Skip to content

L
linux
Commit b47711bf authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Options

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  selinux: make mls_compute_sid always polyinstantiate
  security/selinux: constify function pointer tables and fields
  security: add a secctx_to_secid() hook
  security: call security_file_permission from rw_verify_area
  security: remove security_sb_post_mountroot hook
  Security: remove security.h include from mm.h
  Security: remove security_file_mmap hook sparse-warnings (NULL as 0).
  Security: add get, set, and cloning of superblock security information
  security/selinux: Add missing "space"
parents 7556afa0 2e08c0c1
Expand all Show whitespace changes
Inline Side-by-side
Showing with 642 additions and 341 deletions
fs/compat.c
View file @ b47711bf
...@@ -1104,10 +1104,6 @@ static ssize_t compat_do_readv_writev(int type, struct file *file, ...@@ -1104,10 +1104,6 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
if (ret < 0) if (ret < 0)
goto out; goto out;
ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
if (ret)
goto out;
fnv = NULL; fnv = NULL;
if (type == READ) { if (type == READ) {
fn = file->f_op->read; fn = file->f_op->read;
......
fs/read_write.c
View file @ b47711bf
...@@ -197,25 +197,27 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count ...@@ -197,25 +197,27 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count
{ {
struct inode *inode; struct inode *inode;
loff_t pos; loff_t pos;
int retval = -EINVAL;
inode = file->f_path.dentry->d_inode; inode = file->f_path.dentry->d_inode;
if (unlikely((ssize_t) count < 0)) if (unlikely((ssize_t) count < 0))
goto Einval; return retval;
pos = *ppos; pos = *ppos;
if (unlikely((pos < 0) || (loff_t) (pos + count) < 0)) if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
goto Einval; return retval;
if (unlikely(inode->i_flock && mandatory_lock(inode))) { if (unlikely(inode->i_flock && mandatory_lock(inode))) {
int retval = locks_mandatory_area( retval = locks_mandatory_area(
read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE,
inode, file, pos, count); inode, file, pos, count);
if (retval < 0) if (retval < 0)
return retval; return retval;
} }
retval = security_file_permission(file,
read_write == READ ? MAY_READ : MAY_WRITE);
if (retval)
return retval;
return count > MAX_RW_COUNT ? MAX_RW_COUNT : count; return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;
Einval:
return -EINVAL;
} }
static void wait_on_retry_sync_kiocb(struct kiocb *iocb) static void wait_on_retry_sync_kiocb(struct kiocb *iocb)
...@@ -267,8 +269,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) ...@@ -267,8 +269,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
ret = rw_verify_area(READ, file, pos, count); ret = rw_verify_area(READ, file, pos, count);
if (ret >= 0) { if (ret >= 0) {
count = ret; count = ret;
ret = security_file_permission (file, MAY_READ);
if (!ret) {
if (file->f_op->read) if (file->f_op->read)
ret = file->f_op->read(file, buf, count, pos); ret = file->f_op->read(file, buf, count, pos);
else else
...@@ -279,7 +279,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) ...@@ -279,7 +279,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
} }
inc_syscr(current); inc_syscr(current);
} }
}
return ret; return ret;
} }
...@@ -325,8 +324,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ ...@@ -325,8 +324,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
ret = rw_verify_area(WRITE, file, pos, count); ret = rw_verify_area(WRITE, file, pos, count);
if (ret >= 0) { if (ret >= 0) {
count = ret; count = ret;
ret = security_file_permission (file, MAY_WRITE);
if (!ret) {
if (file->f_op->write) if (file->f_op->write)
ret = file->f_op->write(file, buf, count, pos); ret = file->f_op->write(file, buf, count, pos);
else else
...@@ -337,7 +334,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ ...@@ -337,7 +334,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
} }
inc_syscw(current); inc_syscw(current);
} }
}
return ret; return ret;
} }
...@@ -603,9 +599,6 @@ static ssize_t do_readv_writev(int type, struct file *file, ...@@ -603,9 +599,6 @@ static ssize_t do_readv_writev(int type, struct file *file,
ret = rw_verify_area(type, file, pos, tot_len); ret = rw_verify_area(type, file, pos, tot_len);
if (ret < 0) if (ret < 0)
goto out; goto out;
ret = security_file_permission(file, type == READ ? MAY_READ : MAY_WRITE);
if (ret)
goto out;
fnv = NULL; fnv = NULL;
if (type == READ) { if (type == READ) {
...@@ -737,10 +730,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, ...@@ -737,10 +730,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
goto fput_in; goto fput_in;
count = retval; count = retval;
retval = security_file_permission (in_file, MAY_READ);
if (retval)
goto fput_in;
/* /*
* Get output file, and verify that it is ok.. * Get output file, and verify that it is ok..
*/ */
...@@ -759,10 +748,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, ...@@ -759,10 +748,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
goto fput_out; goto fput_out;
count = retval; count = retval;
retval = security_file_permission (out_file, MAY_WRITE);
if (retval)
goto fput_out;
if (!max) if (!max)
max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes); max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);
......
fs/splice.c
View file @ b47711bf
...@@ -908,10 +908,6 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, ...@@ -908,10 +908,6 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
if (unlikely(ret < 0)) if (unlikely(ret < 0))
return ret; return ret;
ret = security_file_permission(out, MAY_WRITE);
if (unlikely(ret < 0))
return ret;
return out->f_op->splice_write(pipe, out, ppos, len, flags); return out->f_op->splice_write(pipe, out, ppos, len, flags);
} }
...@@ -934,10 +930,6 @@ static long do_splice_to(struct file *in, loff_t *ppos, ...@@ -934,10 +930,6 @@ static long do_splice_to(struct file *in, loff_t *ppos,
if (unlikely(ret < 0)) if (unlikely(ret < 0))
return ret; return ret;
ret = security_file_permission(in, MAY_READ);
if (unlikely(ret < 0))
return ret;
return in->f_op->splice_read(in, ppos, pipe, len, flags); return in->f_op->splice_read(in, ppos, pipe, len, flags);
} }
......
include/linux/mm.h
View file @ b47711bf
...@@ -12,7 +12,6 @@ ...@@ -12,7 +12,6 @@
#include <linux/prio_tree.h> #include <linux/prio_tree.h>
#include <linux/debug_locks.h> #include <linux/debug_locks.h>
#include <linux/mm_types.h> #include <linux/mm_types.h>
#include <linux/security.h>
struct mempolicy; struct mempolicy;
struct anon_vma; struct anon_vma;
...@@ -34,6 +33,8 @@ extern int sysctl_legacy_va_layout; ...@@ -34,6 +33,8 @@ extern int sysctl_legacy_va_layout;
#define sysctl_legacy_va_layout 0 #define sysctl_legacy_va_layout 0
#endif #endif
extern unsigned long mmap_min_addr;
#include <asm/page.h> #include <asm/page.h>
#include <asm/pgtable.h> #include <asm/pgtable.h>
#include <asm/processor.h> #include <asm/processor.h>
......
include/linux/security.h
View file @ b47711bf
...@@ -34,6 +34,12 @@ ...@@ -34,6 +34,12 @@
#include <linux/xfrm.h> #include <linux/xfrm.h>
#include <net/flow.h> #include <net/flow.h>
/* only a char in selinux superblock security struct flags */
#define FSCONTEXT_MNT 0x01
#define CONTEXT_MNT 0x02
#define ROOTCONTEXT_MNT 0x04
#define DEFCONTEXT_MNT 0x08
/* /*
* Bounding set * Bounding set
*/ */
...@@ -243,9 +249,6 @@ struct request_sock; ...@@ -243,9 +249,6 @@ struct request_sock;
* @mnt contains the mounted file system. * @mnt contains the mounted file system.
* @flags contains the new filesystem flags. * @flags contains the new filesystem flags.
* @data contains the filesystem-specific data. * @data contains the filesystem-specific data.
* @sb_post_mountroot:
* Update the security module's state when the root filesystem is mounted.
* This hook is only called if the mount was successful.
* @sb_post_addmount: * @sb_post_addmount:
* Update the security module's state when a filesystem is mounted. * Update the security module's state when a filesystem is mounted.
* This hook is called any time a mount is successfully grafetd to * This hook is called any time a mount is successfully grafetd to
...@@ -261,6 +264,22 @@ struct request_sock; ...@@ -261,6 +264,22 @@ struct request_sock;
* Update module state after a successful pivot. * Update module state after a successful pivot.
* @old_nd contains the nameidata structure for the old root. * @old_nd contains the nameidata structure for the old root.
* @new_nd contains the nameidata structure for the new root. * @new_nd contains the nameidata structure for the new root.
* @sb_get_mnt_opts:
* Get the security relevant mount options used for a superblock
* @sb the superblock to get security mount options from
* @mount_options array for pointers to mount options
* @mount_flags array of ints specifying what each mount options is
* @num_opts number of options in the arrays
* @sb_set_mnt_opts:
* Set the security relevant mount options used for a superblock
* @sb the superblock to set security mount options for
* @mount_options array for pointers to mount options
* @mount_flags array of ints specifying what each mount options is
* @num_opts number of options in the arrays
* @sb_clone_mnt_opts:
* Copy all security options from a given superblock to another
* @oldsb old superblock which contain information to clone
* @newsb new superblock which needs filled in
* *
* Security hooks for inode operations. * Security hooks for inode operations.
* *
...@@ -1183,6 +1202,10 @@ struct request_sock; ...@@ -1183,6 +1202,10 @@ struct request_sock;
* Convert secid to security context. * Convert secid to security context.
* @secid contains the security ID. * @secid contains the security ID.
* @secdata contains the pointer that stores the converted security context. * @secdata contains the pointer that stores the converted security context.
* @secctx_to_secid:
* Convert security context to secid.
* @secid contains the pointer to the generated security ID.
* @secdata contains the security context.
* *
* @release_secctx: * @release_secctx:
* Release the security context. * Release the security context.
...@@ -1235,13 +1258,19 @@ struct security_operations { ...@@ -1235,13 +1258,19 @@ struct security_operations {
void (*sb_umount_busy) (struct vfsmount * mnt); void (*sb_umount_busy) (struct vfsmount * mnt);
void (*sb_post_remount) (struct vfsmount * mnt, void (*sb_post_remount) (struct vfsmount * mnt,
unsigned long flags, void *data); unsigned long flags, void *data);
void (*sb_post_mountroot) (void);
void (*sb_post_addmount) (struct vfsmount * mnt, void (*sb_post_addmount) (struct vfsmount * mnt,
struct nameidata * mountpoint_nd); struct nameidata * mountpoint_nd);
int (*sb_pivotroot) (struct nameidata * old_nd, int (*sb_pivotroot) (struct nameidata * old_nd,
struct nameidata * new_nd); struct nameidata * new_nd);
void (*sb_post_pivotroot) (struct nameidata * old_nd, void (*sb_post_pivotroot) (struct nameidata * old_nd,
struct nameidata * new_nd); struct nameidata * new_nd);
int (*sb_get_mnt_opts) (const struct super_block *sb,
char ***mount_options, int **flags,
int *num_opts);
int (*sb_set_mnt_opts) (struct super_block *sb, char **mount_options,
int *flags, int num_opts);
void (*sb_clone_mnt_opts) (const struct super_block *oldsb,
struct super_block *newsb);
int (*inode_alloc_security) (struct inode *inode); int (*inode_alloc_security) (struct inode *inode);
void (*inode_free_security) (struct inode *inode); void (*inode_free_security) (struct inode *inode);
...@@ -1371,6 +1400,7 @@ struct security_operations { ...@@ -1371,6 +1400,7 @@ struct security_operations {
int (*getprocattr)(struct task_struct *p, char *name, char **value); int (*getprocattr)(struct task_struct *p, char *name, char **value);
int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size); int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen); int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
int (*secctx_to_secid)(char *secdata, u32 seclen, u32 *secid);
void (*release_secctx)(char *secdata, u32 seclen); void (*release_secctx)(char *secdata, u32 seclen);
#ifdef CONFIG_SECURITY_NETWORK #ifdef CONFIG_SECURITY_NETWORK
...@@ -1495,10 +1525,16 @@ int security_sb_umount(struct vfsmount *mnt, int flags); ...@@ -1495,10 +1525,16 @@ int security_sb_umount(struct vfsmount *mnt, int flags);
void security_sb_umount_close(struct vfsmount *mnt); void security_sb_umount_close(struct vfsmount *mnt);
void security_sb_umount_busy(struct vfsmount *mnt); void security_sb_umount_busy(struct vfsmount *mnt);
void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data); void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data);
void security_sb_post_mountroot(void);
void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd); void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd);
int security_sb_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd); int security_sb_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);
void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd); void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_nd);
int security_sb_get_mnt_opts(const struct super_block *sb, char ***mount_options,
int **flags, int *num_opts);
int security_sb_set_mnt_opts(struct super_block *sb, char **mount_options,
int *flags, int num_opts);
void security_sb_clone_mnt_opts(const struct super_block *oldsb,
struct super_block *newsb);
int security_inode_alloc(struct inode *inode); int security_inode_alloc(struct inode *inode);
void security_inode_free(struct inode *inode); void security_inode_free(struct inode *inode);
int security_inode_init_security(struct inode *inode, struct inode *dir, int security_inode_init_security(struct inode *inode, struct inode *dir,
...@@ -1603,6 +1639,7 @@ int security_setprocattr(struct task_struct *p, char *name, void *value, size_t ...@@ -1603,6 +1639,7 @@ int security_setprocattr(struct task_struct *p, char *name, void *value, size_t
int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_netlink_send(struct sock *sk, struct sk_buff *skb);
int security_netlink_recv(struct sk_buff *skb, int cap); int security_netlink_recv(struct sk_buff *skb, int cap);
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
int security_secctx_to_secid(char *secdata, u32 seclen, u32 *secid);
void security_release_secctx(char *secdata, u32 seclen); void security_release_secctx(char *secdata, u32 seclen);
#else /* CONFIG_SECURITY */ #else /* CONFIG_SECURITY */
...@@ -1777,9 +1814,6 @@ static inline void security_sb_post_remount (struct vfsmount *mnt, ...@@ -1777,9 +1814,6 @@ static inline void security_sb_post_remount (struct vfsmount *mnt,
unsigned long flags, void *data) unsigned long flags, void *data)
{ } { }
static inline void security_sb_post_mountroot (void)
{ }
static inline void security_sb_post_addmount (struct vfsmount *mnt, static inline void security_sb_post_addmount (struct vfsmount *mnt,
struct nameidata *mountpoint_nd) struct nameidata *mountpoint_nd)
{ } { }
...@@ -2266,7 +2300,7 @@ static inline struct dentry *securityfs_create_file(const char *name, ...@@ -2266,7 +2300,7 @@ static inline struct dentry *securityfs_create_file(const char *name,
mode_t mode, mode_t mode,
struct dentry *parent, struct dentry *parent,
void *data, void *data,
struct file_operations *fops) const struct file_operations *fops)
{ {
return ERR_PTR(-ENODEV); return ERR_PTR(-ENODEV);
} }
...@@ -2280,6 +2314,13 @@ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *secle ...@@ -2280,6 +2314,13 @@ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *secle
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
static inline int security_secctx_to_secid(char *secdata,
u32 seclen,
u32 *secid)
{
return -EOPNOTSUPP;
}
static inline void security_release_secctx(char *secdata, u32 seclen) static inline void security_release_secctx(char *secdata, u32 seclen)
{ {
} }
......
init/do_mounts.c
View file @ b47711bf
...@@ -378,6 +378,5 @@ void __init prepare_namespace(void) ...@@ -378,6 +378,5 @@ void __init prepare_namespace(void)
out: out:
sys_mount(".", "/", NULL, MS_MOVE, NULL); sys_mount(".", "/", NULL, MS_MOVE, NULL);
sys_chroot("."); sys_chroot(".");
security_sb_post_mountroot();
} }
mm/mmap.c
View file @ b47711bf
...@@ -1620,7 +1620,7 @@ static inline int expand_downwards(struct vm_area_struct *vma, ...@@ -1620,7 +1620,7 @@ static inline int expand_downwards(struct vm_area_struct *vma,
return -ENOMEM; return -ENOMEM;
address &= PAGE_MASK; address &= PAGE_MASK;
error = security_file_mmap(0, 0, 0, 0, address, 1); error = security_file_mmap(NULL, 0, 0, 0, address, 1);
if (error) if (error)
return error; return error;
...@@ -1941,7 +1941,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len) ...@@ -1941,7 +1941,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
if (is_hugepage_only_range(mm, addr, len)) if (is_hugepage_only_range(mm, addr, len))
return -EINVAL; return -EINVAL;
error = security_file_mmap(0, 0, 0, 0, addr, 1); error = security_file_mmap(NULL, 0, 0, 0, addr, 1);
if (error) if (error)
return error; return error;
......
security/dummy.c
View file @ b47711bf
...@@ -225,22 +225,40 @@ static void dummy_sb_post_remount (struct vfsmount *mnt, unsigned long flags, ...@@ -225,22 +225,40 @@ static void dummy_sb_post_remount (struct vfsmount *mnt, unsigned long flags,
} }
static void dummy_sb_post_mountroot (void) static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
{ {
return; return;
} }
static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd) static int dummy_sb_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
{
return 0;
}
static void dummy_sb_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
{ {
return; return;
} }
static int dummy_sb_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd) static int dummy_sb_get_mnt_opts(const struct super_block *sb, char ***mount_options,
int **flags, int *num_opts)
{ {
*mount_options = NULL;
*flags = NULL;
*num_opts = 0;
return 0; return 0;
} }
static void dummy_sb_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd) static int dummy_sb_set_mnt_opts(struct super_block *sb, char **mount_options,
int *flags, int num_opts)
{
if (unlikely(num_opts))
return -EOPNOTSUPP;
return 0;
}
static void dummy_sb_clone_mnt_opts(const struct super_block *oldsb,
struct super_block *newsb)
{ {
return; return;
} }
...@@ -928,6 +946,11 @@ static int dummy_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) ...@@ -928,6 +946,11 @@ static int dummy_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
static int dummy_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
{
return -EOPNOTSUPP;
}
static void dummy_release_secctx(char *secdata, u32 seclen) static void dummy_release_secctx(char *secdata, u32 seclen)
{ {
} }
...@@ -994,10 +1017,12 @@ void security_fixup_ops (struct security_operations *ops) ...@@ -994,10 +1017,12 @@ void security_fixup_ops (struct security_operations *ops)
set_to_dummy_if_null(ops, sb_umount_close); set_to_dummy_if_null(ops, sb_umount_close);
set_to_dummy_if_null(ops, sb_umount_busy); set_to_dummy_if_null(ops, sb_umount_busy);
set_to_dummy_if_null(ops, sb_post_remount); set_to_dummy_if_null(ops, sb_post_remount);
set_to_dummy_if_null(ops, sb_post_mountroot);
set_to_dummy_if_null(ops, sb_post_addmount); set_to_dummy_if_null(ops, sb_post_addmount);
set_to_dummy_if_null(ops, sb_pivotroot); set_to_dummy_if_null(ops, sb_pivotroot);
set_to_dummy_if_null(ops, sb_post_pivotroot); set_to_dummy_if_null(ops, sb_post_pivotroot);
set_to_dummy_if_null(ops, sb_get_mnt_opts);
set_to_dummy_if_null(ops, sb_set_mnt_opts);
set_to_dummy_if_null(ops, sb_clone_mnt_opts);
set_to_dummy_if_null(ops, inode_alloc_security); set_to_dummy_if_null(ops, inode_alloc_security);
set_to_dummy_if_null(ops, inode_free_security); set_to_dummy_if_null(ops, inode_free_security);
set_to_dummy_if_null(ops, inode_init_security); set_to_dummy_if_null(ops, inode_init_security);
...@@ -1086,6 +1111,7 @@ void security_fixup_ops (struct security_operations *ops) ...@@ -1086,6 +1111,7 @@ void security_fixup_ops (struct security_operations *ops)
set_to_dummy_if_null(ops, getprocattr); set_to_dummy_if_null(ops, getprocattr);
set_to_dummy_if_null(ops, setprocattr); set_to_dummy_if_null(ops, setprocattr);
set_to_dummy_if_null(ops, secid_to_secctx); set_to_dummy_if_null(ops, secid_to_secctx);
set_to_dummy_if_null(ops, secctx_to_secid);
set_to_dummy_if_null(ops, release_secctx); set_to_dummy_if_null(ops, release_secctx);
#ifdef CONFIG_SECURITY_NETWORK #ifdef CONFIG_SECURITY_NETWORK
set_to_dummy_if_null(ops, unix_stream_connect); set_to_dummy_if_null(ops, unix_stream_connect);
......
security/keys/proc.c
View file @ b47711bf
...@@ -26,7 +26,7 @@ static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos); ...@@ -26,7 +26,7 @@ static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos);
static void proc_keys_stop(struct seq_file *p, void *v); static void proc_keys_stop(struct seq_file *p, void *v);
static int proc_keys_show(struct seq_file *m, void *v); static int proc_keys_show(struct seq_file *m, void *v);
static struct seq_operations proc_keys_ops = { static const struct seq_operations proc_keys_ops = {
.start = proc_keys_start, .start = proc_keys_start,
.next = proc_keys_next, .next = proc_keys_next,
.stop = proc_keys_stop, .stop = proc_keys_stop,
...@@ -47,7 +47,7 @@ static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos); ...@@ -47,7 +47,7 @@ static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos);
static void proc_key_users_stop(struct seq_file *p, void *v); static void proc_key_users_stop(struct seq_file *p, void *v);
static int proc_key_users_show(struct seq_file *m, void *v); static int proc_key_users_show(struct seq_file *m, void *v);
static struct seq_operations proc_key_users_ops = { static const struct seq_operations proc_key_users_ops = {
.start = proc_key_users_start, .start = proc_key_users_start,
.next = proc_key_users_next, .next = proc_key_users_next,
.stop = proc_key_users_stop, .stop = proc_key_users_stop,
......
security/security.c
View file @ b47711bf
...@@ -288,11 +288,6 @@ void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *d ...@@ -288,11 +288,6 @@ void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *d
security_ops->sb_post_remount(mnt, flags, data); security_ops->sb_post_remount(mnt, flags, data);
} }
void security_sb_post_mountroot(void)
{
security_ops->sb_post_mountroot();
}
void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd) void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd)
{ {
security_ops->sb_post_addmount(mnt, mountpoint_nd); security_ops->sb_post_addmount(mnt, mountpoint_nd);
...@@ -308,6 +303,26 @@ void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_ ...@@ -308,6 +303,26 @@ void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_
security_ops->sb_post_pivotroot(old_nd, new_nd); security_ops->sb_post_pivotroot(old_nd, new_nd);
} }
int security_sb_get_mnt_opts(const struct super_block *sb,
char ***mount_options,
int **flags, int *num_opts)
{
return security_ops->sb_get_mnt_opts(sb, mount_options, flags, num_opts);
}
int security_sb_set_mnt_opts(struct super_block *sb,
char **mount_options,
int *flags, int num_opts)
{
return security_ops->sb_set_mnt_opts(sb, mount_options, flags, num_opts);
}
void security_sb_clone_mnt_opts(const struct super_block *oldsb,
struct super_block *newsb)
{
security_ops->sb_clone_mnt_opts(oldsb, newsb);
}
int security_inode_alloc(struct inode *inode) int security_inode_alloc(struct inode *inode)
{ {
inode->i_security = NULL; inode->i_security = NULL;
...@@ -816,6 +831,12 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) ...@@ -816,6 +831,12 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
} }
EXPORT_SYMBOL(security_secid_to_secctx); EXPORT_SYMBOL(security_secid_to_secctx);
int security_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
{
return security_ops->secctx_to_secid(secdata, seclen, secid);
}
EXPORT_SYMBOL(security_secctx_to_secid);
void security_release_secctx(char *secdata, u32 seclen) void security_release_secctx(char *secdata, u32 seclen)
{ {
return security_ops->release_secctx(secdata, seclen); return security_ops->release_secctx(secdata, seclen);
......
security/selinux/hooks.c
View file @ b47711bf
This diff is collapsed.
security/selinux/include/objsec.h
View file @ b47711bf
...@@ -65,6 +65,7 @@ struct superblock_security_struct { ...@@ -65,6 +65,7 @@ struct superblock_security_struct {
u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */ u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */
unsigned int behavior; /* labeling behavior */ unsigned int behavior; /* labeling behavior */
unsigned char initialized; /* initialization flag */ unsigned char initialized; /* initialization flag */
unsigned char flags; /* which mount options were specified */
unsigned char proc; /* proc fs */ unsigned char proc; /* proc fs */
struct mutex lock; struct mutex lock;
struct list_head isec_head; struct list_head isec_head;
......
security/selinux/selinuxfs.c
View file @ b47711bf
...@@ -1222,7 +1222,7 @@ static int sel_avc_stats_seq_show(struct seq_file *seq, void *v) ...@@ -1222,7 +1222,7 @@ static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v) static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v)
{ } { }
static struct seq_operations sel_avc_cache_stats_seq_ops = { static const struct seq_operations sel_avc_cache_stats_seq_ops = {
.start = sel_avc_stats_seq_start, .start = sel_avc_stats_seq_start,
.next = sel_avc_stats_seq_next, .next = sel_avc_stats_seq_next,
.show = sel_avc_stats_seq_show, .show = sel_avc_stats_seq_show,
......
security/selinux/ss/avtab.c
View file @ b47711bf
...@@ -280,7 +280,7 @@ int avtab_alloc(struct avtab *h, u32 nrules) ...@@ -280,7 +280,7 @@ int avtab_alloc(struct avtab *h, u32 nrules)
h->nel = 0; h->nel = 0;
h->nslot = nslot; h->nslot = nslot;
h->mask = mask; h->mask = mask;
printk(KERN_DEBUG "SELinux:%d avtab hash slots allocated." printk(KERN_DEBUG "SELinux:%d avtab hash slots allocated. "
"Num of rules:%d\n", h->nslot, nrules); "Num of rules:%d\n", h->nslot, nrules);
return 0; return 0;
} }
......
security/selinux/ss/mls.c
View file @ b47711bf
...@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext, ...@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
/* Use the process effective MLS attributes. */ /* Use the process effective MLS attributes. */
return mls_context_cpy_low(newcontext, scontext); return mls_context_cpy_low(newcontext, scontext);
case AVTAB_MEMBER: case AVTAB_MEMBER:
/* Only polyinstantiate the MLS attributes if
the type is being polyinstantiated */
if (newcontext->type != tcontext->type) {
/* Use the process effective MLS attributes. */ /* Use the process effective MLS attributes. */
return mls_context_cpy_low(newcontext, scontext); return mls_context_cpy_low(newcontext, scontext);
} else {
/* Use the related object MLS attributes. */
return mls_context_cpy(newcontext, tcontext);
}
default: default:
return -EINVAL; return -EINVAL;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7