GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-03-18 04:54:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Smack: Provide read control for io_uring_cmd

Browse source 
Limit io_uring "cmd" options to files for which the caller has
Smack read access. There may be cases where the cmd option may
be closer to a write access than a read, but there is no way
to make that determination.

Cc: stable@vger.kernel.org
Fixes: ee692a21e9 ("fs,io_uring: add infrastructure for uring-cmd")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2022-08-23 16:46:18 -07:00 • committed by Paul Moore
parent 707527956d
commit dd93734022
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
security/smack/smack_lsm.c
View file

@ -42,6 +42,7 @@
#include <linux/fs_context.h>
#include <linux/fs_parser.h>
#include <linux/watch_queue.h>
#include <linux/io_uring.h>
#include "smack.h"
#define TRANS_TRUE "TRUE"
@ -4732,6 +4733,36 @@ static int smack_uring_sqpoll(void)
return -EPERM;
}
/**
* smack_uring_cmd - check on file operations for io_uring
* @ioucmd: the command in question
*
* Make a best guess about whether a io_uring "command" should
* be allowed. Use the same logic used for determining if the
* file could be opened for read in the absence of better criteria.
*/
static int smack_uring_cmd(struct io_uring_cmd *ioucmd)
{
struct file *file = ioucmd->file;
struct smk_audit_info ad;
struct task_smack *tsp;
struct inode *inode;
int rc;
if (!file)
return -EINVAL;
tsp = smack_cred(file->f_cred);
inode = file_inode(file);
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
smk_ad_setfield_u_fs_path(&ad, file->f_path);
rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
return rc;
}
#endif /* CONFIG_IO_URING */
struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
@ -4889,6 +4920,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
#ifdef CONFIG_IO_URING
LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds),
LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll),
LSM_HOOK_INIT(uring_cmd, smack_uring_cmd),
#endif
};