Re: [PATCH v2 -next 08/18] LSM: pass struct path to the inode fileattr hooks

The inode_file_getattr and inode_file_setattr hooks are called from
vfs_fileattr_get() and vfs_fileattr_set(), whose callers -- the
FS_IOC_GETFLAGS, FS_IOC_SETFLAGS, FS_IOC_FSGETXATTR and
FS_IOC_FSSETXATTR ioctls and the file_getattr(2) and file_setattr(2)
syscalls -- all operate on a struct file or a struct path and had to
derive the dentry and the idmap from it just for the fileattr helpers
and the hooks.  Switch the helpers and the hooks, along with their
SELinux implementations, to take a const struct path.

vfs_fileattr_get() and vfs_fileattr_set() are also called to forward
fileattr operations to underlying inodes.  Such internal forwards are
performed with kernel-side credentials (e.g. overlayfs uses its
superblock creator credentials) and the user-facing operation was
already checked by the hooks, so they must not invoke the security
hooks a second time.  Add __vfs_fileattr_get() and __vfs_fileattr_set()
[ ... ]
hook-checked vfs_fileattr_get() and vfs_fileattr_set(), passing the
struct path it already holds directly.

Assisted-by: opencode: glm-5.3
Signed-off-by: Cai Xinchen <redacted>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015125425.3246251-1-caixinchen1@huawei.com?part=8