On Thu 07-12-23 14:38:25, Amir Goldstein wrote:
> In preparation for pre-content permission events with file access range,
> move fsnotify_file_perm() hook out of security_file_permission() and into
> the callers that have the access range information and pass the access
> range to fsnotify_file_perm().
>
> Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
So why don't you pass the range into security_file_permission() instead of
pulling fsnotify out of the hook? I mean conceptually the accessed range
makes sense for the hook as well although no LSM currently cares about it.
Also it would address the Christian's concern.
> diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
> index 0a9d6a8a747a..45e6ecbca057 100644
> --- a/include/linux/fsnotify.h
> +++ b/include/linux/fsnotify.h
> @@ -103,7 +103,8 @@ static inline int fsnotify_file(struct file *file, __u32 mask)
> /*
> * fsnotify_file_perm - permission hook before file access
> */
> -static inline int fsnotify_file_perm(struct file *file, int perm_mask)
> +static inline int fsnotify_file_perm(struct file *file, int perm_mask,
> + const loff_t *ppos, size_t count)
> {
> __u32 fsnotify_mask = FS_ACCESS_PERM;
Also why do you actually pass in loff_t * instead of plain loff_t? You
don't plan to change it, do you?
Honza
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
