qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

LSM: Remove double path_rename hook calls for RENAME_EXCHANGE 

JIRA: https://issues.redhat.com/browse/RHEL-33888
Status: Linus

commit 100f59d964050020285f0c8264ce520f0c406c13
Author: Mickaël Salaün <mic@digikod.net>
Date:   Fri May 6 18:10:56 2022 +0200

    LSM: Remove double path_rename hook calls for RENAME_EXCHANGE

    In order to be able to identify a file exchange with renameat2(2) and
    RENAME_EXCHANGE, which will be useful for Landlock [1], propagate the
    rename flags to LSMs.  This may also improve performance because of the
    switch from two set of LSM hook calls to only one, and because LSMs
    using this hook may optimize the double check (e.g. only one lock,
    reduce the number of path walks).

    AppArmor, Landlock and Tomoyo are updated to leverage this change.  This
    should not change the current behavior (same check order), except
    (different level of) speed boosts.

    [1] https://lore.kernel.org/r/20220221212522.320243-1-mic@digikod.net

    Cc: James Morris <jmorris@namei.org>
    Cc: Kentaro Takeda <takedakn@nttdata.co.jp>
    Cc: Serge E. Hallyn <serge@hallyn.com>
    Acked-by: John Johansen <john.johansen@canonical.com>
    Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reviewed-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Mickaël Salaün <mic@digikod.net>
    Link: https://lore.kernel.org/r/20220506161102.525323-7-mic@digikod.net

Signed-off-by: Ian Kent <ikent@redhat.com>
This commit is contained in:
Ian Kent 2024-05-21 10:31:53 +08:00 committed by Ian Kent
parent 4bff8e036f
commit e33ce01b7a
6 changed files with 48 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/lsm_hook_defs.h
View File

@ -100,7 +100,7 @@ LSM_HOOK(int, 0, path_link, struct dentry *old_dentry,
const struct path *new_dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, path_rename, const struct path *old_dir,
struct dentry *old_dentry, const struct path *new_dir,
struct dentry *new_dentry)
struct dentry *new_dentry, unsigned int flags)
LSM_HOOK(int, 0, path_chmod, const struct path *path, umode_t mode)
LSM_HOOK(int, 0, path_chown, const struct path *path, kuid_t uid, kgid_t gid)
LSM_HOOK(int, 0, path_chroot, const struct path *path)

1
include/linux/lsm_hooks.h
View File

@ -345,6 +345,7 @@
* @old_dentry contains the dentry structure of the old link.
* @new_dir contains the path structure for parent of the new link.
* @new_dentry contains the dentry structure of the new link.
* @flags may contain rename options such as RENAME_EXCHANGE.
* Return 0 if permission is granted.
* @path_chmod:
* Check for permission to change a mode of the file @path. The new

30
security/apparmor/lsm.c
View File

@ -354,13 +354,16 @@ static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_
}
static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
const struct path *new_dir, struct dentry *new_dentry)
const struct path *new_dir, struct dentry *new_dentry,
const unsigned int flags)
{
struct aa_label *label;
int error = 0;
if (!path_mediated_fs(old_dentry))
return 0;
if ((flags & RENAME_EXCHANGE) && !path_mediated_fs(new_dentry))
return 0;
label = begin_current_label_crit_section();
if (!unconfined(label)) {
@ -374,10 +377,27 @@ static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_d
d_backing_inode(old_dentry)->i_mode
};
error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0,
MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
AA_MAY_SETATTR | AA_MAY_DELETE,
&cond);
if (flags & RENAME_EXCHANGE) {
struct path_cond cond_exchange = {
i_uid_into_mnt(mnt_userns, d_backing_inode(new_dentry)),
d_backing_inode(new_dentry)->i_mode
};
error = aa_path_perm(OP_RENAME_SRC, label, &new_path, 0,
MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
AA_MAY_SETATTR | AA_MAY_DELETE,
&cond_exchange);
if (!error)
error = aa_path_perm(OP_RENAME_DEST, label, &old_path,
0, MAY_WRITE | AA_MAY_SETATTR |
AA_MAY_CREATE, &cond_exchange);
}
if (!error)
error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0,
MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
AA_MAY_SETATTR | AA_MAY_DELETE,
&cond);
if (!error)
error = aa_path_perm(OP_RENAME_DEST, label, &new_path,
0, MAY_WRITE | AA_MAY_SETATTR |

11
security/landlock/fs.c
View File

@ -574,10 +574,12 @@ static inline u32 maybe_remove(const struct dentry *const dentry)
static int hook_path_rename(const struct path *const old_dir,
struct dentry *const old_dentry,
const struct path *const new_dir,
struct dentry *const new_dentry)
struct dentry *const new_dentry,
const unsigned int flags)
{
const struct landlock_ruleset *const dom =
landlock_get_current_domain();
u32 exchange_access = 0;
if (!dom)
return 0;
@ -585,12 +587,19 @@ static int hook_path_rename(const struct path *const old_dir,
if (old_dir->dentry != new_dir->dentry)
/* Gracefully forbids reparenting. */
return -EXDEV;
if (flags & RENAME_EXCHANGE) {
if (unlikely(d_is_negative(new_dentry)))
return -ENOENT;
exchange_access =
get_mode_access(d_backing_inode(new_dentry)->i_mode);
}
if (unlikely(d_is_negative(old_dentry)))
return -ENOENT;
/* RENAME_EXCHANGE is handled because directories are the same. */
return check_access_path(
dom, old_dir,
maybe_remove(old_dentry) | maybe_remove(new_dentry) |
exchange_access |
get_mode_access(d_backing_inode(old_dentry)->i_mode));
}

9
security/security.c
View File

@ -1225,15 +1225,8 @@ int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
(d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
return 0;
if (flags & RENAME_EXCHANGE) {
int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
old_dir, old_dentry);
if (err)
return err;
}
return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
new_dentry);
new_dentry, flags);
}
EXPORT_SYMBOL(security_path_rename);

11
security/tomoyo/tomoyo.c
View File

@ -264,17 +264,26 @@ static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_di
* @old_dentry: Pointer to "struct dentry".
* @new_parent: Pointer to "struct path".
* @new_dentry: Pointer to "struct dentry".
* @flags: Rename options.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_path_rename(const struct path *old_parent,
struct dentry *old_dentry,
const struct path *new_parent,
struct dentry *new_dentry)
struct dentry *new_dentry,
const unsigned int flags)
{
struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
if (flags & RENAME_EXCHANGE) {
const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2,
&path1);
if (err)
return err;
}
return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
}