diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2018-12-02 05:06:57 +0100 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2018-12-21 17:45:41 +0100 |
| commit | c039bc3c2498724946304a8f964244a9b6af1043 (patch) | |
| tree | ce98ee8e698a28cbaed969460457941e8b34f2e3 /security | |
| parent | LSM: lift parsing LSM options into the caller of ->sb_kern_mount() (diff) | |
| download | linux-c039bc3c2498724946304a8f964244a9b6af1043.tar.xz linux-c039bc3c2498724946304a8f964244a9b6af1043.zip | |
LSM: lift extracting and parsing LSM options into the caller of ->sb_remount()
This paves the way for retaining the LSM options from a common filesystem
mount context during a mount parameter parsing phase to be instituted prior
to actual mount/reconfiguration actions.
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'security')
| -rw-r--r-- | security/security.c | 5 | ||||
| -rw-r--r-- | security/selinux/hooks.c | 47 |
2 files changed, 15 insertions, 37 deletions
diff --git a/security/security.c b/security/security.c index b5fc8e1e849c..3f50beb30fb1 100644 --- a/security/security.c +++ b/security/security.c @@ -390,9 +390,10 @@ int security_sb_copy_data(char *orig, char *copy) } EXPORT_SYMBOL(security_sb_copy_data); -int security_sb_remount(struct super_block *sb, void *data) +int security_sb_remount(struct super_block *sb, + struct security_mnt_opts *opts) { - return call_int_hook(sb_remount, 0, sb, data); + return call_int_hook(sb_remount, 0, sb, opts); } int security_sb_kern_mount(struct super_block *sb, int flags, diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index ba229d4a64d3..ba3e2917bd24 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2812,39 +2812,22 @@ out: return rc; } -static int selinux_sb_remount(struct super_block *sb, void *data) +static int selinux_sb_remount(struct super_block *sb, + struct security_mnt_opts *opts) { - int rc, i, *flags; - struct security_mnt_opts opts; - char *secdata, **mount_options; + int i, *flags; + char **mount_options; struct superblock_security_struct *sbsec = sb->s_security; if (!(sbsec->flags & SE_SBINITIALIZED)) return 0; - if (!data) - return 0; - - if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) - return 0; - - security_init_mnt_opts(&opts); - secdata = alloc_secdata(); - if (!secdata) - return -ENOMEM; - rc = selinux_sb_copy_data(data, secdata); - if (rc) - goto out_free_secdata; - - rc = selinux_parse_opts_str(secdata, &opts); - if (rc) - goto out_free_secdata; + mount_options = opts->mnt_opts; + flags = opts->mnt_opts_flags; - mount_options = opts.mnt_opts; - flags = opts.mnt_opts_flags; - - for (i = 0; i < opts.num_mnt_opts; i++) { + for (i = 0; i < opts->num_mnt_opts; i++) { u32 sid; + int rc; if (flags[i] == SBLABEL_MNT) continue; @@ -2855,9 +2838,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data) pr_warn("SELinux: security_context_str_to_sid" "(%s) failed for (dev %s, type %s) errno=%d\n", mount_options[i], sb->s_id, sb->s_type->name, rc); - goto out_free_opts; + return rc; } - rc = -EINVAL; switch (flags[i]) { case FSCONTEXT_MNT: if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) @@ -2880,21 +2862,16 @@ static int selinux_sb_remount(struct super_block *sb, void *data) goto out_bad_option; break; default: - goto out_free_opts; + return -EINVAL; } } + return 0; - rc = 0; -out_free_opts: - security_free_mnt_opts(&opts); -out_free_secdata: - free_secdata(secdata); - return rc; out_bad_option: pr_warn("SELinux: unable to change security options " "during remount (dev %s, type=%s)\n", sb->s_id, sb->s_type->name); - goto out_free_opts; + return -EINVAL; } static int selinux_sb_kern_mount(struct super_block *sb, int flags, |