mirror of
https://github.com/Fishwaldo/linux-bl808.git
synced 2025-06-17 20:25:19 +00:00
introduce new LSM hooks where vfsmount is available.
Add new LSM hooks for path-based checks. Call them on directory-modifying operations at the points where we still know the vfsmount involved. Signed-off-by: Kentaro Takeda <takedakn@nttdata.co.jp> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Toshiharu Harada <haradats@nttdata.co.jp> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Kentaro Takeda
Al Viro
parent
6a94cb7306
commit
be6d3e56a6
7 changed files with 314 additions and 0 deletions
|
|
@ -335,17 +335,37 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|||
* @dir contains the inode structure of the parent directory of the new link.
|
||||
* @new_dentry contains the dentry structure for the new link.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_link:
|
||||
* Check permission before creating a new hard link to a file.
|
||||
* @old_dentry contains the dentry structure for an existing link
|
||||
* to the file.
|
||||
* @new_dir contains the path structure of the parent directory of
|
||||
* the new link.
|
||||
* @new_dentry contains the dentry structure for the new link.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_unlink:
|
||||
* Check the permission to remove a hard link to a file.
|
||||
* @dir contains the inode structure of parent directory of the file.
|
||||
* @dentry contains the dentry structure for file to be unlinked.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_unlink:
|
||||
* Check the permission to remove a hard link to a file.
|
||||
* @dir contains the path structure of parent directory of the file.
|
||||
* @dentry contains the dentry structure for file to be unlinked.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_symlink:
|
||||
* Check the permission to create a symbolic link to a file.
|
||||
* @dir contains the inode structure of parent directory of the symbolic link.
|
||||
* @dentry contains the dentry structure of the symbolic link.
|
||||
* @old_name contains the pathname of file.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_symlink:
|
||||
* Check the permission to create a symbolic link to a file.
|
||||
* @dir contains the path structure of parent directory of
|
||||
* the symbolic link.
|
||||
* @dentry contains the dentry structure of the symbolic link.
|
||||
* @old_name contains the pathname of file.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_mkdir:
|
||||
* Check permissions to create a new directory in the existing directory
|
||||
* associated with inode strcture @dir.
|
||||
|
|
@ -353,11 +373,25 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|||
* @dentry contains the dentry structure of new directory.
|
||||
* @mode contains the mode of new directory.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_mkdir:
|
||||
* Check permissions to create a new directory in the existing directory
|
||||
* associated with path strcture @path.
|
||||
* @dir containst the path structure of parent of the directory
|
||||
* to be created.
|
||||
* @dentry contains the dentry structure of new directory.
|
||||
* @mode contains the mode of new directory.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_rmdir:
|
||||
* Check the permission to remove a directory.
|
||||
* @dir contains the inode structure of parent of the directory to be removed.
|
||||
* @dentry contains the dentry structure of directory to be removed.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_rmdir:
|
||||
* Check the permission to remove a directory.
|
||||
* @dir contains the path structure of parent of the directory to be
|
||||
* removed.
|
||||
* @dentry contains the dentry structure of directory to be removed.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_mknod:
|
||||
* Check permissions when creating a special file (or a socket or a fifo
|
||||
* file created via the mknod system call). Note that if mknod operation
|
||||
|
|
@ -368,6 +402,15 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|||
* @mode contains the mode of the new file.
|
||||
* @dev contains the device number.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_mknod:
|
||||
* Check permissions when creating a file. Note that this hook is called
|
||||
* even if mknod operation is being done for a regular file.
|
||||
* @dir contains the path structure of parent of the new file.
|
||||
* @dentry contains the dentry structure of the new file.
|
||||
* @mode contains the mode of the new file.
|
||||
* @dev contains the undecoded device number. Use new_decode_dev() to get
|
||||
* the decoded device number.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_rename:
|
||||
* Check for permission to rename a file or directory.
|
||||
* @old_dir contains the inode structure for parent of the old link.
|
||||
|
|
@ -375,6 +418,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|||
* @new_dir contains the inode structure for parent of the new link.
|
||||
* @new_dentry contains the dentry structure of the new link.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_rename:
|
||||
* Check for permission to rename a file or directory.
|
||||
* @old_dir contains the path structure for parent of the old link.
|
||||
* @old_dentry contains the dentry structure of the old link.
|
||||
* @new_dir contains the path structure for parent of the new link.
|
||||
* @new_dentry contains the dentry structure of the new link.
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_readlink:
|
||||
* Check the permission to read the symbolic link.
|
||||
* @dentry contains the dentry structure for the file link.
|
||||
|
|
@ -403,6 +453,12 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|||
* @dentry contains the dentry structure for the file.
|
||||
* @attr is the iattr structure containing the new file attributes.
|
||||
* Return 0 if permission is granted.
|
||||
* @path_truncate:
|
||||
* Check permission before truncating a file.
|
||||
* @path contains the path structure for the file.
|
||||
* @length is the new length of the file.
|
||||
* @time_attrs is the flags passed to do_truncate().
|
||||
* Return 0 if permission is granted.
|
||||
* @inode_getattr:
|
||||
* Check permission before obtaining file attributes.
|
||||
* @mnt is the vfsmount where the dentry was looked up
|
||||
|
|
@ -1331,6 +1387,22 @@ struct security_operations {
|
|||
struct super_block *newsb);
|
||||
int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
|
||||
|
||||
#ifdef CONFIG_SECURITY_PATH
|
||||
int (*path_unlink) (struct path *dir, struct dentry *dentry);
|
||||
int (*path_mkdir) (struct path *dir, struct dentry *dentry, int mode);
|
||||
int (*path_rmdir) (struct path *dir, struct dentry *dentry);
|
||||
int (*path_mknod) (struct path *dir, struct dentry *dentry, int mode,
|
||||
unsigned int dev);
|
||||
int (*path_truncate) (struct path *path, loff_t length,
|
||||
unsigned int time_attrs);
|
||||
int (*path_symlink) (struct path *dir, struct dentry *dentry,
|
||||
const char *old_name);
|
||||
int (*path_link) (struct dentry *old_dentry, struct path *new_dir,
|
||||
struct dentry *new_dentry);
|
||||
int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,
|
||||
struct path *new_dir, struct dentry *new_dentry);
|
||||
#endif
|
||||
|
||||
int (*inode_alloc_security) (struct inode *inode);
|
||||
void (*inode_free_security) (struct inode *inode);
|
||||
int (*inode_init_security) (struct inode *inode, struct inode *dir,
|
||||
|
|
@ -2705,6 +2777,71 @@ static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi
|
|||
|
||||
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
|
||||
|
||||
#ifdef CONFIG_SECURITY_PATH
|
||||
int security_path_unlink(struct path *dir, struct dentry *dentry);
|
||||
int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode);
|
||||
int security_path_rmdir(struct path *dir, struct dentry *dentry);
|
||||
int security_path_mknod(struct path *dir, struct dentry *dentry, int mode,
|
||||
unsigned int dev);
|
||||
int security_path_truncate(struct path *path, loff_t length,
|
||||
unsigned int time_attrs);
|
||||
int security_path_symlink(struct path *dir, struct dentry *dentry,
|
||||
const char *old_name);
|
||||
int security_path_link(struct dentry *old_dentry, struct path *new_dir,
|
||||
struct dentry *new_dentry);
|
||||
int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
|
||||
struct path *new_dir, struct dentry *new_dentry);
|
||||
#else /* CONFIG_SECURITY_PATH */
|
||||
static inline int security_path_unlink(struct path *dir, struct dentry *dentry)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_mkdir(struct path *dir, struct dentry *dentry,
|
||||
int mode)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_rmdir(struct path *dir, struct dentry *dentry)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_mknod(struct path *dir, struct dentry *dentry,
|
||||
int mode, unsigned int dev)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_truncate(struct path *path, loff_t length,
|
||||
unsigned int time_attrs)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_symlink(struct path *dir, struct dentry *dentry,
|
||||
const char *old_name)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_link(struct dentry *old_dentry,
|
||||
struct path *new_dir,
|
||||
struct dentry *new_dentry)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int security_path_rename(struct path *old_dir,
|
||||
struct dentry *old_dentry,
|
||||
struct path *new_dir,
|
||||
struct dentry *new_dentry)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
#endif /* CONFIG_SECURITY_PATH */
|
||||
|
||||
#ifdef CONFIG_KEYS
|
||||
#ifdef CONFIG_SECURITY
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue