GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-30 19:06:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

eCryptfs: Copy lower inode attrs before dentry instantiation

Browse source 
Copies the lower inode attributes to the upper inode before passing the
upper inode to d_instantiate().  This is important for
security_d_instantiate().

The problem was discovered by a user seeing SELinux denials like so:

type=AVC msg=audit(1236812817.898:47): avc:  denied  { 0x100000 } for
pid=3584 comm="httpd" name="testdir" dev=ecryptfs ino=943872
scontext=root:system_r:httpd_t:s0
tcontext=root:object_r:httpd_sys_content_t:s0 tclass=file

Notice target class is file while testdir is really a directory,
confusing the permission translation (0x100000) due to the wrong i_mode.

Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
This commit is contained in:
Tyler Hicks 2009-03-12 00:19:46 -05:00
parent 0910697403
commit ae6e84596e
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
fs/ecryptfs/main.c
View file

@ -190,14 +190,14 @@ int ecryptfs_interpose(struct dentry *lower_dentry, struct dentry *dentry,
init_special_inode(inode, lower_inode->i_mode, init_special_inode(inode, lower_inode->i_mode,
lower_inode->i_rdev); lower_inode->i_rdev);
dentry->d_op = &ecryptfs_dops; dentry->d_op = &ecryptfs_dops;
if (flags & ECRYPTFS_INTERPOSE_FLAG_D_ADD)
d_add(dentry, inode);
else
d_instantiate(dentry, inode);
fsstack_copy_attr_all(inode, lower_inode, NULL); fsstack_copy_attr_all(inode, lower_inode, NULL);
/* This size will be overwritten for real files w/ headers and /* This size will be overwritten for real files w/ headers and
* other metadata */ * other metadata */
fsstack_copy_inode_size(inode, lower_inode); fsstack_copy_inode_size(inode, lower_inode);
if (flags & ECRYPTFS_INTERPOSE_FLAG_D_ADD)
d_add(dentry, inode);
else
d_instantiate(dentry, inode);
out: out:
return rc; return rc;
} }