Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bced9528 authored by H. Peter Anvin's avatar H. Peter Anvin Committed by James Morris
Browse files

security: remove security_sb_post_mountroot hook 

The security_sb_post_mountroot() hook is long-since obsolete, and is
fundamentally broken: it is never invoked if someone uses initramfs.
This is particularly damaging, because the existence of this hook has
been used as motivation for not using initramfs.

Stephen Smalley confirmed on 2007-07-19 that this hook was originally
used by SELinux but can now be safely removed:

     http://marc.info/?l=linux-kernel&m=118485683612916&w=2



Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: default avatarH. Peter Anvin <hpa@zytor.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 42d7896e

include/linux/security.h

+0 −8
Original line number Diff line number Diff line
@@ -249,9 +249,6 @@ struct request_sock; 
 *	@mnt contains the mounted file system.

 *	@flags contains the new filesystem flags.

 *	@data contains the filesystem-specific data.

 * @sb_post_mountroot:

 *	Update the security module's state when the root filesystem is mounted.

 *	This hook is only called if the mount was successful.

 * @sb_post_addmount:

 *	Update the security module's state when a filesystem is mounted.

 *	This hook is called any time a mount is successfully grafetd to
@@ -1257,7 +1254,6 @@ struct security_operations { 
	void (*sb_umount_busy) (struct vfsmount * mnt);

	void (*sb_post_remount) (struct vfsmount * mnt,

				 unsigned long flags, void *data);

	void (*sb_post_mountroot) (void);

	void (*sb_post_addmount) (struct vfsmount * mnt,

				  struct nameidata * mountpoint_nd);

	int (*sb_pivotroot) (struct nameidata * old_nd,
@@ -1524,7 +1520,6 @@ int security_sb_umount(struct vfsmount *mnt, int flags); 
void security_sb_umount_close(struct vfsmount *mnt);

void security_sb_umount_busy(struct vfsmount *mnt);

void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data);

void security_sb_post_mountroot(void);

void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd);

int security_sb_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);

void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);
@@ -1813,9 +1808,6 @@ static inline void security_sb_post_remount (struct vfsmount *mnt, 
					     unsigned long flags, void *data)

{ }



static inline void security_sb_post_mountroot (void)

{ }



static inline void security_sb_post_addmount (struct vfsmount *mnt,

					      struct nameidata *mountpoint_nd)

{ }

init/do_mounts.c

+0 −1
Original line number Diff line number Diff line
@@ -470,6 +470,5 @@ void __init prepare_namespace(void) 
out:

	sys_mount(".", "/", NULL, MS_MOVE, NULL);

	sys_chroot(".");

	security_sb_post_mountroot();

}

security/dummy.c

+0 −6
Original line number Diff line number Diff line
@@ -225,11 +225,6 @@ static void dummy_sb_post_remount (struct vfsmount *mnt, unsigned long flags, 
}





static void dummy_sb_post_mountroot (void)

{

	return;

}



static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd)

{

	return;
@@ -1017,7 +1012,6 @@ void security_fixup_ops (struct security_operations *ops) 
	set_to_dummy_if_null(ops, sb_umount_close);

	set_to_dummy_if_null(ops, sb_umount_busy);

	set_to_dummy_if_null(ops, sb_post_remount);

	set_to_dummy_if_null(ops, sb_post_mountroot);

	set_to_dummy_if_null(ops, sb_post_addmount);

	set_to_dummy_if_null(ops, sb_pivotroot);

	set_to_dummy_if_null(ops, sb_post_pivotroot);

security/security.c

+0 −5
Original line number Diff line number Diff line
@@ -288,11 +288,6 @@ void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *d 
	security_ops->sb_post_remount(mnt, flags, data);

}



void security_sb_post_mountroot(void)

{

	security_ops->sb_post_mountroot();

}



void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd)

{

	security_ops->sb_post_addmount(mnt, mountpoint_nd);