From: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
In preparation for moving IMA and EVM to the LSM infrastructure, introduce
the path_post_mknod hook.
Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
---
fs/namei.c | 2 ++
include/linux/lsm_hook_defs.h | 3 +++
include/linux/security.h | 9 +++++++++
security/security.c | 19 +++++++++++++++++++
4 files changed, 33 insertions(+)
diff --git a/fs/namei.c b/fs/namei.c
index 41f7fdf4657..3f2747521d3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3980,6 +3980,8 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode,
dentry, mode, 0);
break;
}
+ if (!error)
+ security_path_post_mknod(idmap, &path, dentry, mode, dev);
out2:
done_path_create(&path, dentry);
if (retry_estale(error, lookup_flags)) {
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 4580912051a..32c801a3ea2 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -93,6 +93,9 @@ LSM_HOOK(int, 0, path_mkdir, const struct path *dir, struct dentry *dentry,
LSM_HOOK(int, 0, path_rmdir, const struct path *dir, struct dentry *dentry)
LSM_HOOK(int, 0, path_mknod, const struct path *dir, struct dentry *dentry,
umode_t mode, unsigned int dev)
+LSM_HOOK(void, LSM_RET_VOID, path_post_mknod, struct mnt_idmap *idmap,
+ const struct path *dir, struct dentry *dentry, umode_t mode,
+ unsigned int dev)
LSM_HOOK(int, 0, path_truncate, const struct path *path)
LSM_HOOK(int, 0, path_symlink, const struct path *dir, struct dentry *dentry,
const char *old_name)
diff --git a/include/linux/security.h b/include/linux/security.h
index 88e88280f7d..fb6e9d434c6 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1835,6 +1835,9 @@ int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t m
int security_path_rmdir(const struct path *dir, struct dentry *dentry);
int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
unsigned int dev);
+void security_path_post_mknod(struct mnt_idmap *idmap, const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev);
int security_path_truncate(const struct path *path);
int security_path_symlink(const struct path *dir, struct dentry *dentry,
const char *old_name);
@@ -1869,6 +1872,12 @@ static inline int security_path_mknod(const struct path *dir, struct dentry *den
return 0;
}
+static inline void security_path_post_mknod(struct mnt_idmap *idmap,
+ const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev)
+{ }
+
static inline int security_path_truncate(const struct path *path)
{
return 0;
diff --git a/security/security.c b/security/security.c
index 6cbbb4289f7..f5f367e2064 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1753,6 +1753,25 @@ int security_path_mknod(const struct path *dir, struct dentry *dentry,
}
EXPORT_SYMBOL(security_path_mknod);
+/**
+ * security_path_post_mknod() - Update inode security field after file creation
+ * @idmap: idmap of the mount
+ * @dir: parent directory
+ * @dentry: new file
+ * @mode: new file mode
+ * @dev: device number
+ *
+ * Update inode security field after a file has been created.
+ */
+void security_path_post_mknod(struct mnt_idmap *idmap, const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev)
+{
+ if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
+ return;
+ call_void_hook(path_post_mknod, idmap, dir, dentry, mode, dev);
+}
+
/**
* security_path_mkdir() - Check if creating a new directory is allowed
* @dir: parent directory
--
2.25.1
