redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Merge branch 'smack-for-4.21-a' of https://github.com/cschaufler/next-smack into next-smack 

From Casey.

"I have two Smack patches for 4.21. One Jose's patch adds
missing documentation and Zoran's fleshes out the access checks
on keyrings."
hifive-unleashed-5.1
James Morris 2018-12-13 19:30:33 -08:00
parent 1072bd6785 55b078f031
commit 20bb4cb4fb
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/admin-guide/LSM/Smack.rst
View File

@ -818,6 +818,10 @@ Smack supports some mount options:
specifies a label to which all labels set on the
filesystem must have read access. Not yet enforced.
smackfstransmute=label:
behaves exactly like smackfsroot except that it also
sets the transmute flag on the root of the mount
These mount options apply to all file system types.
Smack auditing

12
security/smack/smack_lsm.c
View File

@ -4333,6 +4333,12 @@ static int smack_key_permission(key_ref_t key_ref,
int request = 0;
int rc;
/*
* Validate requested permissions
*/
if (perm & ~KEY_NEED_ALL)
return -EINVAL;
keyp = key_ref_to_ptr(key_ref);
if (keyp == NULL)
return -EINVAL;
@ -4356,10 +4362,10 @@ static int smack_key_permission(key_ref_t key_ref,
ad.a.u.key_struct.key = keyp->serial;
ad.a.u.key_struct.key_desc = keyp->description;
#endif
if (perm & KEY_NEED_READ)
request = MAY_READ;
if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
request |= MAY_READ;
if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
request = MAY_WRITE;
request |= MAY_WRITE;
rc = smk_access(tkp, keyp->security, request, &ad);
rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
return rc;