2023-03-03 18:23:04

by Roberto Sassu

Subject: [PATCH 18/28] security: Introduce path_post_mknod hook

From: Roberto Sassu <[email protected]>

In preparation for moving IMA and EVM to the LSM infrastructure, introduce
the path_post_mknod hook.

Signed-off-by: Roberto Sassu <[email protected]>
---
fs/namei.c | 2 ++
include/linux/lsm_hook_defs.h | 3 +++
include/linux/security.h | 9 +++++++++
security/security.c | 19 +++++++++++++++++++
4 files changed, 33 insertions(+)

diff --git a/fs/namei.c b/fs/namei.c
index 41f7fdf4657..3f2747521d3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3980,6 +3980,8 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode,
dentry, mode, 0);
break;
}
+ if (!error)
+ security_path_post_mknod(idmap, &path, dentry, mode, dev);
out2:
done_path_create(&path, dentry);
if (retry_estale(error, lookup_flags)) {
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 4580912051a..32c801a3ea2 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -93,6 +93,9 @@ LSM_HOOK(int, 0, path_mkdir, const struct path *dir, struct dentry *dentry,
LSM_HOOK(int, 0, path_rmdir, const struct path *dir, struct dentry *dentry)
LSM_HOOK(int, 0, path_mknod, const struct path *dir, struct dentry *dentry,
umode_t mode, unsigned int dev)
+LSM_HOOK(void, LSM_RET_VOID, path_post_mknod, struct mnt_idmap *idmap,
+ const struct path *dir, struct dentry *dentry, umode_t mode,
+ unsigned int dev)
LSM_HOOK(int, 0, path_truncate, const struct path *path)
LSM_HOOK(int, 0, path_symlink, const struct path *dir, struct dentry *dentry,
const char *old_name)
diff --git a/include/linux/security.h b/include/linux/security.h
index 88e88280f7d..fb6e9d434c6 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1835,6 +1835,9 @@ int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t m
int security_path_rmdir(const struct path *dir, struct dentry *dentry);
int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
unsigned int dev);
+void security_path_post_mknod(struct mnt_idmap *idmap, const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev);
int security_path_truncate(const struct path *path);
int security_path_symlink(const struct path *dir, struct dentry *dentry,
const char *old_name);
@@ -1869,6 +1872,12 @@ static inline int security_path_mknod(const struct path *dir, struct dentry *den
return 0;
}

+static inline void security_path_post_mknod(struct mnt_idmap *idmap,
+ const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev)
+{ }
+
static inline int security_path_truncate(const struct path *path)
{
return 0;
diff --git a/security/security.c b/security/security.c
index 6cbbb4289f7..f5f367e2064 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1753,6 +1753,25 @@ int security_path_mknod(const struct path *dir, struct dentry *dentry,
}
EXPORT_SYMBOL(security_path_mknod);

+/**
+ * security_path_post_mknod() - Update inode security field after file creation
+ * @idmap: idmap of the mount
+ * @dir: parent directory
+ * @dentry: new file
+ * @mode: new file mode
+ * @dev: device number
+ *
+ * Update inode security field after a file has been created.
+ */
+void security_path_post_mknod(struct mnt_idmap *idmap, const struct path *dir,
+ struct dentry *dentry, umode_t mode,
+ unsigned int dev)
+{
+ if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
+ return;
+ call_void_hook(path_post_mknod, idmap, dir, dentry, mode, dev);
+}
+
/**
* security_path_mkdir() - Check if creating a new directory is allowed
* @dir: parent directory
--
2.25.1

2023-03-06 19:29:42

by Stefan Berger

Subject: Re: [PATCH 18/28] security: Introduce path_post_mknod hook

On 3/3/23 13:18, Roberto Sassu wrote:
> From: Roberto Sassu <[email protected]>
>
> In preparation for moving IMA and EVM to the LSM infrastructure, introduce
> the path_post_mknod hook.
>
> Signed-off-by: Roberto Sassu <[email protected]>

Reviewed-by: Stefan Berger <[email protected]>

2023-03-08 15:49:25

by Mimi Zohar

Subject: Re: [PATCH 18/28] security: Introduce path_post_mknod hook

Hi Roberto,

On Fri, 2023-03-03 at 19:18 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <[email protected]>
>
> In preparation for moving IMA and EVM to the LSM infrastructure, introduce
> the path_post_mknod hook.
>
> Signed-off-by: Roberto Sassu <[email protected]>
> ---
> fs/namei.c | 2 ++
> include/linux/lsm_hook_defs.h | 3 +++
> include/linux/security.h | 9 +++++++++
> security/security.c | 19 +++++++++++++++++++
> 4 files changed, 33 insertions(+)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index 41f7fdf4657..3f2747521d3 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -3980,6 +3980,8 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode,
> dentry, mode, 0);
> break;
> }
> + if (!error)
> + security_path_post_mknod(idmap, &path, dentry, mode, dev);

Even though the original code uses "if (!error) ...", consider using
"if (error) goto ..." here.

--
thanks,

Mimi