diff mbox series

[20/28] security: Introduce inode_post_set_acl hook

Message ID	20230303181842.1087717-21-roberto.sassu@huaweicloud.com
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: Roberto Sassu <roberto.sassu@huaweicloud.com> To: viro@zeniv.linux.org.uk, chuck.lever@oracle.com, jlayton@kernel.org, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, dhowells@redhat.com, jarkko@kernel.org, stephen.smalley.work@gmail.com, eparis@parisplace.org, casey@schaufler-ca.com, brauner@kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, selinux@vger.kernel.org, linux-kernel@vger.kernel.org, stefanb@linux.ibm.com, Roberto Sassu <roberto.sassu@huawei.com> Subject: [PATCH 20/28] security: Introduce inode_post_set_acl hook Date: Fri, 3 Mar 2023 19:18:34 +0100 Message-Id: <20230303181842.1087717-21-roberto.sassu@huaweicloud.com> In-Reply-To: <20230303181842.1087717-1-roberto.sassu@huaweicloud.com> References: <20230303181842.1087717-1-roberto.sassu@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	security: Move IMA and EVM to the LSM infrastructure \| [00/28] security: Move IMA and EVM to the LSM infrastructure [01/28] ima: Align ima_inode_post_setattr() definition with LSM infrastructure [02/28] ima: Align ima_post_path_mknod() definition with LSM infrastructure [03/28] ima: Align ima_post_create_tmpfile() definition with LSM infrastructure [04/28] ima: Align ima_file_mprotect() definition with LSM infrastructure [05/28] ima: Align ima_inode_setxattr() definition with LSM infrastructure [06/28] ima: Align ima_inode_removexattr() definition with LSM infrastructure [07/28] ima: Align ima_post_read_file() definition with LSM infrastructure [08/28] evm: Align evm_inode_post_setattr() definition with LSM infrastructure [09/28] evm: Align evm_inode_setxattr() definition with LSM infrastructure [10/28] evm: Align evm_inode_post_setxattr() definition with LSM infrastructure [11/28] evm: Complete description of evm_inode_setattr() [12/28] fs: Fix description of vfs_tmpfile() [13/28] security: Align inode_setattr hook definition with EVM [14/28] security: Introduce inode_post_setattr hook [15/28] security: Introduce inode_post_removexattr hook [16/28] security: Introduce file_post_open hook [17/28] security: Introduce file_pre_free_security hook [18/28] security: Introduce path_post_mknod hook [19/28] security: Introduce inode_post_create_tmpfile hook [20/28] security: Introduce inode_post_set_acl hook [21/28] security: Introduce inode_post_remove_acl hook [22/28] security: Introduce key_post_create_or_update hook [23/28] security: Introduce LSM_ORDER_LAST [24/28] ima: Move to LSM infrastructure [25/28] ima: Move IMA-Appraisal to LSM infrastructure [26/28] evm: Move to LSM infrastructure [27/28] integrity: Move integrity functions to the LSM infrastructure [28/28] integrity: Switch from rbtree to LSM-managed blob for integrity_iint_cache

Commit Message

Roberto Sassu March 3, 2023, 6:18 p.m. UTC

  From: Roberto Sassu <roberto.sassu@huawei.com>

In preparation for moving IMA and EVM to the LSM infrastructure, introduce
the inode_post_set_acl hook.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 fs/posix_acl.c                |  1 +
 include/linux/lsm_hook_defs.h |  2 ++
 include/linux/security.h      |  7 +++++++
 security/security.c           | 17 +++++++++++++++++
 4 files changed, 27 insertions(+)

Comments

Stefan Berger March 6, 2023, 7:45 p.m. UTC | #1

On 3/3/23 13:18, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> In preparation for moving IMA and EVM to the LSM infrastructure, introduce
> the inode_post_set_acl hook.
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>   fs/posix_acl.c                |  1 +
>   include/linux/lsm_hook_defs.h |  2 ++
>   include/linux/security.h      |  7 +++++++
>   security/security.c           | 17 +++++++++++++++++
>   4 files changed, 27 insertions(+)
> 
> diff --git a/fs/posix_acl.c b/fs/posix_acl.c
> index 5a76fb35923..acddf2dff4c 100644
> --- a/fs/posix_acl.c
> +++ b/fs/posix_acl.c
> @@ -1102,6 +1102,7 @@ int vfs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
>   		error = -EOPNOTSUPP;
>   	if (!error) {
>   		fsnotify_xattr(dentry);
> +		security_inode_post_set_acl(dentry, acl_name, kacl);
>   		evm_inode_post_set_acl(dentry, acl_name, kacl);
>   	}
>   
> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> index 5dc2a7c3d9a..9a3e14db0af 100644
> --- a/include/linux/lsm_hook_defs.h
> +++ b/include/linux/lsm_hook_defs.h
> @@ -156,6 +156,8 @@ LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry,
>   	 const char *name)
>   LSM_HOOK(int, 0, inode_set_acl, struct mnt_idmap *idmap,
>   	 struct dentry *dentry, const char *acl_name, struct posix_acl *kacl)
> +LSM_HOOK(void, LSM_RET_VOID, inode_post_set_acl, struct dentry *dentry,
> +	 const char *acl_name, struct posix_acl *kacl)
>   LSM_HOOK(int, 0, inode_get_acl, struct mnt_idmap *idmap,
>   	 struct dentry *dentry, const char *acl_name)
>   LSM_HOOK(int, 0, inode_remove_acl, struct mnt_idmap *idmap,
> diff --git a/include/linux/security.h b/include/linux/security.h
> index b3e201404dc..b0691bf7237 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -366,6 +366,8 @@ int security_inode_setxattr(struct mnt_idmap *idmap,
>   int security_inode_set_acl(struct mnt_idmap *idmap,
>   			   struct dentry *dentry, const char *acl_name,
>   			   struct posix_acl *kacl);
> +void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
> +				 struct posix_acl *kacl);
>   int security_inode_get_acl(struct mnt_idmap *idmap,
>   			   struct dentry *dentry, const char *acl_name);
>   int security_inode_remove_acl(struct mnt_idmap *idmap,
> @@ -893,6 +895,11 @@ static inline int security_inode_set_acl(struct mnt_idmap *idmap,
>   	return 0;
>   }
>   
> +static inline void security_inode_post_set_acl(struct dentry *dentry,
> +					       const char *acl_name,
> +					       struct posix_acl *kacl)
> +{ }
> +
>   static inline int security_inode_get_acl(struct mnt_idmap *idmap,
>   					 struct dentry *dentry,
>   					 const char *acl_name)
> diff --git a/security/security.c b/security/security.c
> index 8883082b686..fc11d70bb02 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -2310,6 +2310,23 @@ int security_inode_set_acl(struct mnt_idmap *idmap,
>   	return evm_inode_set_acl(idmap, dentry, acl_name, kacl);
>   }
>   
> +/**
> + * security_inode_post_set_acl() - Update inode sec after set_acl operation

'sec' because 'security' doesn't let this fit into 80 characters for the line?

Update inode security after set_acl op     :-/
Update inode security after set_acl()      :-)

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

diff mbox series

Patch

diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 5a76fb35923..acddf2dff4c 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -1102,6 +1102,7 @@  int vfs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
 		error = -EOPNOTSUPP;
 	if (!error) {
 		fsnotify_xattr(dentry);
+		security_inode_post_set_acl(dentry, acl_name, kacl);
 		evm_inode_post_set_acl(dentry, acl_name, kacl);
 	}
 
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 5dc2a7c3d9a..9a3e14db0af 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -156,6 +156,8 @@  LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry,
 	 const char *name)
 LSM_HOOK(int, 0, inode_set_acl, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *acl_name, struct posix_acl *kacl)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_set_acl, struct dentry *dentry,
+	 const char *acl_name, struct posix_acl *kacl)
 LSM_HOOK(int, 0, inode_get_acl, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *acl_name)
 LSM_HOOK(int, 0, inode_remove_acl, struct mnt_idmap *idmap,
diff --git a/include/linux/security.h b/include/linux/security.h
index b3e201404dc..b0691bf7237 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -366,6 +366,8 @@  int security_inode_setxattr(struct mnt_idmap *idmap,
 int security_inode_set_acl(struct mnt_idmap *idmap,
 			   struct dentry *dentry, const char *acl_name,
 			   struct posix_acl *kacl);
+void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
+				 struct posix_acl *kacl);
 int security_inode_get_acl(struct mnt_idmap *idmap,
 			   struct dentry *dentry, const char *acl_name);
 int security_inode_remove_acl(struct mnt_idmap *idmap,
@@ -893,6 +895,11 @@  static inline int security_inode_set_acl(struct mnt_idmap *idmap,
 	return 0;
 }
 
+static inline void security_inode_post_set_acl(struct dentry *dentry,
+					       const char *acl_name,
+					       struct posix_acl *kacl)
+{ }
+
 static inline int security_inode_get_acl(struct mnt_idmap *idmap,
 					 struct dentry *dentry,
 					 const char *acl_name)
diff --git a/security/security.c b/security/security.c
index 8883082b686..fc11d70bb02 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2310,6 +2310,23 @@  int security_inode_set_acl(struct mnt_idmap *idmap,
 	return evm_inode_set_acl(idmap, dentry, acl_name, kacl);
 }
 
+/**
+ * security_inode_post_set_acl() - Update inode sec after set_acl operation
+ * @dentry: file
+ * @acl_name: acl name
+ * @kacl: acl struct
+ *
+ * Update inode security field after successful set_acl operation on @dentry.
+ * The posix acls in @kacl are identified by @acl_name.
+ */
+void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
+				 struct posix_acl *kacl)
+{
+	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
+		return;
+	call_void_hook(inode_post_set_acl, dentry, acl_name, kacl);
+}
+
 /**
  * security_inode_get_acl() - Check if reading posix acls is allowed
  * @idmap: idmap of the mount