lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SECURITY: Move exec_permission RCU checks into security modules

Browse Source 
Right now all RCU walks fall back to reference walk when CONFIG_SECURITY
is enabled, even though just the standard capability module is active.
This is because security_inode_exec_permission unconditionally fails
RCU walks.

Move this decision to the low level security module. This requires
passing the RCU flags down the security hook. This way at least
the capability module and a few easy cases in selinux/smack work
with RCU walks with CONFIG_SECURITY=y

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Andi Kleen
2011-04-21 17:23:19 -07:00
committed by Linus Torvalds
parent 8d082f8f3f
commit 8c9e80ed27
5 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/selinux/hooks.c
View File

@@ -2635,7 +2635,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
return dentry_has_perm(cred, NULL, dentry, FILE__READ);
}
static int selinux_inode_permission(struct inode *inode, int mask)
static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
{
const struct cred *cred = current_cred();
struct common_audit_data ad;
@@ -2649,6 +2649,10 @@ static int selinux_inode_permission(struct inode *inode, int mask)
if (!mask)
return 0;
/* May be droppable after audit */
if (flags & IPERM_FLAG_RCU)
return -ECHILD;
COMMON_AUDIT_DATA_INIT(&ad, FS);
ad.u.fs.inode = inode;