The patch titled
SELinux: eliminate inode_security_set_security
has been added to the -mm tree. Its filename is
selinux-1-3-eliminate-inode_security_set_security.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: SELinux: eliminate inode_security_set_security
From: Eric Paris <eparis@xxxxxxxxxx>
inode_security_set_sid is only called by security_inode_init_security, which
is called when a new file is being created and needs to have its incore
security state initialized and its security xattr set. This helper used to be
called in other places in the past, but now only has the one. So this patch
rolls inode_security_set_sid directly back into security_inode_init_security.
There also is no need to hold the isec->sem while doing this, as the inode is
not available to other threads at this point in time.
Signed-off-by: Eric Paris <eparis@xxxxxxxxxx>
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
Acked-by: James Morris <jmorris@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
security/selinux/hooks.c | 27 +++++++--------------------
1 files changed, 7 insertions(+), 20 deletions(-)
diff -puN security/selinux/hooks.c~selinux-1-3-eliminate-inode_security_set_security security/selinux/hooks.c
--- a/security/selinux/hooks.c~selinux-1-3-eliminate-inode_security_set_security
+++ a/security/selinux/hooks.c
@@ -1364,25 +1364,6 @@ static inline u32 file_to_av(struct file
return av;
}
-/* Set an inode's SID to a specified value. */
-static int inode_security_set_sid(struct inode *inode, u32 sid)
-{
- struct inode_security_struct *isec = inode->i_security;
- struct superblock_security_struct *sbsec = inode->i_sb->s_security;
-
- if (!sbsec->initialized) {
- /* Defer initialization to selinux_complete_init. */
- return 0;
- }
-
- down(&isec->sem);
- isec->sclass = inode_mode_to_security_class(inode->i_mode);
- isec->sid = sid;
- isec->initialized = 1;
- up(&isec->sem);
- return 0;
-}
-
/* Hook functions begin here. */
static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
@@ -2091,7 +2072,13 @@ static int selinux_inode_init_security(s
}
}
- inode_security_set_sid(inode, newsid);
+ /* Possibly defer initialization to selinux_complete_init. */
+ if (sbsec->initialized) {
+ struct inode_security_struct *isec = inode->i_security;
+ isec->sclass = inode_mode_to_security_class(inode->i_mode);
+ isec->sid = newsid;
+ isec->initialized = 1;
+ }
if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
return -EOPNOTSUPP;
_
Patches currently in -mm which might be from eparis@xxxxxxxxxx are
selinux-enable-configuration-of-max-policy-version.patch
selinux-add-support-for-range-transitions-on-object.patch
selinux-1-3-eliminate-inode_security_set_security.patch
selinux-2-3-change-isec-semaphore-to-a-mutex.patch
selinux-3-3-convert-sbsec-semaphore-to-a-mutex.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
