[PATCH v2 -next 02/18] LSM: pass struct path to the inode_setsecctx hook
flat view
HOTtoday
From: Cai Xinchen <hidden>
Date: 2026-10-15 12:20:00
Also in:
bpf, driver-core, linux-block, linux-cifs, linux-doc, linux-fsdevel, linux-integrity, linux-kselftest, linux-nfs, linux-trace-kernel, linux-unionfs, lkml, netfs, selinux
Subsystem:
filesystems (vfs and infrastructure), kernel nfsd, sunrpc, and lockd servers, security subsystem, selinux security module, smack security module, the rest · Maintainers:
Alexander Viro, Christian Brauner, Chuck Lever, Jeff Layton, Paul Moore, James Morris, "Serge E. Hallyn", Stephen Smalley, Casey Schaufler, Linus Torvalds
Revision v2 of 2 in this series.
Revisions (2)
- rfc [diff vs current]
- v2 current
The inode_setsecctx hook and its security_inode_setsecctx() caller in fs/nfsd operate on a dentry even though both have a struct path available. The SELinux and Smack implementations write the label through __vfs_setxattr_locked(), whose idmap argument they hardcode to &nop_mnt_idmap. Switch the hook to take a const struct path so that the upcoming conversion of the xattr helpers to struct path can be reflected directly in the implementations. For now the implementations keep passing &nop_mnt_idmap together with path->dentry to __vfs_setxattr_locked(), preserving the current behavior; they will be switched to pass the path itself once the xattr helpers take one. Assisted-by: opencode: glm-5.3 Signed-off-by: Cai Xinchen <redacted> --- fs/nfsd/vfs.c | 2 +- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 ++-- security/security.c | 6 +++--- security/selinux/hooks.c | 6 +++--- security/smack/smack_lsm.c | 6 +++--- 6 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 0897b132aa74..4598962b397c 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c@@ -625,7 +625,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, break; } if (attr->na_seclabel && attr->na_seclabel->len) - attr->na_labelerr = security_inode_setsecctx(dentry, + attr->na_labelerr = security_inode_setsecctx(&path, attr->na_seclabel->data, attr->na_seclabel->len); if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && attr->na_dpacl) { if (!S_ISDIR(inode->i_mode))
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index ef16e5343e09..98ce7c814f01 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h@@ -314,7 +314,7 @@ LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid) LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp) LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen) -LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen) +LSM_HOOK(int, 0, inode_setsecctx, const struct path *path, void *ctx, u32 ctxlen) LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, struct lsm_context *cp)
diff --git a/include/linux/security.h b/include/linux/security.h
index 8b8d6b8b802f..26996f546ab2 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h@@ -589,7 +589,7 @@ int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); void security_release_secctx(struct lsm_context *cp); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); -int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); +int security_inode_setsecctx(const struct path *path, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp); int security_locked_down(enum lockdown_reason what); int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
@@ -1637,7 +1637,7 @@ static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u3 { return -EOPNOTSUPP; } -static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) +static inline int security_inode_setsecctx(const struct path *path, void *ctx, u32 ctxlen) { return -EOPNOTSUPP; }
diff --git a/security/security.c b/security/security.c
index da8d48cd0a2a..c9fb7c3380ad 100644
--- a/security/security.c
+++ b/security/security.c@@ -4134,7 +4134,7 @@ EXPORT_SYMBOL(security_inode_notifysecctx); /** * security_inode_setsecctx() - Change the security label of an inode - * @dentry: inode + * @path: inode * @ctx: secctx * @ctxlen: length of secctx *
@@ -4148,9 +4148,9 @@ EXPORT_SYMBOL(security_inode_notifysecctx); * * Return: Returns 0 on success, error on failure. */ -int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) +int security_inode_setsecctx(const struct path *path, void *ctx, u32 ctxlen) { - return call_int_hook(inode_setsecctx, dentry, ctx, ctxlen); + return call_int_hook(inode_setsecctx, path, ctx, ctxlen); } EXPORT_SYMBOL(security_inode_setsecctx);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 51454c411a03..015fc0c01105 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c@@ -7173,10 +7173,10 @@ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen /* * called with inode->i_mutex locked */ -static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) +static int selinux_inode_setsecctx(const struct path *path, void *ctx, u32 ctxlen) { - return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, - ctx, ctxlen, 0, NULL); + return __vfs_setxattr_locked(&nop_mnt_idmap, path->dentry, + XATTR_NAME_SELINUX, ctx, ctxlen, 0, NULL); } static int selinux_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 3524649f402d..953461571026 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c@@ -4978,10 +4978,10 @@ static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) ctxlen, 0); } -static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) +static int smack_inode_setsecctx(const struct path *path, void *ctx, u32 ctxlen) { - return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, - ctx, ctxlen, 0, NULL); + return __vfs_setxattr_locked(&nop_mnt_idmap, path->dentry, + XATTR_NAME_SMACK, ctx, ctxlen, 0, NULL); } static int smack_inode_getsecctx(struct inode *inode, struct lsm_context *cp)
--
2.18.0.huawei.25