summaryrefslogtreecommitdiff
path: root/fs/xattr.c
diff options
context:
space:
mode:
authorJames Morris <jmorris@namei.org>2005-10-30 14:59:22 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2005-10-30 17:37:11 -0800
commitd381d8a9a08cac9824096213069159be17fd2e2f (patch)
tree0c19722b8f67c29b7c08c6ab8776a9c146395d03 /fs/xattr.c
parent89d155ef62e5e0c10e4b37aaa5056f0beafe10e6 (diff)
downloadlinux-3.10-d381d8a9a08cac9824096213069159be17fd2e2f.tar.gz
linux-3.10-d381d8a9a08cac9824096213069159be17fd2e2f.tar.bz2
linux-3.10-d381d8a9a08cac9824096213069159be17fd2e2f.zip
[PATCH] SELinux: canonicalize getxattr()
This patch allows SELinux to canonicalize the value returned from getxattr() via the security_inode_getsecurity() hook, which is called after the fs level getxattr() function. The purpose of this is to allow the in-core security context for an inode to override the on-disk value. This could happen in cases such as upgrading a system to a different labeling form (e.g. standard SELinux to MLS) without needing to do a full relabel of the filesystem. In such cases, we want getxattr() to return the canonical security context that the kernel is using rather than what is stored on disk. The implementation hooks into the inode_getsecurity(), adding another parameter to indicate the result of the preceding fs-level getxattr() call, so that SELinux knows whether to compare a value obtained from disk with the kernel value. We also now allow getxattr() to work for mountpoint labeled filesystems (i.e. mount with option context=foo_t), as we are able to return the kernel value to the user. Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs/xattr.c')
-rw-r--r--fs/xattr.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/fs/xattr.c b/fs/xattr.c
index 3f9c64bea15..f6e00c0e114 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -143,7 +143,7 @@ getxattr(struct dentry *d, char __user *name, void __user *value, size_t size)
if (size) {
if (size > XATTR_SIZE_MAX)
size = XATTR_SIZE_MAX;
- kvalue = kmalloc(size, GFP_KERNEL);
+ kvalue = kzalloc(size, GFP_KERNEL);
if (!kvalue)
return -ENOMEM;
}
@@ -154,11 +154,15 @@ getxattr(struct dentry *d, char __user *name, void __user *value, size_t size)
error = -EOPNOTSUPP;
if (d->d_inode->i_op && d->d_inode->i_op->getxattr)
error = d->d_inode->i_op->getxattr(d, kname, kvalue, size);
- else if (!strncmp(kname, XATTR_SECURITY_PREFIX,
- sizeof XATTR_SECURITY_PREFIX - 1)) {
+
+ if (!strncmp(kname, XATTR_SECURITY_PREFIX,
+ sizeof XATTR_SECURITY_PREFIX - 1)) {
const char *suffix = kname + sizeof XATTR_SECURITY_PREFIX - 1;
- error = security_inode_getsecurity(d->d_inode, suffix, kvalue,
- size);
+ int rv = security_inode_getsecurity(d->d_inode, suffix, kvalue,
+ size, error);
+ /* Security module active: overwrite error value */
+ if (rv != -EOPNOTSUPP)
+ error = rv;
}
if (error > 0) {
if (size && copy_to_user(value, kvalue, error))