• Rafal Krypa's avatar
    Smack: fix d_instantiate logic for sockfs and pipefs · 805b65a8
    Rafal Krypa authored
    Since 4b936885 (v2.6.32) all inodes on sockfs and pipefs are disconnected.
    It caused filesystem specific code in smack_d_instantiate to be skipped,
    because all inodes on those pseudo filesystems were treated as root inodes.
    As a result all sockfs inodes had the Smack label set to floor.
    
    In most cases access checks for sockets use socket_smack data so the inode
    label is not important. But there are special cases that were broken.
    One example would be calling fcntl with F_SETOWN command on a socket fd.
    
    Now smack_d_instantiate expects all pipefs and sockfs inodes to be
    disconnected and has the logic in appropriate place.
    Signed-off-by: default avatarRafal Krypa <r.krypa@samsung.com>
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    805b65a8
smack_lsm.c 117 KB