selinuxfs: don't stash the dentry of /policy_capabilities

Don't bother to store the dentry of /policy_capabilities - it belongs
to invariant part of tree and we only use it to populate that directory,
so there's no reason to keep it around afterwards.

Same situation as with /avc, /ss, etc.  There are two directories that
get replaced on policy load - /class and /booleans.  These we need to
stash (and update the pointers on policy reload); /policy_capabilities
is not in the same boat.

Acked-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 232e087bce3eeafe9f3ee03999bf6ca9e74f973d..b39e919c27b1caee734ad8d075960e226c79afd7 100644 (file)
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -75,7 +75,6 @@ struct selinux_fs_info {
        struct dentry *class_dir;
        unsigned long last_class_ino;
        bool policy_opened;
-       struct dentry *policycap_dir;
        unsigned long last_ino;
        struct super_block *sb;
 };
@@ -117,7 +116,6 @@ static void selinux_fs_info_free(struct super_block *sb)
 
 #define BOOL_DIR_NAME "booleans"
 #define CLASS_DIR_NAME "class"
-#define POLICYCAP_DIR_NAME "policy_capabilities"
 
 #define TMPBUFLEN      12
 static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
@@ -1871,23 +1869,24 @@ out:
        return rc;
 }
 
-static int sel_make_policycap(struct selinux_fs_info *fsi)
+static int sel_make_policycap(struct dentry *dir)
 {
+       struct super_block *sb = dir->d_sb;
        unsigned int iter;
        struct dentry *dentry = NULL;
        struct inode *inode = NULL;
 
        for (iter = 0; iter <= POLICYDB_CAP_MAX; iter++) {
                if (iter < ARRAY_SIZE(selinux_policycap_names))
-                       dentry = d_alloc_name(fsi->policycap_dir,
+                       dentry = d_alloc_name(dir,
                                              selinux_policycap_names[iter]);
                else
-                       dentry = d_alloc_name(fsi->policycap_dir, "unknown");
+                       dentry = d_alloc_name(dir, "unknown");
 
                if (dentry == NULL)
                        return -ENOMEM;
 
-               inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
+               inode = sel_make_inode(sb, S_IFREG | 0444);
                if (inode == NULL) {
                        dput(dentry);
                        return -ENOMEM;
@@ -2071,15 +2070,13 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
                goto err;
        }
 
-       fsi->policycap_dir = sel_make_dir(sb->s_root, POLICYCAP_DIR_NAME,
-                                         &fsi->last_ino);
-       if (IS_ERR(fsi->policycap_dir)) {
-               ret = PTR_ERR(fsi->policycap_dir);
-               fsi->policycap_dir = NULL;
+       dentry = sel_make_dir(sb->s_root, "policy_capabilities", &fsi->last_ino);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto err;
        }
 
-       ret = sel_make_policycap(fsi);
+       ret = sel_make_policycap(dentry);
        if (ret) {
                pr_err("SELinux: failed to load policy capabilities\n");
                goto err;