Commit 5289ba41 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] selinux: clean up binary mount data

From: James Morris <jmorris@redhat.com>

selinux is currently inspecting the filesystem name ("nfs" vs "coda" vs
watever) to work out whether it needs to hanbdle binary mount data.

Eliminate all that by adding a flag to file_system_type.fs_flags.
parent ef01bd3f
...@@ -53,6 +53,7 @@ static struct file_system_type afs_fs_type = { ...@@ -53,6 +53,7 @@ static struct file_system_type afs_fs_type = {
.name = "afs", .name = "afs",
.get_sb = afs_get_sb, .get_sb = afs_get_sb,
.kill_sb = kill_anon_super, .kill_sb = kill_anon_super,
.fs_flags = FS_BINARY_MOUNTDATA,
}; };
static struct super_operations afs_super_ops = { static struct super_operations afs_super_ops = {
......
...@@ -309,5 +309,6 @@ struct file_system_type coda_fs_type = { ...@@ -309,5 +309,6 @@ struct file_system_type coda_fs_type = {
.name = "coda", .name = "coda",
.get_sb = coda_get_sb, .get_sb = coda_get_sb,
.kill_sb = kill_anon_super, .kill_sb = kill_anon_super,
.fs_flags = FS_BINARY_MOUNTDATA,
}; };
...@@ -1352,7 +1352,7 @@ static struct file_system_type nfs_fs_type = { ...@@ -1352,7 +1352,7 @@ static struct file_system_type nfs_fs_type = {
.name = "nfs", .name = "nfs",
.get_sb = nfs_get_sb, .get_sb = nfs_get_sb,
.kill_sb = nfs_kill_super, .kill_sb = nfs_kill_super,
.fs_flags = FS_ODD_RENAME|FS_REVAL_DOT, .fs_flags = FS_ODD_RENAME|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
}; };
#ifdef CONFIG_NFS_V4 #ifdef CONFIG_NFS_V4
...@@ -1666,7 +1666,7 @@ static struct file_system_type nfs4_fs_type = { ...@@ -1666,7 +1666,7 @@ static struct file_system_type nfs4_fs_type = {
.name = "nfs4", .name = "nfs4",
.get_sb = nfs4_get_sb, .get_sb = nfs4_get_sb,
.kill_sb = nfs_kill_super, .kill_sb = nfs_kill_super,
.fs_flags = FS_ODD_RENAME|FS_REVAL_DOT, .fs_flags = FS_ODD_RENAME|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
}; };
#define nfs4_zero_state(nfsi) \ #define nfs4_zero_state(nfsi) \
......
...@@ -779,6 +779,7 @@ static struct file_system_type smb_fs_type = { ...@@ -779,6 +779,7 @@ static struct file_system_type smb_fs_type = {
.name = "smbfs", .name = "smbfs",
.get_sb = smb_get_sb, .get_sb = smb_get_sb,
.kill_sb = kill_anon_super, .kill_sb = kill_anon_super,
.fs_flags = FS_BINARY_MOUNTDATA,
}; };
static int __init init_smb_fs(void) static int __init init_smb_fs(void)
......
...@@ -745,7 +745,7 @@ do_kern_mount(const char *fstype, int flags, const char *name, void *data) ...@@ -745,7 +745,7 @@ do_kern_mount(const char *fstype, int flags, const char *name, void *data)
goto out_mnt; goto out_mnt;
} }
error = security_sb_copy_data(fstype, data, secdata); error = security_sb_copy_data(type, data, secdata);
if (error) { if (error) {
sb = ERR_PTR(error); sb = ERR_PTR(error);
goto out_free_secdata; goto out_free_secdata;
......
...@@ -89,6 +89,7 @@ extern int leases_enable, dir_notify_enable, lease_break_time; ...@@ -89,6 +89,7 @@ extern int leases_enable, dir_notify_enable, lease_break_time;
/* public flags for file_system_type */ /* public flags for file_system_type */
#define FS_REQUIRES_DEV 1 #define FS_REQUIRES_DEV 1
#define FS_BINARY_MOUNTDATA 2
#define FS_REVAL_DOT 16384 /* Check the paths ".", ".." for staleness */ #define FS_REVAL_DOT 16384 /* Check the paths ".", ".." for staleness */
#define FS_ODD_RENAME 32768 /* Temporary stuff; will go away as soon #define FS_ODD_RENAME 32768 /* Temporary stuff; will go away as soon
* as nfs_rename() will be cleaned up * as nfs_rename() will be cleaned up
......
...@@ -177,7 +177,7 @@ struct swap_info_struct; ...@@ -177,7 +177,7 @@ struct swap_info_struct;
* options cleanly (a filesystem may modify the data e.g. with strsep()). * options cleanly (a filesystem may modify the data e.g. with strsep()).
* This also allows the original mount data to be stripped of security- * This also allows the original mount data to be stripped of security-
* specific options to avoid having to make filesystems aware of them. * specific options to avoid having to make filesystems aware of them.
* @fstype the type of filesystem being mounted. * @type the type of filesystem being mounted.
* @orig the original mount data copied from userspace. * @orig the original mount data copied from userspace.
* @copy copied data which will be passed to the security module. * @copy copied data which will be passed to the security module.
* Returns 0 if the copy was successful. * Returns 0 if the copy was successful.
...@@ -1033,7 +1033,8 @@ struct security_operations { ...@@ -1033,7 +1033,8 @@ struct security_operations {
int (*sb_alloc_security) (struct super_block * sb); int (*sb_alloc_security) (struct super_block * sb);
void (*sb_free_security) (struct super_block * sb); void (*sb_free_security) (struct super_block * sb);
int (*sb_copy_data)(const char *fstype, void *orig, void *copy); int (*sb_copy_data)(struct file_system_type *type,
void *orig, void *copy);
int (*sb_kern_mount) (struct super_block *sb, void *data); int (*sb_kern_mount) (struct super_block *sb, void *data);
int (*sb_statfs) (struct super_block * sb); int (*sb_statfs) (struct super_block * sb);
int (*sb_mount) (char *dev_name, struct nameidata * nd, int (*sb_mount) (char *dev_name, struct nameidata * nd,
...@@ -1318,9 +1319,10 @@ static inline void security_sb_free (struct super_block *sb) ...@@ -1318,9 +1319,10 @@ static inline void security_sb_free (struct super_block *sb)
security_ops->sb_free_security (sb); security_ops->sb_free_security (sb);
} }
static inline int security_sb_copy_data (const char *fstype, void *orig, void *copy) static inline int security_sb_copy_data (struct file_system_type *type,
void *orig, void *copy)
{ {
return security_ops->sb_copy_data (fstype, orig, copy); return security_ops->sb_copy_data (type, orig, copy);
} }
static inline int security_sb_kern_mount (struct super_block *sb, void *data) static inline int security_sb_kern_mount (struct super_block *sb, void *data)
...@@ -1988,7 +1990,8 @@ static inline int security_sb_alloc (struct super_block *sb) ...@@ -1988,7 +1990,8 @@ static inline int security_sb_alloc (struct super_block *sb)
static inline void security_sb_free (struct super_block *sb) static inline void security_sb_free (struct super_block *sb)
{ } { }
static inline int security_sb_copy_data (const char *fstype, void *orig, void *copy) static inline int security_sb_copy_data (struct file_system_type *type,
void *orig, void *copy)
{ {
return 0; return 0;
} }
......
...@@ -194,7 +194,8 @@ static void dummy_sb_free_security (struct super_block *sb) ...@@ -194,7 +194,8 @@ static void dummy_sb_free_security (struct super_block *sb)
return; return;
} }
static int dummy_sb_copy_data (const char *fstype, void *orig, void *copy) static int dummy_sb_copy_data (struct file_system_type *type,
void *orig, void *copy)
{ {
return 0; return 0;
} }
......
...@@ -331,10 +331,7 @@ static int try_context_mount(struct super_block *sb, void *data) ...@@ -331,10 +331,7 @@ static int try_context_mount(struct super_block *sb, void *data)
name = sb->s_type->name; name = sb->s_type->name;
/* Ignore these fileystems with binary mount option data. */ if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
if (!strcmp(name, "coda") ||
!strcmp(name, "afs") || !strcmp(name, "smbfs"))
goto out;
/* NFS we understand. */ /* NFS we understand. */
if (!strcmp(name, "nfs")) { if (!strcmp(name, "nfs")) {
...@@ -347,9 +344,11 @@ static int try_context_mount(struct super_block *sb, void *data) ...@@ -347,9 +344,11 @@ static int try_context_mount(struct super_block *sb, void *data)
context = d->context; context = d->context;
seen |= Opt_context; seen |= Opt_context;
} }
} else
goto out;
/* Standard string-based options. */
} else { } else {
/* Standard string-based options. */
char *p, *options = data; char *p, *options = data;
while ((p = strsep(&options, ",")) != NULL) { while ((p = strsep(&options, ",")) != NULL) {
...@@ -1885,7 +1884,7 @@ static inline void take_option(char **to, char *from, int *first, int len) ...@@ -1885,7 +1884,7 @@ static inline void take_option(char **to, char *from, int *first, int len)
*to += len; *to += len;
} }
static int selinux_sb_copy_data(const char *fstype, void *orig, void *copy) static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
{ {
int fnosec, fsec, rc = 0; int fnosec, fsec, rc = 0;
char *in_save, *in_curr, *in_end; char *in_save, *in_curr, *in_end;
...@@ -1895,8 +1894,7 @@ static int selinux_sb_copy_data(const char *fstype, void *orig, void *copy) ...@@ -1895,8 +1894,7 @@ static int selinux_sb_copy_data(const char *fstype, void *orig, void *copy)
sec_curr = copy; sec_curr = copy;
/* Binary mount data: just copy */ /* Binary mount data: just copy */
if (!strcmp(fstype, "nfs") || !strcmp(fstype, "coda") || if (type->fs_flags & FS_BINARY_MOUNTDATA) {
!strcmp(fstype, "smbfs") || !strcmp(fstype, "afs")) {
copy_page(sec_curr, in_curr); copy_page(sec_curr, in_curr);
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment