Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753325Ab3FGILK (ORCPT ); Fri, 7 Jun 2013 04:11:10 -0400 Received: from mailout3.samsung.com ([203.254.224.33]:46011 "EHLO mailout3.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752510Ab3FGIK6 (ORCPT ); Fri, 7 Jun 2013 04:10:58 -0400 X-AuditID: cbfee690-b7f6f6d00000740c-b2-51b195907c73 Message-id: <1370592580.3600.42.camel@kjgkr> Subject: Re: [PATCH 2/2 v2] f2fs: support xattr security labels From: Jaegeuk Kim Reply-to: jaegeuk.kim@samsung.com To: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Date: Fri, 07 Jun 2013 17:09:40 +0900 In-reply-to: <1370584557-20592-2-git-send-email-jaegeuk.kim@samsung.com> References: <1370584557-20592-1-git-send-email-jaegeuk.kim@samsung.com> <1370584557-20592-2-git-send-email-jaegeuk.kim@samsung.com> Organization: samsung Content-type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-GQNmxQQ94a9hxEEMjeIu" X-Mailer: Evolution 3.2.3-0ubuntu6 MIME-version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrFIsWRmVeSWpSXmKPExsVy+t8zfd0JUzcGGrw8pmhxaZG7xZ69J1ks Lu+aw+bA7LF7wWcmj8+b5AKYorhsUlJzMstSi/TtErgyXq6ax1iw1qFi41GRBsYWsy5GTg4J AROJEw/eMULYYhIX7q1n62Lk4hASWMYo0fz3HnsXIwdYUfMmYYj4IkaJtRf72CGc14wSTy9P ZgLp5hXQkTh27iYziC0sYC9xYtkvFpBmNgFtic37DUDCQgKKEm/332UFCYsA2ZffO4GYzAIe EruOlYJUsAioSnx6c5AVxOYECl86c5IRYlMro8Tc9n9sIAl+AVGJk62fwG5mFqiS6L3xngni fiWJ3e2d7BDXCEr8mHyPBaRZQuAru8T1FZPZITYISHybfIgF4i9ZiU0HmCF6JSUOrrjBMoFR fBaSsbOQjIKIa0q0bv/NDmFrSyxb+JoZwraVWLfuPVSNjcSmqwsYIWx5ie1v5zAvYGRfxSia WpBcUJyUXmSiV5yYW1yal66XnJ+7iRESoRN2MN47YH2IsQroxInMUqLJ+cAIzyuJNzQ2M7Iw NTE1NjK3NKOKsJI4r3qLdaCQQHpiSWp2ampBalF8UWlOavEhRiYOTqkGRu+3DJJ97Y0TuZg0 GJmP5C/1+JyySLh+83fWWIny59bMO23ZuF0+tJ4+cvHoiUe6t6RLbnb9/Jr95OFy0a9n90Tv uW5akT6VU6BUUlRy0t9w23MeGbq2cxV+7nK1i5977HpVTKV3o8njnDkqCSx6r4XfFu9x7Dvf dq+P1eu0pZ7FnJkz+48oKrEUZyQaajEXFScCAC1S3nX9AgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNKsWRmVeSWpSXmKPExsVy+t9jAd0JUzcGGuxcJWNxaZG7xZ69J1ks Lu+aw+bA7LF7wWcmj8+b5AKYohoYbTJSE1NSixRS85LzUzLz0m2VvIPjneNNzQwMdQ0tLcyV FPISc1NtlVx8AnTdMnOAdigplCXmlAKFAhKLi5X07TBNCA1x07WAaYzQ9Q0JgusxMkADCesY M16umsdYsNahYuNRkQbGFrMuRg4OCQETieZNwl2MnECmmMSFe+vZuhi5OIQEFjFKrL3Yxw7h vGaUeHp5MhNIFa+AjsSxczeZQWxhAXuJE8t+sYAMYhPQlti83wAkLCSgKPF2/11WkLAIkH35 vROIySzgIbHrWClIBYuAqsSnNwdZQWxOoPClMycZITa1MkrMbf/HBpLgFxCVONn6iRHEZhao kui98Z4J4k4lid3tnewQ1whK/Jh8j2UCo+AsJGWzkKQg4poSrdt/s0PY2hLLFr5mhrBtJdat ew9VYyOx6eoCRghbXmL72znMCxjZVzGKphYkFxQnpeca6RUn5haX5qXrJefnbmIEx/8z6R2M qxosDjEKcDAq8fD+WLUhUIg1say4MvcQowrQnEcbVl9glGLJy89LVRLhXZ+2MVCINyWxsiq1 KD++qDQntfgQ40RGYHhMZJYSTc4HJq28knhDYxMzI0sjMwsjE3NzWgorifMebLUOFBJITyxJ zU5NLUgtgjmKiYNTqoFx2a1VVo1/XNfM22Y95UlW2e1palJrj7hoTr4tdOGw/krVWe+u/u65 2JoctO3mZl23j4v2rvt7bN8bm7NHf5Xmduf83Oa/rvnbwvhv0kn5L9hYM163/efb0W30Ps8r 5/uESW85xTdfeZZwtnePz42Fl/m77u35sJJxEff3SLeM71u2hcTNWleX8V+JpTgj0VCLuag4 EQCqAUYJfgMAAA== DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 8211 Lines: 278 --=-GQNmxQQ94a9hxEEMjeIu Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Change log from v1: o fix a bug =46rom 901aea226653e26aa3556edd88ca1e48fa89eb5f Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Mon, 3 Jun 2013 19:46:19 +0900 Subject: [PATCH 2/2] f2fs: support xattr security labels Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-f2fs= -devel@lists.sourceforge.net This patch adds the support of security labels for f2fs, which will be used by SElinux. Signed-off-by: Jaegeuk Kim --- fs/f2fs/Kconfig | 9 +++++++++ fs/f2fs/dir.c | 5 +++++ fs/f2fs/xattr.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++= ++-- fs/f2fs/xattr.h | 12 +++++++++++- 4 files changed, 83 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/Kconfig b/fs/f2fs/Kconfig index fd27e7e..2214cc9 100644 --- a/fs/f2fs/Kconfig +++ b/fs/f2fs/Kconfig @@ -51,3 +51,12 @@ config F2FS_FS_POSIX_ACL Linux website . =20 If you don't know what Access Control Lists are, say N + +config F2FS_FS_SECURITY + bool "F2FS Security Labels" + depends on F2FS_FS_XATTR + help + Security labels provide acls used by the security modules + like SELinux. This option should be used with the xattr mode. + + If you are not using a security module, say N. diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c index 67e2d13..81a1d6f 100644 --- a/fs/f2fs/dir.c +++ b/fs/f2fs/dir.c @@ -13,6 +13,7 @@ #include "f2fs.h" #include "node.h" #include "acl.h" +#include "xattr.h" =20 static unsigned long dir_blocks(struct inode *inode) { @@ -334,6 +335,10 @@ static struct page *init_inode_metadata(struct inode *= inode, if (err) goto error; =20 + err =3D f2fs_init_security(inode, dir, name); + if (err) + goto error; + wait_on_page_writeback(page); } else { page =3D get_node_page(F2FS_SB(dir->i_sb), inode->i_ino); diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index ae61f35..67ef1a5 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -20,6 +20,7 @@ */ #include #include +#include #include "f2fs.h" #include "xattr.h" =20 @@ -43,6 +44,10 @@ static size_t f2fs_xattr_generic_list(struct dentry *den= try, char *list, prefix =3D XATTR_TRUSTED_PREFIX; prefix_len =3D XATTR_TRUSTED_PREFIX_LEN; break; + case F2FS_XATTR_INDEX_SECURITY: + prefix =3D XATTR_SECURITY_PREFIX; + prefix_len =3D XATTR_SECURITY_PREFIX_LEN; + break; default: return -EINVAL; } @@ -70,13 +75,14 @@ static int f2fs_xattr_generic_get(struct dentry *dentry= , const char *name, if (!capable(CAP_SYS_ADMIN)) return -EPERM; break; + case F2FS_XATTR_INDEX_SECURITY: + break; default: return -EINVAL; } if (strcmp(name, "") =3D=3D 0) return -EINVAL; - return f2fs_getxattr(dentry->d_inode, type, name, - buffer, size); + return f2fs_getxattr(dentry->d_inode, type, name, buffer, size); } =20 static int f2fs_xattr_generic_set(struct dentry *dentry, const char *name, @@ -93,6 +99,8 @@ static int f2fs_xattr_generic_set(struct dentry *dentry, = const char *name, if (!capable(CAP_SYS_ADMIN)) return -EPERM; break; + case F2FS_XATTR_INDEX_SECURITY: + break; default: return -EINVAL; } @@ -145,6 +153,40 @@ static int f2fs_xattr_advise_set(struct dentry *dentry= , const char *name, return 0; } =20 +#ifdef CONFIG_F2FS_FS_SECURITY +static int f2fs_initxattrs(struct inode *inode, const struct xattr *xattr_= array, + void *fs_info) +{ + const struct xattr *xattr; + char *name; + int err =3D 0; + + for (xattr =3D xattr_array; xattr->name !=3D NULL; xattr++) { + name =3D kmalloc(XATTR_SECURITY_PREFIX_LEN + + strlen(xattr->name) + 1, GFP_NOFS); + if (!name) { + err =3D -ENOMEM; + break; + } + strcpy(name, XATTR_SECURITY_PREFIX); + strcpy(name + XATTR_SECURITY_PREFIX_LEN, xattr->name); + err =3D f2fs_setxattr(inode, F2FS_XATTR_INDEX_SECURITY, name, + xattr->value, xattr->value_len); + kfree(name); + if (err < 0) + break; + } + return err; +} + +int f2fs_init_security(struct inode *inode, struct inode *dir, + const struct qstr *qstr) +{ + return security_inode_init_security(inode, dir, qstr, + &f2fs_initxattrs, NULL); +} +#endif + const struct xattr_handler f2fs_xattr_user_handler =3D { .prefix =3D XATTR_USER_PREFIX, .flags =3D F2FS_XATTR_INDEX_USER, @@ -169,6 +211,14 @@ const struct xattr_handler f2fs_xattr_advise_handler = =3D { .set =3D f2fs_xattr_advise_set, }; =20 +const struct xattr_handler f2fs_xattr_security_handler =3D { + .prefix =3D XATTR_SECURITY_PREFIX, + .flags =3D F2FS_XATTR_INDEX_SECURITY, + .list =3D f2fs_xattr_generic_list, + .get =3D f2fs_xattr_generic_get, + .set =3D f2fs_xattr_generic_set, +}; + static const struct xattr_handler *f2fs_xattr_handler_map[] =3D { [F2FS_XATTR_INDEX_USER] =3D &f2fs_xattr_user_handler, #ifdef CONFIG_F2FS_FS_POSIX_ACL @@ -176,6 +226,9 @@ static const struct xattr_handler *f2fs_xattr_handler_m= ap[] =3D { [F2FS_XATTR_INDEX_POSIX_ACL_DEFAULT] =3D &f2fs_xattr_acl_default_handler, #endif [F2FS_XATTR_INDEX_TRUSTED] =3D &f2fs_xattr_trusted_handler, +#ifdef CONFIG_F2FS_FS_SECURITY + [F2FS_XATTR_INDEX_SECURITY] =3D &f2fs_xattr_security_handler, +#endif [F2FS_XATTR_INDEX_ADVISE] =3D &f2fs_xattr_advise_handler, }; =20 @@ -186,6 +239,9 @@ const struct xattr_handler *f2fs_xattr_handlers[] =3D { &f2fs_xattr_acl_default_handler, #endif &f2fs_xattr_trusted_handler, +#ifdef CONFIG_F2FS_FS_SECURITY + &f2fs_xattr_security_handler, +#endif &f2fs_xattr_advise_handler, NULL, }; diff --git a/fs/f2fs/xattr.h b/fs/f2fs/xattr.h index 49c9558..14e1329 100644 --- a/fs/f2fs/xattr.h +++ b/fs/f2fs/xattr.h @@ -112,6 +112,7 @@ extern const struct xattr_handler f2fs_xattr_trusted_ha= ndler; extern const struct xattr_handler f2fs_xattr_acl_access_handler; extern const struct xattr_handler f2fs_xattr_acl_default_handler; extern const struct xattr_handler f2fs_xattr_advise_handler; +extern const struct xattr_handler f2fs_xattr_security_handler; =20 extern const struct xattr_handler *f2fs_xattr_handlers[]; =20 @@ -121,7 +122,6 @@ extern int f2fs_getxattr(struct inode *inode, int name_= index, const char *name, void *buffer, size_t buffer_size); extern ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size); - #else =20 #define f2fs_xattr_handlers NULL @@ -142,4 +142,14 @@ static inline ssize_t f2fs_listxattr(struct dentry *de= ntry, char *buffer, } #endif =20 +#ifdef CONFIG_F2FS_FS_SECURITY +extern int f2fs_init_security(struct inode *inode, struct inode *dir, + const struct qstr *qstr); +#else +static inline int f2fs_init_security(struct inode *inode, struct inode *di= r, + const struct qstr *qstr) +{ + return 0; +} +#endif #endif /* __F2FS_XATTR_H__ */ --=20 1.8.1.3.566.gaa39828 --=20 Jaegeuk Kim Samsung --=-GQNmxQQ94a9hxEEMjeIu Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAABAgAGBQJRsZVEAAoJEEAUqH6CSFDSYVUP/1lBZ5ig2fnxKW33HWdSn4Oo Em+XzgrSqDzihfUWaPQvfgXiwiYDlW32EnOK0szK5IWrGMF+nJ5EaB+/jklZPspv 0uPXIe2wtygEj2jpWo407NWfF5KmRA1NWWR60kS8Ft2Nb5MzrAWcXGIDTWGcosUb 0egYVjbkPwwjFA6/XeTqW77i6SqT2XjV5IEoinjiQXRyy+O9g2+oZM+ChhzaE5Ms IXeFGKFcw9qqeOolPpdlp9w0frPD8nf3EcvcOGAza+AdH6gioUM3kzAU+Uq6VmMD eG3MAVgGI1HEeM3Wrwxze5D86s7qIJe78fdNW1tAmLiQZ4ZZIG8YoRpGDp7e98CJ /FCQybDoLrQ1Xfn+2BhtkAJOWakICcPBwuTlip5Mr/O4yW1wrDHInwiZMThX5DXh 8/1mxNL3/Kpsae371gfiI0ltyVSSeH/2oZc7Dw2wI3hBQeqYDsCVaCKurozJqOLM ctp3jhA1sWIwECnxdFInpijIAoyLFCh4Bgjk8wJ/dGrHgoiM+lcHmVZohwH3A9BV jrm1b39vgMIrFMXlOjba7uvNb1vNAdwXvdLdaVm/g+vJXrTgd5kyeUY6qiDh9CjJ mfuZQYYYaJFTAAdBuZC8jeuxcCjA5oo8C97i5b4HSMMI9Pt9A9zy5HpHweI1nq+k K41w3Dq8Fz7x9u/ZBQD5 =nwz2 -----END PGP SIGNATURE----- --=-GQNmxQQ94a9hxEEMjeIu-- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/