Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

selinux: implement inode_file_[g|s]etattr hooks 

These hooks are called on inode extended attribute retrieval/change.

Cc: selinux@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>

Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-3-c4e3bc35227b@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Andrey Albershteyn 2025-06-30 18:20:13 +02:00 committed by Christian Brauner
parent defdd02d78
commit bd14e462bb
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
security/selinux/hooks.c
View File

@ -3480,6 +3480,18 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap,
return -EACCES; return -EACCES;
} }
static int selinux_inode_file_setattr(struct dentry *dentry,
struct fileattr *fa)
{
return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
}
static int selinux_inode_file_getattr(struct dentry *dentry,
struct fileattr *fa)
{
return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
}
static int selinux_path_notify(const struct path *path, u64 mask, static int selinux_path_notify(const struct path *path, u64 mask,
unsigned int obj_type) unsigned int obj_type)
{ {
@ -7350,6 +7362,8 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr), LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr), LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr), LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
LSM_HOOK_INIT(inode_file_getattr, selinux_inode_file_getattr),
LSM_HOOK_INIT(inode_file_setattr, selinux_inode_file_setattr),
LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl), LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl), LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl), LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),