SECURITY: Move exec_permission RCU checks into security modules
Right now all RCU walks fall back to reference walk when CONFIG_SECURITY is enabled, even though just the standard capability module is active. This is because security_inode_exec_permission unconditionally fails RCU walks. Move this decision to the low level security module. This requires passing the RCU flags down the security hook. This way at least the capability module and a few easy cases in selinux/smack work with RCU walks with CONFIG_SECURITY=y Signed-off-by: Andi Kleen <ak@linux.intel.com> Acked-by: Eric Paris <eparis@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
8d082f8f3f
commit
8c9e80ed27
|
@ -1456,7 +1456,7 @@ struct security_operations {
|
||||||
struct inode *new_dir, struct dentry *new_dentry);
|
struct inode *new_dir, struct dentry *new_dentry);
|
||||||
int (*inode_readlink) (struct dentry *dentry);
|
int (*inode_readlink) (struct dentry *dentry);
|
||||||
int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
|
int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
|
||||||
int (*inode_permission) (struct inode *inode, int mask);
|
int (*inode_permission) (struct inode *inode, int mask, unsigned flags);
|
||||||
int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
|
int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
|
||||||
int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
|
int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
|
||||||
int (*inode_setxattr) (struct dentry *dentry, const char *name,
|
int (*inode_setxattr) (struct dentry *dentry, const char *name,
|
||||||
|
|
|
@ -181,7 +181,7 @@ static int cap_inode_follow_link(struct dentry *dentry,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int cap_inode_permission(struct inode *inode, int mask)
|
static int cap_inode_permission(struct inode *inode, int mask, unsigned flags)
|
||||||
{
|
{
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -518,16 +518,14 @@ int security_inode_permission(struct inode *inode, int mask)
|
||||||
{
|
{
|
||||||
if (unlikely(IS_PRIVATE(inode)))
|
if (unlikely(IS_PRIVATE(inode)))
|
||||||
return 0;
|
return 0;
|
||||||
return security_ops->inode_permission(inode, mask);
|
return security_ops->inode_permission(inode, mask, 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
int security_inode_exec_permission(struct inode *inode, unsigned int flags)
|
int security_inode_exec_permission(struct inode *inode, unsigned int flags)
|
||||||
{
|
{
|
||||||
if (unlikely(IS_PRIVATE(inode)))
|
if (unlikely(IS_PRIVATE(inode)))
|
||||||
return 0;
|
return 0;
|
||||||
if (flags)
|
return security_ops->inode_permission(inode, MAY_EXEC, flags);
|
||||||
return -ECHILD;
|
|
||||||
return security_ops->inode_permission(inode, MAY_EXEC);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
|
int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
|
||||||
|
|
|
@ -2635,7 +2635,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
|
||||||
return dentry_has_perm(cred, NULL, dentry, FILE__READ);
|
return dentry_has_perm(cred, NULL, dentry, FILE__READ);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int selinux_inode_permission(struct inode *inode, int mask)
|
static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
|
||||||
{
|
{
|
||||||
const struct cred *cred = current_cred();
|
const struct cred *cred = current_cred();
|
||||||
struct common_audit_data ad;
|
struct common_audit_data ad;
|
||||||
|
@ -2649,6 +2649,10 @@ static int selinux_inode_permission(struct inode *inode, int mask)
|
||||||
if (!mask)
|
if (!mask)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
/* May be droppable after audit */
|
||||||
|
if (flags & IPERM_FLAG_RCU)
|
||||||
|
return -ECHILD;
|
||||||
|
|
||||||
COMMON_AUDIT_DATA_INIT(&ad, FS);
|
COMMON_AUDIT_DATA_INIT(&ad, FS);
|
||||||
ad.u.fs.inode = inode;
|
ad.u.fs.inode = inode;
|
||||||
|
|
||||||
|
|
|
@ -686,7 +686,7 @@ static int smack_inode_rename(struct inode *old_inode,
|
||||||
*
|
*
|
||||||
* Returns 0 if access is permitted, -EACCES otherwise
|
* Returns 0 if access is permitted, -EACCES otherwise
|
||||||
*/
|
*/
|
||||||
static int smack_inode_permission(struct inode *inode, int mask)
|
static int smack_inode_permission(struct inode *inode, int mask, unsigned flags)
|
||||||
{
|
{
|
||||||
struct smk_audit_info ad;
|
struct smk_audit_info ad;
|
||||||
|
|
||||||
|
@ -696,6 +696,10 @@ static int smack_inode_permission(struct inode *inode, int mask)
|
||||||
*/
|
*/
|
||||||
if (mask == 0)
|
if (mask == 0)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
/* May be droppable after audit */
|
||||||
|
if (flags & IPERM_FLAG_RCU)
|
||||||
|
return -ECHILD;
|
||||||
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
|
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
|
||||||
smk_ad_setfield_u_fs_inode(&ad, inode);
|
smk_ad_setfield_u_fs_inode(&ad, inode);
|
||||||
return smk_curacc(smk_of_inode(inode), mask, &ad);
|
return smk_curacc(smk_of_inode(inode), mask, &ad);
|
||||||
|
|
Loading…
Reference in a new issue