +337,7 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred)
 
        /* The f_mode flags must be set before fput(). */
        ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT;
-       error = init_backing_file(ff);
+       error = init_backing_file(ff, user_file);
        if (unlikely(error)) {
                fput(&ff->file);
                return ERR_PTR(error);

diff --git a/fs/fuse/passthrough.c b/fs/fuse/passthrough.c
index 72de97c03d0eeb93bf0943ac6f6fb1ca714dec2c..f2d08ac2459b7e05578edd56960e1028d6d1bb49 100644 (file)
--- a/fs/fuse/passthrough.c
+++ b/fs/fuse/passthrough.c
@@ -167,7 +167,7 @@ struct fuse_backing *fuse_passthrough_open(struct file *file, int backing_id)
                goto out;
 
        /* Allocate backing file per fuse file to store fuse path */
-       backing_file = backing_file_open(&file->f_path, file->f_flags,
+       backing_file = backing_file_open(file, file->f_flags,
                                         &fb->file->f_path, fb->cred);
        err = PTR_ERR(backing_file);
        if (IS_ERR(backing_file)) {

diff --git a/fs/internal.h b/fs/internal.h
index cbc384a1aa096ade4734f9c80ec978fd2ea6977f..77e90e4124e09ac823853a8bfd5b25feed0e37b2 100644 (file)
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -106,7 +106,8 @@ extern void chroot_fs_refs(const struct path *, const struct path *);
  */
 struct file *alloc_empty_file(int flags, const struct cred *cred);
 struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred);
-struct file *alloc_empty_backing_file(int flags, const struct cred *cred);
+struct file *alloc_empty_backing_file(int flags, const struct cred *cred,
+                                     const struct file *user_file);
 void backing_file_set_user_path(struct file *f, const struct path *path);
 
 static inline void file_put_write_access(struct file *file)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index ff3dbd1ca61f280d1495bb52182a2da9a6b28119..f2f20a611af3ad5d1c9c4cc0f8c9d48bcd2d03d3 100644 (file)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1374,7 +1374,7 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry,
                                return PTR_ERR(cred);
 
                        ovl_path_upper(dentry->d_parent, &realparentpath);
-                       realfile = backing_tmpfile_open(&file->f_path, flags, &realparentpath,
+                       realfile = backing_tmpfile_open(file, flags, &realparentpath,
                                                        mode, current_cred());
                        err = PTR_ERR_OR_ZERO(realfile);
                        pr_debug("tmpfile/open(%pd2, 0%o) = %i\n", realparentpath.dentry, mode, err);

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index 97bed2286030daf3403fa3dc458cbadbd99df3c6..27cc07738f33bf9a29ebc4092f9b89f71e76bee9 100644 (file)
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -48,7 +48,7 @@ static struct file *ovl_open_realfile(const struct file *file,
                        if (!inode_owner_or_capable(real_idmap, realinode))
                                flags &= ~O_NOATIME;
 
-                       realfile = backing_file_open(file_user_path(file),
+                       realfile = backing_file_open(file,
                                                     flags, realpath, current_cred());
                }
        }

diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h
index 1476a6ed1bfd77d447b9802c947b944582127f87..c939cd222730c4eadb714f532423bedc8cd96485 100644 (file)
--- a/include/linux/backing-file.h
+++ b/include/linux/backing-file.h
@@ -18,10 +18,10 @@ struct backing_file_ctx {
        void (*end_write)(struct kiocb *iocb, ssize_t);
 };
 
-struct file *backing_file_open(const struct path *user_path, int flags,
+struct file *backing_file_open(const struct file *user_file, int flags,
                               const struct path *real_path,
                               const struct cred *cred);
-struct file *backing_tmpfile_open(const struct path *user_path, int flags,
+struct file *backing_tmpfile_open(const struct file *user_file, int flags,
                                  const struct path *real_parentpath,
                                  umode_t mode, const struct cred *cred);
 ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter,

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8b3dd145b25ec12b00ac1df17a952d9116b88047..d0d0e8f55589e42ab6de814593dbfda43e5d9b70 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2475,6 +2475,19 @@ struct file *dentry_create(struct path *path, int flags, umode_t mode,
                           const struct cred *cred);
 const struct path *backing_file_user_path(const struct file *f);
 
+#ifdef CONFIG_SECURITY
+void *backing_file_security(const struct file *f);
+void backing_file_set_security(struct file *f, void *security);
+#else
+static inline void *backing_file_security(const struct file *f)
+{
+       return NULL;
+}
+static inline void backing_file_set_security(struct file *f, void *security)
+{
+}
+#endif /* CONFIG_SECURITY */
+
 /*
  * When mmapping a file on a stackable filesystem (e.g., overlayfs), the file
  * stored in ->vm_file is a backing file whose f_inode is on the underlying

diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h
index 382c56a97bba1d0e5efe082553338229d541e267..584db296e43b200d2ec95dc5ff8f8bb191932917 100644 (file)
--- a/include/linux/lsm_audit.h
+++ b/include/linux/lsm_audit.h
@@ -94,7 +94,7 @@ struct common_audit_data {
 #endif
                char *kmod_name;
                struct lsm_ioctlop_audit *op;
-               struct file *file;
+               const struct file *file;
                struct lsm_ibpkey_audit *ibpkey;
                struct lsm_ibendport_audit *ibendport;
                int reason;

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 8c42b4bde09c073f6a420c81bc8bc87b2284544d..b4958167e38196b4ab79fa0231e1b43a60d8fb79 100644 (file)
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -191,6 +191,9 @@ LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
 LSM_HOOK(int, 0, file_alloc_security, struct file *file)
 LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file)
 LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file)
+LSM_HOOK(int, 0, backing_file_alloc, struct file *backing_file,
+        const struct file *user_file)
+LSM_HOOK(void, LSM_RET_VOID, backing_file_free, struct file *backing_file)
 LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd,
         unsigned long arg)
 LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd,
@@ -198,6 +201,8 @@ LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd,
 LSM_HOOK(int, 0, mmap_addr, unsigned long addr)
 LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot,
         unsigned long prot, unsigned long flags)
+LSM_HOOK(int, 0, mmap_backing_file, struct vm_area_struct *vma,
+        struct file *backing_file, struct file *user_file)
 LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma,
         unsigned long reqprot, unsigned long prot)
 LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd)

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index d48bf0ad26f4f79350eeac36456f727e3c018be7..b4f8cad53ddb03e453935056274c0e7db9ba22a3 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -104,6 +104,7 @@ struct security_hook_list {
 struct lsm_blob_sizes {
        unsigned int lbs_cred;
        unsigned int lbs_file;
+       unsigned int lbs_backing_file;
        unsigned int lbs_ib;
        unsigned int lbs_inode;
        unsigned int lbs_sock;

diff --git a/include/linux/security.h b/include/linux/security.h
index 83a646d72f6f8facea550c63693a397cca4cd0ef..ad99b35891a6f23be2470e03a4c2496c8659e2cc 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -471,11 +471,17 @@ int security_file_permission(struct file *file, int mask);
 int security_file_alloc(struct file *file);
 void security_file_release(struct file *file);
 void security_file_free(struct file *file);
+int security_backing_file_alloc(struct file *backing_file,
+                               const struct file *user_file);
+void security_backing_file_free(struct file *backing_file);
 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 int security_file_ioctl_compat(struct file *file, unsigned int cmd,
                               unsigned long arg);
 int security_mmap_file(struct file *file, unsigned long prot,
                        unsigned long flags);
+int security_mmap_backing_file(struct vm_area_struct *vma,
+                              struct file *backing_file,
+                              struct file *user_file);
 int security_mmap_addr(unsigned long addr);
 int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
                           unsigned long prot);
@@ -1140,6 +1146,15 @@ static inline void security_file_release(struct file *file)
 static inline void security_file_free(struct file *file)
 { }
 
+static inline int security_backing_file_alloc(struct file *backing_file,
+                                             const struct file *user_file)
+{
+       return 0;
+}
+
+static inline void security_backing_file_free(struct file *backing_file)
+{ }
+
 static inline int security_file_ioctl(struct file *file, unsigned int cmd,
                                      unsigned long arg)
 {
@@ -1159,6 +1174,13 @@ static inline int security_mmap_file(struct file *file, unsigned long prot,
        return 0;
 }
 
+static inline int security_mmap_backing_file(struct vm_area_struct *vma,
+                                            struct file *backing_file,
+                                            struct file *user_file)
+{
+       return 0;
+}
+
 static inline int security_mmap_addr(unsigned long addr)
 {
        return cap_mmap_addr(addr);

diff --git a/security/lsm.h b/security/lsm.h
index db77cc83e1582b38fc8e08807c667cea0c68c146..32f808ad4335a865529c9eb281d416d9fcb43c59 100644 (file)
--- a/security/lsm.h
+++ b/security/lsm.h
@@ -29,6 +29,7 @@ extern struct lsm_blob_sizes blob_sizes;
 
 /* LSM blob caches */
 extern struct kmem_cache *lsm_file_cache;
+extern struct kmem_cache *lsm_backing_file_cache;
 extern struct kmem_cache *lsm_inode_cache;
 
 /* LSM blob allocators */

diff --git a/security/lsm_init.c b/security/lsm_init.c
index 573e2a7250c41618740f96b44f05151d9fab6d31..7c0fd17f1601f29416f603925b43cf4abac5c278 100644 (file)
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -293,6 +293,8 @@ static void __init lsm_prepare(struct lsm_info *lsm)
        blobs = lsm->blobs;
        lsm_blob_size_update(&blobs->lbs_cred, &blob_sizes.lbs_cred);
        lsm_blob_size_update(&blobs->lbs_file, &blob_sizes.lbs_file);
+       lsm_blob_size_update(&blobs->lbs_backing_file,
+                            &blob_sizes.lbs_backing_file);
        lsm_blob_size_update(&blobs->lbs_ib, &blob_sizes.lbs_ib);
        /* inode blob gets an rcu_head in addition to LSM blobs. */
        if (blobs->lbs_inode && blob_sizes.lbs_inode == 0)
@@ -441,6 +443,8 @@ int __init security_init(void)
        if (lsm_debug) {
                lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred);
                lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file);
+               lsm_pr("blob(backing_file) size %d\n",
+                      blob_sizes.lbs_backing_file);
                lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib);
                lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode);
                lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc);
@@ -462,6 +466,11 @@ int __init security_init(void)
                lsm_file_cache = kmem_cache_create("lsm_file_cache",
                                                   blob_sizes.lbs_file, 0,
                                                   SLAB_PANIC, NULL);
+       if (blob_sizes.lbs_backing_file)
+               lsm_backing_file_cache = kmem_cache_create(
+                                                  "lsm_backing_file_cache",
+                                                  blob_sizes.lbs_backing_file,
+                                                  0, SLAB_PANIC, NULL);
        if (blob_sizes.lbs_inode)
                lsm_inode_cache = kmem_cache_create("lsm_inode_cache",
                                                    blob_sizes.lbs_inode, 0,

diff --git a/security/security.c b/security/security.c
index 67af9228c4e9413d62aff17884657427adfaa4b0..680113625451e86be5a78259aa256a15a9274f7a 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -81,6 +81,7 @@ const struct lsm_id *lsm_idlist[MAX_LSM_COUNT];
 struct lsm_blob_sizes blob_sizes;
 
 struct kmem_cache *lsm_file_cache;
+struct kmem_cache *lsm_backing_file_cache;
 struct kmem_cache *lsm_inode_cache;
 
 #define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX
@@ -172,6 +173,30 @@ static int lsm_file_alloc(struct file *file)
        return 0;
 }
 
+/**
+ * lsm_backing_file_alloc - allocate a composite backing file blob
+ * @backing_file: the backing file
+ *
+ * Allocate the backing file blob for all the modules.
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_backing_file_alloc(struct file *backing_file)
+{
+       void *blob;
+
+       if (!lsm_backing_file_cache) {
+               backing_file_set_security(backing_file, NULL);
+               return 0;
+       }
+
+       blob = kmem_cache_zalloc(lsm_backing_file_cache, GFP_KERNEL);
+       backing_file_set_security(backing_file, blob);
+       if (!blob)
+               return -ENOMEM;
+       return 0;
+}
+
 /**
  * lsm_blob_alloc - allocate a composite blob
  * @dest: the destination for the blob
@@ -2417,6 +2442,57 @@ void security_file_free(struct file *file)
        }
 }
 
+/**
+ * security_backing_file_alloc() - Allocate and setup a backing file blob
+ * @backing_file: the backing file
+ * @user_file: the associated user visible file
+ *
+ * Allocate a backing file LSM blob and perform any necessary initialization of
+ * the LSM blob.  There will be some operations where the LSM will not have
+ * access to @user_file after this point, so any important state associated
+ * with @user_file that is important to the LSM should be captured in the
+ * backing file's LSM blob.
+ *
+ * LSM's should avoid taking a reference to @user_file in this hook as it will
+ * result in problems later when the system attempts to drop/put the file
+ * references due to a circular dependency.
+ *
+ * Return: Return 0 if the hook is successful, negative values otherwise.
+ */
+int security_backing_file_alloc(struct file *backing_file,
+                               const struct file *user_file)
+{
+       int rc;
+
+       rc = lsm_backing_file_alloc(backing_file);
+       if (rc)
+               return rc;
+       rc = call_int_hook(backing_file_alloc, backing_file, user_file);
+       if (unlikely(rc))
+               security_backing_file_free(backing_file);
+
+       return rc;
+}
+
+/**
+ * security_backing_file_free() - Free a backing file blob
+ * @backing_file: the backing file
+ *
+ * Free any LSM state associate with a backing file's LSM blob, including the
+ * blob itself.
+ */
+void security_backing_file_free(struct file *backing_file)
+{
+       void *blob = backing_file_security(backing_file);
+
+       call_void_hook(backing_file_free, backing_file);
+
+       if (blob) {
+               backing_file_set_security(backing_file, NULL);
+               kmem_cache_free(lsm_backing_file_cache, blob);
+       }
+}
+
 /**
  * security_file_ioctl() - Check if an ioctl is allowed
  * @file: associated file
@@ -2505,6 +2581,32 @@ int security_mmap_file(struct file *file, unsigned long prot,
                             flags);
 }
 
+/**
+ * security_mmap_backing_file - Check if mmap'ing a backing file is allowed
+ * @vma: the vm_area_struct for the mmap'd region
+ * @backing_file: the backing file being mmap'd
+ * @user_file: the user file being mmap'd
+ *
+ * Check permissions for a mmap operation on a stacked filesystem.  This hook
+ * is called after the security_mmap_file() and is responsible for authorizing
+ * the mmap on @backing_file.  It is important to note that the mmap operation
+ * on @user_file has already been authorized and the @vma->vm_file has been
+ * set to @backing_file.
+ *
+ * Return: Returns 0 if permission is granted.
+ */
+int security_mmap_backing_file(struct vm_area_struct *vma,
+                              struct file *backing_file,
+                              struct file *user_file)
+{
+       /* recommended by the stackable filesystem devs */
+       if (WARN_ON_ONCE(!(backing_file->f_mode & FMODE_BACKING)))
+               return -EIO;
+
+       return call_int_hook(mmap_backing_file, vma, backing_file, user_file);
+}
+EXPORT_SYMBOL_GPL(security_mmap_backing_file);
+
 /**
  * security_mmap_addr() - Check if mmap'ing an address is allowed
  * @addr: address