On Mon, Nov 28, 2022 at 9:43 AM Roberto Sassu <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> > > include/linux/lsm_hooks.h reports the result of the LSM infrastructure to > the callers, not what LSMs should return to the LSM infrastructure. > > Clarify that and add that if all LSMs return a positive value > __vm_enough_memory() will be called with cap_sys_admin set. If at least one > LSM returns 0 or negative, it will be called with cap_sys_admin cleared. > > Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> > --- > include/linux/lsm_hooks.h | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) Thanks Roberto. Normally I don't like merging patches this close to the merge window, but as this is a comment-only fix that makes an important clarification I'm going to make an exception here and merge it into lsm/next. > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > index 2831efebde69..c35e260efd8c 100644 > --- a/include/linux/lsm_hooks.h > +++ b/include/linux/lsm_hooks.h > @@ -1398,7 +1398,11 @@ > * Check permissions for allocating a new virtual mapping. > * @mm contains the mm struct it is being added to. > * @pages contains the number of pages. > - * Return 0 if permission is granted. > + * Return 0 if permission is granted by the LSM infrastructure to the > + * caller. If all LSMs return a positive value, __vm_enough_memory() will > + * be called with cap_sys_admin set. If at least one LSM returns 0 or > + * negative, __vm_enough_memory() will be called with cap_sys_admin > + * cleared. > * > * @ismaclabel: > * Check if the extended attribute specified by @name > -- > 2.25.1 -- paul-moore.com
