Commit 8ae8f162 authored by Jaegeuk Kim's avatar Jaegeuk Kim
Browse files

f2fs: support xattr security labels 

This patch adds the support of security labels for f2fs, which will be used
by Linus Security Models (LSMs).

Quote from http://en.wikipedia.org/wiki/Linux_Security_Modules

:
"Linux Security Modules (LSM) is a framework that allows the Linux kernel to
support a variety of computer security models while avoiding favoritism toward
any single security implementation. The framework is licensed under the terms of
the GNU General Public License and is standard part of the Linux kernel since
Linux 2.6. AppArmor, SELinux, Smack and TOMOYO Linux are the currently accepted
modules in the official kernel.".

Signed-off-by: default avatarJaegeuk Kim <jaegeuk.kim@samsung.com>
parent 5deb8267

fs/f2fs/Kconfig

+12 −0
Original line number Diff line number Diff line
@@ -51,3 +51,15 @@ config F2FS_FS_POSIX_ACL 
	  Linux website <http://acl.bestbits.at/>.



	  If you don't know what Access Control Lists are, say N



config F2FS_FS_SECURITY

	bool "F2FS Security Labels"

	depends on F2FS_FS_XATTR

	help

	  Security labels provide an access control facility to support Linux

	  Security Models (LSMs) accepted by AppArmor, SELinux, Smack and TOMOYO

	  Linux. This option enables an extended attribute handler for file

	  security labels in the f2fs filesystem, so that it requires enabling

	  the extended attribute support in advance.



	  If you are not using a security module, say N.

fs/f2fs/acl.c

+1 −1
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ static int f2fs_set_acl(struct inode *inode, int type, struct posix_acl *acl) 
		}

	}



	error = f2fs_setxattr(inode, name_index, "", value, size);

	error = f2fs_setxattr(inode, name_index, "", value, size, NULL);



	kfree(value);

	if (!error)

fs/f2fs/dir.c

+5 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include "f2fs.h"

#include "node.h"

#include "acl.h"

#include "xattr.h"



static unsigned long dir_blocks(struct inode *inode)

{
@@ -334,6 +335,10 @@ static struct page *init_inode_metadata(struct inode *inode, 
		if (err)

			goto error;



		err = f2fs_init_security(inode, dir, name, page);

		if (err)

			goto error;



		wait_on_page_writeback(page);

	} else {

		page = get_node_page(F2FS_SB(dir->i_sb), inode->i_ino);

fs/f2fs/f2fs.h

+1 −1
Original line number Diff line number Diff line
@@ -968,7 +968,7 @@ int get_dnode_of_data(struct dnode_of_data *, pgoff_t, int); 
int truncate_inode_blocks(struct inode *, pgoff_t);

int remove_inode_page(struct inode *);

struct page *new_inode_page(struct inode *, const struct qstr *);

struct page *new_node_page(struct dnode_of_data *, unsigned int);

struct page *new_node_page(struct dnode_of_data *, unsigned int, struct page *);

void ra_node_page(struct f2fs_sb_info *, nid_t);

struct page *get_node_page(struct f2fs_sb_info *, pgoff_t);

struct page *get_node_page_ra(struct page *, int);

fs/f2fs/node.c

+8 −4
Original line number Diff line number Diff line
@@ -433,7 +433,7 @@ int get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode) 
			}



			dn->nid = nids[i];

			npage[i] = new_node_page(dn, noffset[i]);

			npage[i] = new_node_page(dn, noffset[i], NULL);

			if (IS_ERR(npage[i])) {

				alloc_nid_failed(sbi, nids[i]);

				err = PTR_ERR(npage[i]);
@@ -814,10 +814,11 @@ struct page *new_inode_page(struct inode *inode, const struct qstr *name) 
	set_new_dnode(&dn, inode, NULL, NULL, inode->i_ino);



	/* caller should f2fs_put_page(page, 1); */

	return new_node_page(&dn, 0);

	return new_node_page(&dn, 0, NULL);

}



struct page *new_node_page(struct dnode_of_data *dn, unsigned int ofs)

struct page *new_node_page(struct dnode_of_data *dn,

				unsigned int ofs, struct page *ipage)

{

	struct f2fs_sb_info *sbi = F2FS_SB(dn->inode->i_sb);

	struct address_space *mapping = sbi->node_inode->i_mapping;
@@ -850,6 +851,9 @@ struct page *new_node_page(struct dnode_of_data *dn, unsigned int ofs) 
	set_cold_node(dn->inode, page);



	dn->node_page = page;

	if (ipage)

		update_inode(dn->inode, ipage);

	else

		sync_inode_page(dn);

	set_page_dirty(page);

	if (ofs == 0)

CRA Git | Maintained and supported by SUSTech CRA and CCSE