Commit 9d8f13ba authored by Mimi Zohar's avatar Mimi Zohar
Browse files

security: new security_inode_init_security API adds function callback 



This patch changes the security_inode_init_security API by adding a
filesystem specific callback to write security extended attributes.
This change is in preparation for supporting the initialization of
multiple LSM xattrs and the EVM xattr.  Initially the callback function
walks an array of xattrs, writing each xattr separately, but could be
optimized to write multiple xattrs at once.

For existing security_inode_init_security() calls, which have not yet
been converted to use the new callback function, such as those in
reiserfs and ocfs2, this patch defines security_old_inode_init_security().

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent 0f2a55d5

fs/btrfs/xattr.c

+25 −25
Original line number Diff line number Diff line
@@ -360,36 +360,36 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) 
				XATTR_REPLACE);

}



int btrfs_xattr_security_init(struct btrfs_trans_handle *trans,

			      struct inode *inode, struct inode *dir,

			      const struct qstr *qstr)

int btrfs_initxattrs(struct inode *inode, const struct xattr *xattr_array,

		     void *fs_info)

{

	int err;

	size_t len;

	void *value;

	char *suffix;

	const struct xattr *xattr;

	struct btrfs_trans_handle *trans = fs_info;

	char *name;

	int err = 0;



	err = security_inode_init_security(inode, dir, qstr, &suffix, &value,

					   &len);

	if (err) {

		if (err == -EOPNOTSUPP)

			return 0;

		return err;

	}



	name = kmalloc(XATTR_SECURITY_PREFIX_LEN + strlen(suffix) + 1,

		       GFP_NOFS);

	for (xattr = xattr_array; xattr->name != NULL; xattr++) {

		name = kmalloc(XATTR_SECURITY_PREFIX_LEN +

			       strlen(xattr->name) + 1, GFP_NOFS);

		if (!name) {

			err = -ENOMEM;

	} else {

			break;

		}

		strcpy(name, XATTR_SECURITY_PREFIX);

		strcpy(name + XATTR_SECURITY_PREFIX_LEN, suffix);

		err = __btrfs_setxattr(trans, inode, name, value, len, 0);

		strcpy(name + XATTR_SECURITY_PREFIX_LEN, xattr->name);

		err = __btrfs_setxattr(trans, inode, name,

				       xattr->value, xattr->value_len, 0);

		kfree(name);

		if (err < 0)

			break;

	}



	kfree(suffix);

	kfree(value);

	return err;

}



int btrfs_xattr_security_init(struct btrfs_trans_handle *trans,

			      struct inode *inode, struct inode *dir,

			      const struct qstr *qstr)

{

	return security_inode_init_security(inode, dir, qstr,

					    &btrfs_initxattrs, trans);

}

fs/ext2/xattr_security.c

+18 −16
Original line number Diff line number Diff line
@@ -46,28 +46,30 @@ ext2_xattr_security_set(struct dentry *dentry, const char *name, 
			      value, size, flags);

}



int

ext2_init_security(struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

int ext2_initxattrs(struct inode *inode, const struct xattr *xattr_array,

		    void *fs_info)

{

	int err;

	size_t len;

	void *value;

	char *name;

	const struct xattr *xattr;

	int err = 0;



	err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);

	if (err) {

		if (err == -EOPNOTSUPP)

			return 0;

		return err;

	}

	for (xattr = xattr_array; xattr->name != NULL; xattr++) {

		err = ext2_xattr_set(inode, EXT2_XATTR_INDEX_SECURITY,

			     name, value, len, 0);

	kfree(name);

	kfree(value);

				     xattr->name, xattr->value,

				     xattr->value_len, 0);

		if (err < 0)

			break;

	}

	return err;

}



int

ext2_init_security(struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

{

	return security_inode_init_security(inode, dir, qstr,

					    &ext2_initxattrs, NULL);

}



const struct xattr_handler ext2_xattr_security_handler = {

	.prefix	= XATTR_SECURITY_PREFIX,

	.list	= ext2_xattr_security_list,

fs/ext3/xattr_security.c

+20 −16
Original line number Diff line number Diff line
@@ -48,28 +48,32 @@ ext3_xattr_security_set(struct dentry *dentry, const char *name, 
			      name, value, size, flags);

}



int

ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

int ext3_initxattrs(struct inode *inode, const struct xattr *xattr_array,

		    void *fs_info)

{

	int err;

	size_t len;

	void *value;

	char *name;

	const struct xattr *xattr;

	handle_t *handle = fs_info;

	int err = 0;



	err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);

	if (err) {

		if (err == -EOPNOTSUPP)

			return 0;

		return err;

	for (xattr = xattr_array; xattr->name != NULL; xattr++) {

		err = ext3_xattr_set_handle(handle, inode,

					    EXT3_XATTR_INDEX_SECURITY,

					    xattr->name, xattr->value,

					    xattr->value_len, 0);

		if (err < 0)

			break;

	}

	err = ext3_xattr_set_handle(handle, inode, EXT3_XATTR_INDEX_SECURITY,

				    name, value, len, 0);

	kfree(name);

	kfree(value);

	return err;

}



int

ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

{

	return security_inode_init_security(inode, dir, qstr,

					    &ext3_initxattrs, handle);

}



const struct xattr_handler ext3_xattr_security_handler = {

	.prefix	= XATTR_SECURITY_PREFIX,

	.list	= ext3_xattr_security_list,

fs/ext4/xattr_security.c

+20 −16
Original line number Diff line number Diff line
@@ -48,28 +48,32 @@ ext4_xattr_security_set(struct dentry *dentry, const char *name, 
			      name, value, size, flags);

}



int

ext4_init_security(handle_t *handle, struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

int ext4_initxattrs(struct inode *inode, const struct xattr *xattr_array,

		    void *fs_info)

{

	int err;

	size_t len;

	void *value;

	char *name;

	const struct xattr *xattr;

	handle_t *handle = fs_info;

	int err = 0;



	err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);

	if (err) {

		if (err == -EOPNOTSUPP)

			return 0;

		return err;

	for (xattr = xattr_array; xattr->name != NULL; xattr++) {

		err = ext4_xattr_set_handle(handle, inode,

					    EXT4_XATTR_INDEX_SECURITY,

					    xattr->name, xattr->value,

					    xattr->value_len, 0);

		if (err < 0)

			break;

	}

	err = ext4_xattr_set_handle(handle, inode, EXT4_XATTR_INDEX_SECURITY,

				    name, value, len, 0);

	kfree(name);

	kfree(value);

	return err;

}



int

ext4_init_security(handle_t *handle, struct inode *inode, struct inode *dir,

		   const struct qstr *qstr)

{

	return security_inode_init_security(inode, dir, qstr,

					    &ext4_initxattrs, handle);

}



const struct xattr_handler ext4_xattr_security_handler = {

	.prefix	= XATTR_SECURITY_PREFIX,

	.list	= ext4_xattr_security_list,

fs/gfs2/inode.c

+18 −20
Original line number Diff line number Diff line
@@ -624,29 +624,27 @@ fail: 
	return error;

}



static int gfs2_security_init(struct gfs2_inode *dip, struct gfs2_inode *ip,

			      const struct qstr *qstr)

int gfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,

		    void *fs_info)

{

	int err;

	size_t len;

	void *value;

	char *name;

	const struct xattr *xattr;

	int err = 0;



	err = security_inode_init_security(&ip->i_inode, &dip->i_inode, qstr,

					   &name, &value, &len);



	if (err) {

		if (err == -EOPNOTSUPP)

			return 0;

	for (xattr = xattr_array; xattr->name != NULL; xattr++) {

		err = __gfs2_xattr_set(inode, xattr->name, xattr->value,

				       xattr->value_len, 0,

				       GFS2_EATYPE_SECURITY);

		if (err < 0)

			break;

	}

	return err;

}



	err = __gfs2_xattr_set(&ip->i_inode, name, value, len, 0,

			       GFS2_EATYPE_SECURITY);

	kfree(value);

	kfree(name);



	return err;

static int gfs2_security_init(struct gfs2_inode *dip, struct gfs2_inode *ip,

			      const struct qstr *qstr)

{

	return security_inode_init_security(&ip->i_inode, &dip->i_inode, qstr,

					    &gfs2_initxattrs, NULL);

}



/**

CRA Git | Maintained and supported by SUSTech CRA and CCSE