Re: [PATCH v2 12/25] security: Introduce inode_post_setattr hook
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2023-08-31 22:29:07
Also in:
keyrings, linux-fsdevel, linux-integrity, linux-nfs, lkml, selinux
On 8/31/2023 3:41 AM, Roberto Sassu wrote:
From: Roberto Sassu <roberto.sassu@huawei.com> In preparation for moving IMA and EVM to the LSM infrastructure, introduce the inode_post_setattr hook.
Would you please include some explanation of how an LSM would use this hook? You might start with a description of how it is used in IMA/EVM, and why that could be generally useful.
quoted hunk ↗ jump to hunk
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> --- fs/attr.c | 1 + include/linux/lsm_hook_defs.h | 2 ++ include/linux/security.h | 7 +++++++ security/security.c | 16 ++++++++++++++++ 4 files changed, 26 insertions(+)diff --git a/fs/attr.c b/fs/attr.c index 431f667726c7..3c309eb456c6 100644 --- a/fs/attr.c +++ b/fs/attr.c@@ -486,6 +486,7 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry, if (!error) { fsnotify_change(dentry, ia_valid); + security_inode_post_setattr(idmap, dentry, ia_valid); ima_inode_post_setattr(idmap, dentry, ia_valid); evm_inode_post_setattr(idmap, dentry, ia_valid); }diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index fdf075a6b1bb..995d30336cfa 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h@@ -136,6 +136,8 @@ LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode, LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask) LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry, struct iattr *attr) +LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap, + struct dentry *dentry, int ia_valid) LSM_HOOK(int, 0, inode_getattr, const struct path *path) LSM_HOOK(int, 0, inode_setxattr, struct mnt_idmap *idmap, struct dentry *dentry, const char *name, const void *value,diff --git a/include/linux/security.h b/include/linux/security.h index dcb3604ffab8..820899db5276 100644 --- a/include/linux/security.h +++ b/include/linux/security.h@@ -355,6 +355,8 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode, int security_inode_permission(struct inode *inode, int mask); int security_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry, struct iattr *attr); +void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + int ia_valid); int security_inode_getattr(const struct path *path); int security_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *name,@@ -856,6 +858,11 @@ static inline int security_inode_setattr(struct mnt_idmap *idmap, return 0; } +static inline void +security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + int ia_valid) +{ } + static inline int security_inode_getattr(const struct path *path) { return 0;diff --git a/security/security.c b/security/security.c index 2b24d01cf181..764a6f28b3b9 100644 --- a/security/security.c +++ b/security/security.c@@ -2124,6 +2124,22 @@ int security_inode_setattr(struct mnt_idmap *idmap, } EXPORT_SYMBOL_GPL(security_inode_setattr); +/** + * security_inode_post_setattr() - Update the inode after a setattr operation + * @idmap: idmap of the mount + * @dentry: file + * @ia_valid: file attributes set + * + * Update inode security field after successful setting file attributes. + */ +void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + int ia_valid) +{ + if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) + return; + call_void_hook(inode_post_setattr, idmap, dentry, ia_valid); +} + /** * security_inode_getattr() - Check if getting file attributes is allowed * @path: file