Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@xxxxxxxxxx> --- security/security.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/security/security.c b/security/security.c index 0d210da9862c..f515d8430318 100644 --- a/security/security.c +++ b/security/security.c @@ -2365,9 +2365,14 @@ int security_inode_remove_acl(struct mnt_idmap *idmap, int security_inode_set_fscaps(struct mnt_idmap *idmap, struct dentry *dentry, const struct vfs_caps *caps, int flags) { + int ret; + if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) return 0; - return call_int_hook(inode_set_fscaps, 0, idmap, dentry, caps, flags); + ret = call_int_hook(inode_set_fscaps, 0, idmap, dentry, caps, flags); + if (ret) + return ret; + return evm_inode_set_fscaps(idmap, dentry, caps, flags); } /** @@ -2387,6 +2392,7 @@ void security_inode_post_set_fscaps(struct mnt_idmap *idmap, if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) return; call_void_hook(inode_post_set_fscaps, idmap, dentry, caps, flags); + evm_inode_post_set_fscaps(idmap, dentry, caps, flags); } /** @@ -2415,9 +2421,14 @@ int security_inode_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry) */ int security_inode_remove_fscaps(struct mnt_idmap *idmap, struct dentry *dentry) { + int ret; + if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) return 0; - return call_int_hook(inode_remove_fscaps, 0, idmap, dentry); + ret = call_int_hook(inode_remove_fscaps, 0, idmap, dentry); + if (ret) + return ret; + return evm_inode_remove_fscaps(dentry); } /** -- 2.43.0