Commit 757cbe59 authored by Al Viro's avatar Al Viro

LSM: new method: ->sb_add_mnt_opt()

Adding options to growing mnt_opts.  NFS kludge with passing
context= down into non-text-options mount switched to it, and
with that the last use of ->sb_parse_opts_str() is gone.
Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 99dbbb59
...@@ -2070,14 +2070,9 @@ static int nfs23_validate_mount_data(void *options, ...@@ -2070,14 +2070,9 @@ static int nfs23_validate_mount_data(void *options,
if (data->context[0]){ if (data->context[0]){
#ifdef CONFIG_SECURITY_SELINUX #ifdef CONFIG_SECURITY_SELINUX
int rc; int rc;
char *opts_str = kmalloc(sizeof(data->context) + 8, GFP_KERNEL);
if (!opts_str)
return -ENOMEM;
strcpy(opts_str, "context=");
data->context[NFS_MAX_CONTEXT_LEN] = '\0'; data->context[NFS_MAX_CONTEXT_LEN] = '\0';
strcat(opts_str, &data->context[0]); rc = security_add_mnt_opt("context", data->context,
rc = security_sb_parse_opts_str(opts_str, &args->lsm_opts); strlen(data->context), &args->lsm_opts);
kfree(opts_str);
if (rc) if (rc)
return rc; return rc;
#else #else
......
...@@ -1479,7 +1479,8 @@ union security_list_options { ...@@ -1479,7 +1479,8 @@ union security_list_options {
struct super_block *newsb, struct super_block *newsb,
unsigned long kern_flags, unsigned long kern_flags,
unsigned long *set_kern_flags); unsigned long *set_kern_flags);
int (*sb_parse_opts_str)(char *options, void **mnt_opts); int (*sb_add_mnt_opt)(const char *option, const char *val, int len,
void **mnt_opts);
int (*dentry_init_security)(struct dentry *dentry, int mode, int (*dentry_init_security)(struct dentry *dentry, int mode,
const struct qstr *name, void **ctx, const struct qstr *name, void **ctx,
u32 *ctxlen); u32 *ctxlen);
...@@ -1812,7 +1813,7 @@ struct security_hook_heads { ...@@ -1812,7 +1813,7 @@ struct security_hook_heads {
struct hlist_head sb_pivotroot; struct hlist_head sb_pivotroot;
struct hlist_head sb_set_mnt_opts; struct hlist_head sb_set_mnt_opts;
struct hlist_head sb_clone_mnt_opts; struct hlist_head sb_clone_mnt_opts;
struct hlist_head sb_parse_opts_str; struct hlist_head sb_add_mnt_opt;
struct hlist_head dentry_init_security; struct hlist_head dentry_init_security;
struct hlist_head dentry_create_files_as; struct hlist_head dentry_create_files_as;
#ifdef CONFIG_SECURITY_PATH #ifdef CONFIG_SECURITY_PATH
......
...@@ -240,7 +240,8 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, ...@@ -240,7 +240,8 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb,
struct super_block *newsb, struct super_block *newsb,
unsigned long kern_flags, unsigned long kern_flags,
unsigned long *set_kern_flags); unsigned long *set_kern_flags);
int security_sb_parse_opts_str(char *options, void **mnt_opts); int security_add_mnt_opt(const char *option, const char *val,
int len, void **mnt_opts);
int security_dentry_init_security(struct dentry *dentry, int mode, int security_dentry_init_security(struct dentry *dentry, int mode,
const struct qstr *name, void **ctx, const struct qstr *name, void **ctx,
u32 *ctxlen); u32 *ctxlen);
...@@ -586,7 +587,8 @@ static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb, ...@@ -586,7 +587,8 @@ static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
return 0; return 0;
} }
static inline int security_sb_parse_opts_str(char *options, void **mnt_opts) static inline int security_add_mnt_opt(const char *option, const char *val,
int len, void **mnt_opts)
{ {
return 0; return 0;
} }
......
...@@ -458,11 +458,13 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, ...@@ -458,11 +458,13 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb,
} }
EXPORT_SYMBOL(security_sb_clone_mnt_opts); EXPORT_SYMBOL(security_sb_clone_mnt_opts);
int security_sb_parse_opts_str(char *options, void **mnt_opts) int security_add_mnt_opt(const char *option, const char *val, int len,
void **mnt_opts)
{ {
return call_int_hook(sb_parse_opts_str, 0, options, mnt_opts); return call_int_hook(sb_add_mnt_opt, -EINVAL,
option, val, len, mnt_opts);
} }
EXPORT_SYMBOL(security_sb_parse_opts_str); EXPORT_SYMBOL(security_add_mnt_opt);
int security_inode_alloc(struct inode *inode) int security_inode_alloc(struct inode *inode)
{ {
......
...@@ -1049,40 +1049,33 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) ...@@ -1049,40 +1049,33 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
return -EINVAL; return -EINVAL;
} }
static int selinux_parse_opts_str(char *options, static int selinux_add_mnt_opt(const char *option, const char *val, int len,
void **mnt_opts) void **mnt_opts)
{ {
char *p = options, *next; int token = Opt_error;
int rc; int rc, i;
/* Standard string-based options. */
for (p = options; *p; p = next) {
int token, len;
char *arg = NULL;
next = strchr(p, '|'); for (i = 0; i < ARRAY_SIZE(tokens); i++) {
if (next) { if (strcmp(option, tokens[i].name) == 0) {
len = next++ - p; token = tokens[i].opt;
} else { break;
len = strlen(p); }
next = p + len;
} }
if (!len) if (token == Opt_error)
continue; return -EINVAL;
token = match_opt_prefix(p, len, &arg); if (token != Opt_seclabel)
if (arg) val = kmemdup_nul(val, len, GFP_KERNEL);
arg = kmemdup_nul(arg, p + len - arg, GFP_KERNEL); rc = selinux_add_opt(token, val, mnt_opts);
rc = selinux_add_opt(token, arg, mnt_opts); if (unlikely(rc)) {
if (rc) { kfree(val);
kfree(arg); if (*mnt_opts) {
selinux_free_mnt_opts(*mnt_opts); selinux_free_mnt_opts(*mnt_opts);
*mnt_opts = NULL; *mnt_opts = NULL;
return rc;
} }
} }
return 0; return rc;
} }
static int show_sid(struct seq_file *m, u32 sid) static int show_sid(struct seq_file *m, u32 sid)
...@@ -6726,7 +6719,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { ...@@ -6726,7 +6719,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(sb_umount, selinux_umount), LSM_HOOK_INIT(sb_umount, selinux_umount),
LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts), LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts), LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str), LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security), LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as), LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
......
...@@ -4629,7 +4629,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { ...@@ -4629,7 +4629,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts), LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts),
LSM_HOOK_INIT(sb_statfs, smack_sb_statfs), LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),
LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts), LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts),
LSM_HOOK_INIT(sb_parse_opts_str, smack_parse_opts_str),
LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds), LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment