selinux: Implementation for inode_copy_up() hook (56909eb3) · Commits · 戴 / test

A file is being copied up for overlay file system. Prepare a new set of creds and set create_sid appropriately so that new file is created with appropriate label. Overlay inode has right label for both context and non-context mount cases. In case of non-context mount, overlay inode will have the label of lower file and in case of context mount, overlay inode will have the label from context= mount option. Signed-off-by:

Vivek Goyal <vgoyal@redhat.com> Acked-by:

Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by:

Paul Moore <paul@paul-moore.com>

security/selinux/hooks.c

+21 −0

Original line number	Diff line number	Diff line
		@@ -3293,6 +3293,26 @@ static void selinux_inode_getsecid(struct inode inode, u32 secid)
		*secid = isec->sid;
		}

		static int selinux_inode_copy_up(struct dentry src, struct cred *new)
		{
		u32 sid;
		struct task_security_struct *tsec;
		struct cred new_creds = new;

		if (new_creds == NULL) {
		new_creds = prepare_creds();
		if (!new_creds)
		return -ENOMEM;
		}

		tsec = new_creds->security;
		/* Get label from overlay inode and set it in create_sid */
		selinux_inode_getsecid(d_inode(src), &sid);
		tsec->create_sid = sid;
		*new = new_creds;
		return 0;
		}

		/* file security operations */

		static int selinux_revalidate_file_permission(struct file *file, int mask)
		@@ -6088,6 +6108,7 @@ static struct security_hook_list selinux_hooks[] = {
		LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
		LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
		LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
		LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),

		LSM_HOOK_INIT(file_permission, selinux_file_permission),
		LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),

Admin message