Commit 49b7b8de authored by Eric Paris's avatar Eric Paris Committed by James Morris

selinux: place open in the common file perms

kernel can dynamically remap perms.  Drop the open lookup table and put open
in the common file perms.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarStephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent b782e0a6
...@@ -1776,27 +1776,9 @@ static inline u32 open_file_to_av(struct file *file) ...@@ -1776,27 +1776,9 @@ static inline u32 open_file_to_av(struct file *file)
{ {
u32 av = file_to_av(file); u32 av = file_to_av(file);
if (selinux_policycap_openperm) { if (selinux_policycap_openperm)
mode_t mode = file->f_path.dentry->d_inode->i_mode; av |= FILE__OPEN;
/*
* lnk files and socks do not really have an 'open'
*/
if (S_ISREG(mode))
av |= FILE__OPEN;
else if (S_ISCHR(mode))
av |= CHR_FILE__OPEN;
else if (S_ISBLK(mode))
av |= BLK_FILE__OPEN;
else if (S_ISFIFO(mode))
av |= FIFO_FILE__OPEN;
else if (S_ISDIR(mode))
av |= DIR__OPEN;
else if (S_ISSOCK(mode))
av |= SOCK_FILE__OPEN;
else
printk(KERN_ERR "SELinux: WARNING: inside %s with "
"unknown mode:%o\n", __func__, mode);
}
return av; return av;
} }
......
...@@ -2,7 +2,8 @@ ...@@ -2,7 +2,8 @@
"getattr", "setattr", "lock", "relabelfrom", "relabelto", "append" "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append"
#define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \
"rename", "execute", "swapon", "quotaon", "mounton", "audit_access" "rename", "execute", "swapon", "quotaon", "mounton", "audit_access", \
"open"
#define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \
"listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \
...@@ -43,22 +44,22 @@ struct security_class_mapping secclass_map[] = { ...@@ -43,22 +44,22 @@ struct security_class_mapping secclass_map[] = {
"quotaget", NULL } }, "quotaget", NULL } },
{ "file", { "file",
{ COMMON_FILE_PERMS, { COMMON_FILE_PERMS,
"execute_no_trans", "entrypoint", "execmod", "open", NULL } }, "execute_no_trans", "entrypoint", "execmod", NULL } },
{ "dir", { "dir",
{ COMMON_FILE_PERMS, "add_name", "remove_name", { COMMON_FILE_PERMS, "add_name", "remove_name",
"reparent", "search", "rmdir", "open", NULL } }, "reparent", "search", "rmdir", NULL } },
{ "fd", { "use", NULL } }, { "fd", { "use", NULL } },
{ "lnk_file", { "lnk_file",
{ COMMON_FILE_PERMS, NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "chr_file", { "chr_file",
{ COMMON_FILE_PERMS, { COMMON_FILE_PERMS,
"execute_no_trans", "entrypoint", "execmod", "open", NULL } }, "execute_no_trans", "entrypoint", "execmod", NULL } },
{ "blk_file", { "blk_file",
{ COMMON_FILE_PERMS, "open", NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "sock_file", { "sock_file",
{ COMMON_FILE_PERMS, "open", NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "fifo_file", { "fifo_file",
{ COMMON_FILE_PERMS, "open", NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "socket", { "socket",
{ COMMON_SOCK_PERMS, NULL } }, { COMMON_SOCK_PERMS, NULL } },
{ "tcp_socket", { "tcp_socket",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment