linux/security/landlock
Mickaël Salaün 63817febd1
landlock: Use f_cred in security_file_open() hook
Use landlock_cred(file->f_cred)->domain instead of
landlock_get_current_domain() in security_file_open() hook
implementation.

This should not change the current behavior but could avoid potential
race conditions in case of current task's credentials change.

This will also ensure consistency with upcoming audit support relying on
file->f_cred.

Add and use a new get_fs_domain() helper to mask non-filesystem domains.

file->f_cred is set by path_openat()/alloc_empty_file()/init_file() just
before calling security_file_alloc().

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240307095203.1467189-1-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2024-03-08 18:22:16 +01:00
..
.kunitconfig landlock: Add support for KUnit tests 2024-02-27 11:21:45 +01:00
common.h landlock: Add support for KUnit tests 2024-02-27 11:21:45 +01:00
cred.c LSM: Identify modules by more than name 2023-11-12 22:54:42 -05:00
cred.h landlock: Format with clang-format 2022-05-09 12:31:10 +02:00
fs.c landlock: Use f_cred in security_file_open() hook 2024-03-08 18:22:16 +01:00
fs.h landlock: Support file truncation 2022-10-19 09:01:44 +02:00
Kconfig landlock: Add support for KUnit tests 2024-02-27 11:21:45 +01:00
limits.h landlock: Support network rules with TCP bind and connect 2023-10-26 21:07:15 +02:00
Makefile landlock: Rename "ptrace" files to "task" 2024-03-08 18:22:16 +01:00
net.c landlock: Simplify current_check_access_socket() 2024-03-08 18:22:13 +01:00
net.h landlock: Support network rules with TCP bind and connect 2023-10-26 21:07:15 +02:00
object.c landlock: Format with clang-format 2022-05-09 12:31:10 +02:00
object.h landlock: Format with clang-format 2022-05-09 12:31:10 +02:00
ruleset.c landlock: Optimize the number of calls to get_access_mask slightly 2024-01-03 12:43:17 +01:00
ruleset.h landlock: Support network rules with TCP bind and connect 2023-10-26 21:07:15 +02:00
setup.c landlock: Rename "ptrace" files to "task" 2024-03-08 18:22:16 +01:00
setup.h LSM: Identify modules by more than name 2023-11-12 22:54:42 -05:00
syscalls.c landlock: Warn once if a Landlock action is requested while disabled 2024-03-07 11:29:46 +01:00
task.c landlock: Rename "ptrace" files to "task" 2024-03-08 18:22:16 +01:00
task.h landlock: Rename "ptrace" files to "task" 2024-03-08 18:22:16 +01:00