smack: Implement filesystem context security hooks (2febd254) · Commits · 戴 / test

security/smack/smack.h

+5 −14

Original line number	Diff line number	Diff line
		@@ -195,22 +195,13 @@ struct smack_known_list_elem {

		enum {
		Opt_error = -1,
		Opt_fsdefault = 1,
		Opt_fsfloor = 2,
		Opt_fshat = 3,
		Opt_fsroot = 4,
		Opt_fstransmute = 5,
		Opt_fsdefault = 0,
		Opt_fsfloor = 1,
		Opt_fshat = 2,
		Opt_fsroot = 3,
		Opt_fstransmute = 4,
		};

		/*
		* Mount options
		*/
		#define SMK_FSDEFAULT "smackfsdef="
		#define SMK_FSFLOOR "smackfsfloor="
		#define SMK_FSHAT "smackfshat="
		#define SMK_FSROOT "smackfsroot="
		#define SMK_FSTRANS "smackfstransmute="

		#define SMACK_DELETE_OPTION "-DELETE"
		#define SMACK_CIPSO_OPTION "-CIPSO"

security/smack/smack_lsm.c

+42 −1

Original line number	Diff line number	Diff line
		@@ -43,6 +43,8 @@
		#include <linux/shm.h>
		#include <linux/binfmts.h>
		#include <linux/parser.h>
		#include <linux/fs_context.h>
		#include <linux/fs_parser.h>
		#include "smack.h"

		#define TRANS_TRUE "TRUE"
		@@ -541,7 +543,6 @@ static int smack_syslog(int typefrom_file)
		return rc;
		}


		/*
		* Superblock Hooks.
		*/
		@@ -646,6 +647,44 @@ out_opt_err:
		return -EINVAL;
		}

		static const struct fs_parameter_spec smack_param_specs[] = {
		fsparam_string("fsdefault", Opt_fsdefault),
		fsparam_string("fsfloor", Opt_fsfloor),
		fsparam_string("fshat", Opt_fshat),
		fsparam_string("fsroot", Opt_fsroot),
		fsparam_string("fstransmute", Opt_fstransmute),
		{}
		};

		static const struct fs_parameter_description smack_fs_parameters = {
		.name = "smack",
		.specs = smack_param_specs,
		};

		/**
		* smack_fs_context_parse_param - Parse a single mount parameter
		* @fc: The new filesystem context being constructed.
		* @param: The parameter.
		*
		* Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on
		* error.
		*/
		static int smack_fs_context_parse_param(struct fs_context *fc,
		struct fs_parameter *param)
		{
		struct fs_parse_result result;
		int opt, rc;

		opt = fs_parse(fc, &smack_fs_parameters, param, &result);
		if (opt < 0)
		return opt;

		rc = smack_add_opt(opt, param->string, &fc->security);
		if (!rc)
		param->string = NULL;
		return rc;
		}

		static int smack_sb_eat_lsm_opts(char options, void *mnt_opts)
		{
		char from = options, to = options;
		@@ -4587,6 +4626,8 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
		LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
		LSM_HOOK_INIT(syslog, smack_syslog),

		LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),

		LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
		LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),
		LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),

Admin message