• Ondrej Mosnacek's avatar
    LSM: add new hook for kernfs node initialization · b230d5ab
    Ondrej Mosnacek authored
    This patch introduces a new security hook that is intended for
    initializing the security data for newly created kernfs nodes, which
    provide a way of storing a non-default security context, but need to
    operate independently from mounts (and therefore may not have an
    associated inode at the moment of creation).
    
    The main motivation is to allow kernfs nodes to inherit the context of
    the parent under SELinux, similar to the behavior of
    security_inode_init_security(). Other LSMs may implement their own logic
    for handling the creation of new nodes.
    
    This patch also adds helper functions to <linux/kernfs.h> for
    getting/setting security xattrs of a kernfs node so that LSMs hooks are
    able to do their job. Other important attributes should be accessible
    direcly in the kernfs_node fields (in case there is need for more, then
    new helpers should be added to kernfs.h along with the patch that needs
    them).
    Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
    Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    [PM: more manual merge fixes]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    b230d5ab
lsm_hooks.h 91.6 KB