smack: fix bug: SMACK64TRANSMUTE set on non-directory

[ Upstream commit 195da3ff244deff119c3f5244b464b2236ea1725 ]

When a new file system object is created
and the conditions for label transmutation are met,
the SMACK64TRANSMUTE extended attribute is set
on the object regardless of its type:
file, pipe, socket, symlink, or directory.

However,
SMACK64TRANSMUTE may only be set on directories.

This bug is a combined effect of the commits [1] and [2]
which both transfer functionality
from smack_d_instantiate() to smack_inode_init_security(),
but only in part.

Commit [1] set blank  SMACK64TRANSMUTE on improper object types.
Commit [2] set "TRUE" SMACK64TRANSMUTE on improper object types.

[1] 2023-06-10,
Fixes: baed456a6a2f ("smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20230610075738.3273764-3-roberto.sassu@huaweicloud.com/
[2] 2023-11-16,
Fixes: e63d86b8b764 ("smack: Initialize the in-memory inode in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20231116090125.187209-5-roberto.sassu@huaweicloud.com/
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index af986587841d8c3608ba3e0ace1dbad02d8928b5..39a4caeb6bc8ed1ce6189f8709748e90df62d01a 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1015,18 +1015,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
                if (tsp->smk_task != tsp->smk_transmuted)
                        isp = issp->smk_inode = dsp;
 
-               issp->smk_flags |= SMK_INODE_TRANSMUTE;
-               xattr_transmute = lsm_get_xattr_slot(xattrs,
-                                                    xattr_count);
-               if (xattr_transmute) {
-                       xattr_transmute->value = kmemdup(TRANS_TRUE,
-                                                        TRANS_TRUE_SIZE,
-                                                        GFP_NOFS);
-                       if (!xattr_transmute->value)
-                               return -ENOMEM;
-
-                       xattr_transmute->value_len = TRANS_TRUE_SIZE;
-                       xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+               if (S_ISDIR(inode->i_mode)) {
+                       issp->smk_flags |= SMK_INODE_TRANSMUTE;
+                       xattr_transmute = lsm_get_xattr_slot(xattrs,
+                                                            xattr_count);
+                       if (xattr_transmute) {
+                               xattr_transmute->value = kmemdup(TRANS_TRUE,
+                                                                TRANS_TRUE_SIZE,
+                                                                GFP_NOFS);
+                               if (!xattr_transmute->value)
+                                       return -ENOMEM;
+
+                               xattr_transmute->value_len = TRANS_TRUE_SIZE;
+                               xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+                       }
                }
        }