| Date | Mon, 6 Mar 2023 14:24:51 -0500 | Subject | Re: [PATCH 16/28] security: Introduce file_post_open hook | From | Stefan Berger <> |
| |
On 3/3/23 13:18, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > In preparation to move IMA and EVM to the LSM infrastructure, introduce the > file_post_open hook. Also, export security_file_post_open() for NFS. > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > +/** > + * security_file_post_open() - Recheck access to a file after it has been opened > + * @file: the file > + * @mask: access mask > + * > + * Recheck access with mask after the file has been opened. The hook is useful > + * for LSMs that require the file content to be available in order to make > + * decisions. > + * > + * Return: Returns 0 if permission is granted. > + */ > +int security_file_post_open(struct file *file, int mask) > +{
Files with private inodes don't seem to checked for in any existing functions, either, so no check. Good..
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> + return call_int_hook(file_post_open, 0, file, mask); > +} > +EXPORT_SYMBOL_GPL(security_file_post_open); > + > /** > * security_file_truncate() - Check if truncating a file is allowed > * @file: file
|