Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6335d77 authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Paul Moore
Browse files

security: Make inode argument of inode_getsecid non-const 



Make the inode argument of the inode_getsecid hook non-const so that we
can use it to revalidate invalid security labels.

Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
parent ea861dfd

include/linux/audit.h

+4 −4
Original line number Original line Diff line number Diff line
@@ -137,7 +137,7 @@ extern void __audit_getname(struct filename *name); 
extern void __audit_inode(struct filename *name, const struct dentry *dentry,

extern void __audit_inode(struct filename *name, const struct dentry *dentry,

				unsigned int flags);

				unsigned int flags);

extern void __audit_file(const struct file *);

extern void __audit_file(const struct file *);

extern void __audit_inode_child(const struct inode *parent,

extern void __audit_inode_child(struct inode *parent,

				const struct dentry *dentry,

				const struct dentry *dentry,

				const unsigned char type);

				const unsigned char type);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);
@@ -202,7 +202,7 @@ static inline void audit_inode_parent_hidden(struct filename *name, 
		__audit_inode(name, dentry,

		__audit_inode(name, dentry,

				AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);

				AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);

}

}

static inline void audit_inode_child(const struct inode *parent,

static inline void audit_inode_child(struct inode *parent,

				     const struct dentry *dentry,

				     const struct dentry *dentry,

				     const unsigned char type) {

				     const unsigned char type) {

	if (unlikely(!audit_dummy_context()))

	if (unlikely(!audit_dummy_context()))
@@ -359,7 +359,7 @@ static inline void __audit_inode(struct filename *name, 
					const struct dentry *dentry,

					const struct dentry *dentry,

					unsigned int flags)

					unsigned int flags)

{ }

{ }

static inline void __audit_inode_child(const struct inode *parent,

static inline void __audit_inode_child(struct inode *parent,

					const struct dentry *dentry,

					const struct dentry *dentry,

					const unsigned char type)

					const unsigned char type)

{ }

{ }
@@ -373,7 +373,7 @@ static inline void audit_file(struct file *file) 
static inline void audit_inode_parent_hidden(struct filename *name,

static inline void audit_inode_parent_hidden(struct filename *name,

				const struct dentry *dentry)

				const struct dentry *dentry)

{ }

{ }

static inline void audit_inode_child(const struct inode *parent,

static inline void audit_inode_child(struct inode *parent,

				     const struct dentry *dentry,

				     const struct dentry *dentry,

				     const unsigned char type)

				     const unsigned char type)

{ }

{ }

include/linux/lsm_hooks.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -1420,7 +1420,7 @@ union security_list_options { 
					int flags);

					int flags);

	int (*inode_listsecurity)(struct inode *inode, char *buffer,

	int (*inode_listsecurity)(struct inode *inode, char *buffer,

					size_t buffer_size);

					size_t buffer_size);

	void (*inode_getsecid)(const struct inode *inode, u32 *secid);

	void (*inode_getsecid)(struct inode *inode, u32 *secid);





	int (*file_permission)(struct file *file, int mask);

	int (*file_permission)(struct file *file, int mask);

	int (*file_alloc_security)(struct file *file);

	int (*file_alloc_security)(struct file *file);

include/linux/security.h

+2 −2
Original line number Original line Diff line number Diff line
@@ -273,7 +273,7 @@ int security_inode_killpriv(struct dentry *dentry); 
int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc);

int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc);

int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);

int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);

int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);

int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);

void security_inode_getsecid(const struct inode *inode, u32 *secid);

void security_inode_getsecid(struct inode *inode, u32 *secid);

int security_file_permission(struct file *file, int mask);

int security_file_permission(struct file *file, int mask);

int security_file_alloc(struct file *file);

int security_file_alloc(struct file *file);

void security_file_free(struct file *file);

void security_file_free(struct file *file);
@@ -734,7 +734,7 @@ static inline int security_inode_listsecurity(struct inode *inode, char *buffer, 
	return 0;

	return 0;

}

}





static inline void security_inode_getsecid(const struct inode *inode, u32 *secid)

static inline void security_inode_getsecid(struct inode *inode, u32 *secid)

{

{

	*secid = 0;

	*secid = 0;

}

}

kernel/audit.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -1722,7 +1722,7 @@ static inline int audit_copy_fcaps(struct audit_names *name, 




/* Copy inode data into an audit_names. */

/* Copy inode data into an audit_names. */

void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,

void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,

		      const struct inode *inode)

		      struct inode *inode)

{

{

	name->ino   = inode->i_ino;

	name->ino   = inode->i_ino;

	name->dev   = inode->i_sb->s_dev;

	name->dev   = inode->i_sb->s_dev;

kernel/audit.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -207,7 +207,7 @@ extern u32 audit_ever_enabled; 




extern void audit_copy_inode(struct audit_names *name,

extern void audit_copy_inode(struct audit_names *name,

			     const struct dentry *dentry,

			     const struct dentry *dentry,

			     const struct inode *inode);

			     struct inode *inode);

extern void audit_log_cap(struct audit_buffer *ab, char *prefix,

extern void audit_log_cap(struct audit_buffer *ab, char *prefix,

			  kernel_cap_t *cap);

			  kernel_cap_t *cap);

extern void audit_log_name(struct audit_context *context,

extern void audit_log_name(struct audit_context *context,