system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-30 08:20:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

lsm: Refactor return value of LSM hook inode_copy_up_xattr

Browse source 
To be consistent with most LSM hooks, convert the return value of
hook inode_copy_up_xattr to 0 or a negative error code.

Before:
- Hook inode_copy_up_xattr returns 0 when accepting xattr, 1 when
  discarding xattr, -EOPNOTSUPP if it does not know xattr, or any
  other negative error code otherwise.

After:
- Hook inode_copy_up_xattr returns 0 when accepting xattr, *-ECANCELED*
  when discarding xattr, -EOPNOTSUPP if it does not know xattr, or
  any other negative error code otherwise.

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Xu Kuohai 2024-07-24 10:06:59 +08:00 committed by Paul Moore
parent be72a57527
commit 924e19c39e
5 changed files with 12 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
fs/overlayfs/copy_up.c
View file

@ -115,12 +115,12 @@ int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct de
continue;
error = security_inode_copy_up_xattr(old, name);
if (error < 0 && error != -EOPNOTSUPP)
break;
if (error == 1) {
if (error == -ECANCELED) {
error = 0;
continue; /* Discard */
}
if (error < 0 && error != -EOPNOTSUPP)
break;
if (is_posix_acl_xattr(name)) {
error = ovl_copy_acl(OVL_FS(sb), oldpath, new, name);

2
security/integrity/evm/evm_main.c
View file

@ -1000,7 +1000,7 @@ static int evm_inode_copy_up_xattr(struct dentry *src, const char *name)
case EVM_XATTR_HMAC:
case EVM_IMA_XATTR_DIGSIG:
default:
rc = 1; /* discard */
rc = -ECANCELED; /* discard */
}
kfree(xattr_data);

11
security/security.c
View file

@ -2674,19 +2674,14 @@ EXPORT_SYMBOL(security_inode_copy_up);
* lower layer to the union/overlay layer. The caller is responsible for
* reading and writing the xattrs, this hook is merely a filter.
*
* Return: Returns 0 to accept the xattr, 1 to discard the xattr, -EOPNOTSUPP
* if the security module does not know about attribute, or a negative
* error code to abort the copy up.
* Return: Returns 0 to accept the xattr, -ECANCELED to discard the xattr,
* -EOPNOTSUPP if the security module does not know about attribute,
* or a negative error code to abort the copy up.
*/
int security_inode_copy_up_xattr(struct dentry *src, const char *name)
{
int rc;
/*
* The implementation can return 0 (accept the xattr), 1 (discard the
* xattr), -EOPNOTSUPP if it does not know anything about the xattr or
* any other error code in case of an error.
*/
rc = call_int_hook(inode_copy_up_xattr, src, name);
if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
return rc;

4
security/selinux/hooks.c
View file

@ -3531,8 +3531,8 @@ static int selinux_inode_copy_up_xattr(struct dentry *dentry, const char *name)
* xattrs up. Instead, filter out SELinux-related xattrs following
* policy load.
*/
if (selinux_initialized() && strcmp(name, XATTR_NAME_SELINUX) == 0)
return 1; /* Discard */
if (selinux_initialized() && !strcmp(name, XATTR_NAME_SELINUX))
return -ECANCELED; /* Discard */
/*
* Any other attribute apart from SELINUX is not claimed, supported
* by selinux.

6
security/smack/smack_lsm.c
View file

@ -4910,10 +4910,10 @@ static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
static int smack_inode_copy_up_xattr(struct dentry *src, const char *name)
{
/*
* Return 1 if this is the smack access Smack attribute.
* Return -ECANCELED if this is the smack access Smack attribute.
*/
if (strcmp(name, XATTR_NAME_SMACK) == 0)
return 1;
if (!strcmp(name, XATTR_NAME_SMACK))
return -ECANCELED;
return -EOPNOTSUPP;
}