lkml.org 
[lkml]   [2023]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 19/28] security: Introduce inode_post_create_tmpfile hook
    Date
    From: Roberto Sassu <roberto.sassu@huawei.com>

    In preparation for moving IMA and EVM to the LSM infrastructure, introduce
    the inode_post_create_tmpfile hook.

    Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    ---
    fs/namei.c | 1 +
    include/linux/lsm_hook_defs.h | 2 ++
    include/linux/security.h | 8 ++++++++
    security/security.c | 18 ++++++++++++++++++
    4 files changed, 29 insertions(+)

    diff --git a/fs/namei.c b/fs/namei.c
    index 3f2747521d3..8c4fdfd81d4 100644
    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -3624,6 +3624,7 @@ static int vfs_tmpfile(struct mnt_idmap *idmap,
    inode->i_state |= I_LINKABLE;
    spin_unlock(&inode->i_lock);
    }
    + security_inode_post_create_tmpfile(idmap, dir, file_dentry(file), mode);
    ima_post_create_tmpfile(idmap, dir, file_dentry(file), mode);
    return 0;
    }
    diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
    index 32c801a3ea2..5dc2a7c3d9a 100644
    --- a/include/linux/lsm_hook_defs.h
    +++ b/include/linux/lsm_hook_defs.h
    @@ -120,6 +120,8 @@ LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
    const struct qstr *name, const struct inode *context_inode)
    LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
    umode_t mode)
    +LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
    + struct inode *dir, struct dentry *dentry, umode_t mode)
    LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
    struct dentry *new_dentry)
    LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
    diff --git a/include/linux/security.h b/include/linux/security.h
    index fb6e9d434c6..b3e201404dc 100644
    --- a/include/linux/security.h
    +++ b/include/linux/security.h
    @@ -337,6 +337,9 @@ int security_inode_init_security_anon(struct inode *inode,
    const struct qstr *name,
    const struct inode *context_inode);
    int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
    +void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
    + struct inode *dir,
    + struct dentry *dentry, umode_t mode);
    int security_inode_link(struct dentry *old_dentry, struct inode *dir,
    struct dentry *new_dentry);
    int security_inode_unlink(struct inode *dir, struct dentry *dentry);
    @@ -787,6 +790,11 @@ static inline int security_inode_create(struct inode *dir,
    return 0;
    }

    +static inline void
    +security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
    + struct dentry *dentry, umode_t mode)
    +{ }
    +
    static inline int security_inode_link(struct dentry *old_dentry,
    struct inode *dir,
    struct dentry *new_dentry)
    diff --git a/security/security.c b/security/security.c
    index f5f367e2064..8883082b686 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -1971,6 +1971,24 @@ int security_inode_create(struct inode *dir, struct dentry *dentry,
    }
    EXPORT_SYMBOL_GPL(security_inode_create);

    +/**
    + * security_inode_post_create_tmpfile() - Update inode sec after tmpfile created
    + * @idmap: idmap of the mount
    + * @dir: the inode of the base directory
    + * @dentry: the dentry of the new tmpfile
    + * @mode: the mode of the new tmpfile
    + *
    + * Update inode security field after a tmpfile has been created.
    + */
    +void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
    + struct inode *dir,
    + struct dentry *dentry, umode_t mode)
    +{
    + if (unlikely(IS_PRIVATE(dir)))
    + return;
    + call_void_hook(inode_post_create_tmpfile, idmap, dir, dentry, mode);
    +}
    +
    /**
    * security_inode_link() - Check if creating a hard link is allowed
    * @old_dentry: existing file
    --
    2.25.1
    \
     
     \ /
      Last update: 2023-03-27 00:43    [W:4.135 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site