Commit a10d7c22 authored by Al Viro's avatar Al Viro
Browse files

LSM: split ->sb_set_mnt_opts() out of ->sb_kern_mount() 



... leaving the "is it kernel-internal" logics in the caller.

Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent f5c0c26d

fs/super.c

+7 −1
Original line number Diff line number Diff line
@@ -1275,10 +1275,16 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) 
	smp_wmb();

	sb->s_flags |= SB_BORN;



	error = security_sb_kern_mount(sb, flags, &opts);

	error = security_sb_set_mnt_opts(sb, &opts, 0, NULL);

	if (error)

		goto out_sb;



	if (!(flags & MS_KERNMOUNT)) {

		error = security_sb_kern_mount(sb);

		if (error)

			goto out_sb;

	}



	/*

	 * filesystems should never set s_maxbytes larger than MAX_LFS_FILESIZE

	 * but s_maxbytes was an unsigned long long for many releases. Throw

include/linux/lsm_hooks.h

+1 −2
Original line number Diff line number Diff line
@@ -1464,8 +1464,7 @@ union security_list_options { 
	int (*sb_copy_data)(char *orig, char *copy);

	int (*sb_remount)(struct super_block *sb,

			  struct security_mnt_opts *opts);

	int (*sb_kern_mount)(struct super_block *sb, int flags,

			     struct security_mnt_opts *opts);

	int (*sb_kern_mount)(struct super_block *sb);

	int (*sb_show_options)(struct seq_file *m, struct super_block *sb);

	int (*sb_statfs)(struct dentry *dentry);

	int (*sb_mount)(const char *dev_name, const struct path *path,

include/linux/security.h

+2 −4
Original line number Diff line number Diff line
@@ -250,8 +250,7 @@ int security_sb_alloc(struct super_block *sb); 
void security_sb_free(struct super_block *sb);

int security_sb_eat_lsm_opts(char *options, struct security_mnt_opts *opts);

int security_sb_remount(struct super_block *sb, struct security_mnt_opts *opts);

int security_sb_kern_mount(struct super_block *sb, int flags,

			   struct security_mnt_opts *opts);

int security_sb_kern_mount(struct super_block *sb);

int security_sb_show_options(struct seq_file *m, struct super_block *sb);

int security_sb_statfs(struct dentry *dentry);

int security_sb_mount(const char *dev_name, const struct path *path,
@@ -568,8 +567,7 @@ static inline int security_sb_remount(struct super_block *sb, 
	return 0;

}



static inline int security_sb_kern_mount(struct super_block *sb, int flags,

					 struct security_mnt_opts *opts)

static inline int security_sb_kern_mount(struct super_block *sb)

{

	return 0;

}

security/security.c

+2 −3
Original line number Diff line number Diff line
@@ -405,10 +405,9 @@ int security_sb_remount(struct super_block *sb, 
	return call_int_hook(sb_remount, 0, sb, opts);

}



int security_sb_kern_mount(struct super_block *sb, int flags,

			   struct security_mnt_opts *opts)

int security_sb_kern_mount(struct super_block *sb)

{

	return call_int_hook(sb_kern_mount, 0, sb, flags, opts);

	return call_int_hook(sb_kern_mount, 0, sb);

}



int security_sb_show_options(struct seq_file *m, struct super_block *sb)

security/selinux/hooks.c

+1 −9
Original line number Diff line number Diff line
@@ -2874,18 +2874,10 @@ static int selinux_sb_remount(struct super_block *sb, 
	return -EINVAL;

}



static int selinux_sb_kern_mount(struct super_block *sb, int flags,

				 struct security_mnt_opts *opts)

static int selinux_sb_kern_mount(struct super_block *sb)

{

	const struct cred *cred = current_cred();

	struct common_audit_data ad;

	int rc = selinux_set_mnt_opts(sb, opts, 0, NULL);

	if (rc)

		return rc;



	/* Allow all mounts performed by the kernel */

	if (flags & MS_KERNMOUNT)

		return 0;



	ad.type = LSM_AUDIT_DATA_DENTRY;

	ad.u.dentry = sb->s_root;