From: Miklos Szeredi <mszeredi@xxxxxxx>
Only pass nameidata->flags instead of the nameidata to
security_inode_permission(), synchronizing it with i_op->permission().
Currently no security module uses the nameidata parameter.
The other change in ->permission() is that a dentry is passed instead
of an inode. Leave this till AppArmor integration, since that will
need a struct path instead of an inode.
Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxx>
CC: James Morris <jmorris@xxxxxxxxx>
CC: Stephen Smalley <sds@xxxxxxxxxxxxx>
CC: Eric Paris <eparis@xxxxxxxxxx>
CC: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
---
fs/namei.c | 4 ++--
include/linux/security.h | 8 ++++----
security/dummy.c | 2 +-
security/security.c | 4 ++--
security/selinux/hooks.c | 5 ++---
security/smack/smack_lsm.c | 5 ++---
6 files changed, 13 insertions(+), 15 deletions(-)
Index: linux-2.6/fs/namei.c
===================================================================
--- linux-2.6.orig/fs/namei.c 2008-05-21 13:41:30.000000000 +0200
+++ linux-2.6/fs/namei.c 2008-05-21 13:41:33.000000000 +0200
@@ -288,7 +288,7 @@ int dentry_permission(struct dentry *den
if (retval)
return retval;
- return security_inode_permission(inode, mask, nd);
+ return security_inode_permission(inode, mask, nd ? nd->flags : 0);
}
/**
@@ -488,7 +488,7 @@ static int exec_permission_lite(struct i
return -EACCES;
ok:
- return security_inode_permission(inode, MAY_EXEC, nd);
+ return security_inode_permission(inode, MAY_EXEC, nd->flags);
}
/*
Index: linux-2.6/include/linux/security.h
===================================================================
--- linux-2.6.orig/include/linux/security.h 2008-05-21 13:13:29.000000000 +0200
+++ linux-2.6/include/linux/security.h 2008-05-21 13:41:33.000000000 +0200
@@ -407,7 +407,7 @@ static inline void security_free_mnt_opt
* called when the actual read/write operations are performed.
* @inode contains the inode structure to check.
* @mask contains the permission mask.
- * @nd contains the nameidata (may be NULL).
+ * @flags contains the lookup flags
* Return 0 if permission is granted.
* @inode_setattr:
* Check permission before setting file attributes. Note that the kernel
@@ -1370,7 +1370,7 @@ struct security_operations {
struct inode *new_dir, struct dentry *new_dentry);
int (*inode_readlink) (struct dentry *dentry);
int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
- int (*inode_permission) (struct inode *inode, int mask, struct nameidata *nd);
+ int (*inode_permission) (struct inode *inode, int mask, int flags);
int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
void (*inode_delete) (struct inode *inode);
@@ -1641,7 +1641,7 @@ int security_inode_rename(struct inode *
struct inode *new_dir, struct dentry *new_dentry);
int security_inode_readlink(struct dentry *dentry);
int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd);
-int security_inode_permission(struct inode *inode, int mask, struct nameidata *nd);
+int security_inode_permission(struct inode *inode, int mask, int flags);
int security_inode_setattr(struct dentry *dentry, struct iattr *attr);
int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry);
void security_inode_delete(struct inode *inode);
@@ -2033,7 +2033,7 @@ static inline int security_inode_follow_
}
static inline int security_inode_permission(struct inode *inode, int mask,
- struct nameidata *nd)
+ int flags)
{
return 0;
}
Index: linux-2.6/security/dummy.c
===================================================================
--- linux-2.6.orig/security/dummy.c 2008-05-21 13:13:29.000000000 +0200
+++ linux-2.6/security/dummy.c 2008-05-21 13:41:33.000000000 +0200
@@ -345,7 +345,7 @@ static int dummy_inode_follow_link (stru
return 0;
}
-static int dummy_inode_permission (struct inode *inode, int mask, struct nameidata *nd)
+static int dummy_inode_permission (struct inode *inode, int mask, int flags)
{
return 0;
}
Index: linux-2.6/security/security.c
===================================================================
--- linux-2.6.orig/security/security.c 2008-05-21 13:13:29.000000000 +0200
+++ linux-2.6/security/security.c 2008-05-21 13:41:33.000000000 +0200
@@ -463,11 +463,11 @@ int security_inode_follow_link(struct de
return security_ops->inode_follow_link(dentry, nd);
}
-int security_inode_permission(struct inode *inode, int mask, struct nameidata *nd)
+int security_inode_permission(struct inode *inode, int mask, int flags)
{
if (unlikely(IS_PRIVATE(inode)))
return 0;
- return security_ops->inode_permission(inode, mask, nd);
+ return security_ops->inode_permission(inode, mask, flags);
}
int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
Index: linux-2.6/security/selinux/hooks.c
===================================================================
--- linux-2.6.orig/security/selinux/hooks.c 2008-05-21 13:13:29.000000000 +0200
+++ linux-2.6/security/selinux/hooks.c 2008-05-21 13:41:33.000000000 +0200
@@ -2579,12 +2579,11 @@ static int selinux_inode_follow_link(str
return dentry_has_perm(current, NULL, dentry, FILE__READ);
}
-static int selinux_inode_permission(struct inode *inode, int mask,
- struct nameidata *nd)
+static int selinux_inode_permission(struct inode *inode, int mask, int flags)
{
int rc;
- rc = secondary_ops->inode_permission(inode, mask, nd);
+ rc = secondary_ops->inode_permission(inode, mask, flags);
if (rc)
return rc;
Index: linux-2.6/security/smack/smack_lsm.c
===================================================================
--- linux-2.6.orig/security/smack/smack_lsm.c 2008-05-21 13:13:29.000000000 +0200
+++ linux-2.6/security/smack/smack_lsm.c 2008-05-21 13:41:33.000000000 +0200
@@ -515,14 +515,13 @@ static int smack_inode_rename(struct ino
* smack_inode_permission - Smack version of permission()
* @inode: the inode in question
* @mask: the access requested
- * @nd: unused
+ * @flags: unused
*
* This is the important Smack hook.
*
* Returns 0 if access is permitted, -EACCES otherwise
*/
-static int smack_inode_permission(struct inode *inode, int mask,
- struct nameidata *nd)
+static int smack_inode_permission(struct inode *inode, int mask, int flags)
{
/*
* No permission to check. Existence test. Yup, it's there.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
