Commit 292f902a authored by Miklos Szeredi's avatar Miklos Szeredi
Browse files

ovl: call secutiry hook in ovl_real_ioctl() 



Verify LSM permissions for underlying file, since vfs_ioctl() doesn't do
it.

[Stephen Rothwell] export security_file_ioctl

Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent 56230d95

fs/overlayfs/file.c

+4 −1
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/uio.h>

#include <linux/uaccess.h>

#include <linux/splice.h>

#include <linux/security.h>

#include <linux/mm.h>

#include <linux/fs.h>

#include "overlayfs.h"
@@ -520,6 +521,8 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd, 
		return ret;



	old_cred = ovl_override_creds(file_inode(file)->i_sb);

	ret = security_file_ioctl(real.file, cmd, arg);

	if (!ret)

		ret = vfs_ioctl(real.file, cmd, arg);

	revert_creds(old_cred);

security/security.c

+1 −0
Original line number Diff line number Diff line
@@ -1459,6 +1459,7 @@ int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
{

	return call_int_hook(file_ioctl, 0, file, cmd, arg);

}

EXPORT_SYMBOL_GPL(security_file_ioctl);



static inline unsigned long mmap_prot(struct file *file, unsigned long prot)

{