Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6be8750b authored by Al Viro's avatar Al Viro
Browse files

LSM: lift parsing LSM options into the caller of ->sb_kern_mount() 



This paves the way for retaining the LSM options from a common filesystem
mount context during a mount parameter parsing phase to be instituted prior
to actual mount/reconfiguration actions.

Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 6466f3d1

fs/super.c

+16 −8
Original line number Diff line number Diff line
@@ -1246,17 +1246,26 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) 
{

	struct dentry *root;

	struct super_block *sb;

	char *secdata = NULL;

	int error = -ENOMEM;

	struct security_mnt_opts opts;



	security_init_mnt_opts(&opts);



	if (data && !(type->fs_flags & FS_BINARY_MOUNTDATA)) {

		secdata = alloc_secdata();

		char *secdata = alloc_secdata();

		if (!secdata)

			goto out;

			return ERR_PTR(-ENOMEM);



		error = security_sb_copy_data(data, secdata);

		if (error) {

			free_secdata(secdata);

			return ERR_PTR(error);

		}



		error = security_sb_parse_opts_str(secdata, &opts);

		free_secdata(secdata);

		if (error)

			goto out_free_secdata;

			return ERR_PTR(error);

	}



	root = type->mount(type, flags, name, data);
@@ -1277,7 +1286,7 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) 
	smp_wmb();

	sb->s_flags |= SB_BORN;



	error = security_sb_kern_mount(sb, flags, secdata);

	error = security_sb_kern_mount(sb, flags, &opts);

	if (error)

		goto out_sb;
@@ -1291,14 +1300,13 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) 
		"negative value (%lld)\n", type->name, sb->s_maxbytes);



	up_write(&sb->s_umount);

	free_secdata(secdata);

	security_free_mnt_opts(&opts);

	return root;

out_sb:

	dput(root);

	deactivate_locked_super(sb);

out_free_secdata:

	free_secdata(secdata);

out:

	security_free_mnt_opts(&opts);

	return ERR_PTR(error);

}

include/linux/lsm_hooks.h

+2 −1
Original line number Diff line number Diff line
@@ -1463,7 +1463,8 @@ union security_list_options { 
	void (*sb_free_security)(struct super_block *sb);

	int (*sb_copy_data)(char *orig, char *copy);

	int (*sb_remount)(struct super_block *sb, void *data);

	int (*sb_kern_mount)(struct super_block *sb, int flags, void *data);

	int (*sb_kern_mount)(struct super_block *sb, int flags,

			     struct security_mnt_opts *opts);

	int (*sb_show_options)(struct seq_file *m, struct super_block *sb);

	int (*sb_statfs)(struct dentry *dentry);

	int (*sb_mount)(const char *dev_name, const struct path *path,

include/linux/security.h

+4 −2
Original line number Diff line number Diff line
@@ -250,7 +250,8 @@ int security_sb_alloc(struct super_block *sb); 
void security_sb_free(struct super_block *sb);

int security_sb_copy_data(char *orig, char *copy);

int security_sb_remount(struct super_block *sb, void *data);

int security_sb_kern_mount(struct super_block *sb, int flags, void *data);

int security_sb_kern_mount(struct super_block *sb, int flags,

			   struct security_mnt_opts *opts);

int security_sb_show_options(struct seq_file *m, struct super_block *sb);

int security_sb_statfs(struct dentry *dentry);

int security_sb_mount(const char *dev_name, const struct path *path,
@@ -565,7 +566,8 @@ static inline int security_sb_remount(struct super_block *sb, void *data) 
	return 0;

}



static inline int security_sb_kern_mount(struct super_block *sb, int flags, void *data)

static inline int security_sb_kern_mount(struct super_block *sb, int flags,

					 struct security_mnt_opts *opts)

{

	return 0;

}

security/security.c

+3 −2
Original line number Diff line number Diff line
@@ -395,9 +395,10 @@ int security_sb_remount(struct super_block *sb, void *data) 
	return call_int_hook(sb_remount, 0, sb, data);

}



int security_sb_kern_mount(struct super_block *sb, int flags, void *data)

int security_sb_kern_mount(struct super_block *sb, int flags,

			   struct security_mnt_opts *opts)

{

	return call_int_hook(sb_kern_mount, 0, sb, flags, data);

	return call_int_hook(sb_kern_mount, 0, sb, flags, opts);

}



int security_sb_show_options(struct seq_file *m, struct super_block *sb)

security/selinux/hooks.c

+3 −21
Original line number Diff line number Diff line
@@ -2897,30 +2897,12 @@ static int selinux_sb_remount(struct super_block *sb, void *data) 
	goto out_free_opts;

}



static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)

static int selinux_sb_kern_mount(struct super_block *sb, int flags,

				 struct security_mnt_opts *opts)

{

	char *options = data;

	const struct cred *cred = current_cred();

	struct common_audit_data ad;

	int rc = 0;

	struct security_mnt_opts opts;



	security_init_mnt_opts(&opts);



	if (!data)

		goto out;



	BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);



	rc = selinux_parse_opts_str(options, &opts);

	if (rc)

		goto out_err;



out:

	rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);



out_err:

	security_free_mnt_opts(&opts);

	int rc = selinux_set_mnt_opts(sb, opts, 0, NULL);

	if (rc)

		return rc;