2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 14:25:52 +00:00

Add nfsd_permission-nameidata.diff. Rediff for offsets.

This commit is contained in:
Andreas Gruenbacher
2007-04-23 02:06:00 +00:00
parent 08d2c181b0
commit 5dbfaab817
15 changed files with 104 additions and 67 deletions

View File

@@ -12,7 +12,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1132,25 +1132,24 @@ static int fastcall do_path_lookup(int d
@@ -1131,25 +1131,24 @@ static int fastcall do_path_lookup(int d
nd->dentry = dget(fs->pwd);
read_unlock(&fs->lock);
} else {
@@ -33,7 +33,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
goto fput_fail;
- retval = file_permission(file, MAY_EXEC);
+ retval = vfs_permission(nd, MAY_EXEC);
+ retval = vfs_permission(ND2(nd), MAY_EXEC);
if (retval)
goto fput_fail;

View File

@@ -4,7 +4,7 @@
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1426,14 +1426,13 @@ static int may_delete(struct inode *dir,
@@ -1425,14 +1425,13 @@ static int may_delete(struct inode *dir,
* 3. We should have write and exec permissions on dir
* 4. We can't do it if dir is immutable (done in permission())
*/
@@ -22,7 +22,7 @@
}
/*
@@ -1499,7 +1498,7 @@ void unlock_rename(struct dentry *p1, st
@@ -1498,7 +1497,7 @@ void unlock_rename(struct dentry *p1, st
int vfs_create(struct nameidata2 *nd, struct dentry *dentry, int mode)
{
struct inode *dir = nd->dentry->d_inode;
@@ -31,7 +31,7 @@
if (error)
return error;
@@ -1845,7 +1844,7 @@ EXPORT_SYMBOL_GPL(lookup_create);
@@ -1844,7 +1843,7 @@ EXPORT_SYMBOL_GPL(lookup_create);
int vfs_mknod(struct nameidata2 *nd, struct dentry *dentry, int mode, dev_t dev)
{
struct inode *dir = nd->dentry->d_inode;
@@ -40,7 +40,7 @@
if (error)
return error;
@@ -1925,7 +1924,7 @@ asmlinkage long sys_mknod(const char __u
@@ -1924,7 +1923,7 @@ asmlinkage long sys_mknod(const char __u
int vfs_mkdir(struct nameidata2 *nd, struct dentry *dentry, int mode)
{
struct inode *dir = nd->dentry->d_inode;
@@ -49,7 +49,7 @@
if (error)
return error;
@@ -2194,7 +2193,7 @@ int vfs_symlink(struct nameidata2 *nd, s
@@ -2193,7 +2192,7 @@ int vfs_symlink(struct nameidata2 *nd, s
const char *oldname, int mode)
{
struct inode *dir = nd->dentry->d_inode;
@@ -58,7 +58,7 @@
if (error)
return error;
@@ -2266,7 +2265,7 @@ int vfs_link(struct nameidata2 *old_nd,
@@ -2265,7 +2264,7 @@ int vfs_link(struct nameidata2 *old_nd,
if (!inode)
return -ENOENT;
@@ -67,7 +67,7 @@
if (error)
return error;
@@ -2484,7 +2483,7 @@ int vfs_rename(struct nameidata2 *old_nd
@@ -2483,7 +2482,7 @@ int vfs_rename(struct nameidata2 *old_nd
return error;
if (!new_dentry->d_inode)

View File

@@ -4,7 +4,7 @@
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1386,8 +1386,9 @@ static inline int check_sticky(struct in
@@ -1385,8 +1385,9 @@ static inline int check_sticky(struct in
* 10. We don't allow removal of NFS sillyrenamed files; it's handled by
* nfs_async_unlink().
*/
@@ -15,7 +15,7 @@
int error;
if (!victim->d_inode)
@@ -1396,7 +1397,7 @@ static int may_delete(struct inode *dir,
@@ -1395,7 +1396,7 @@ static int may_delete(struct inode *dir,
BUG_ON(victim->d_parent->d_inode != dir);
audit_inode_child(victim->d_name.name, victim->d_inode, dir);
@@ -24,7 +24,7 @@
if (error)
return error;
if (IS_APPEND(dir))
@@ -2012,7 +2013,7 @@ void dentry_unhash(struct dentry *dentry
@@ -2011,7 +2012,7 @@ void dentry_unhash(struct dentry *dentry
int vfs_rmdir(struct nameidata2 *nd, struct dentry *dentry)
{
struct inode *dir = nd->dentry->d_inode;
@@ -33,7 +33,7 @@
if (error)
return error;
@@ -2094,7 +2095,7 @@ asmlinkage long sys_rmdir(const char __u
@@ -2093,7 +2094,7 @@ asmlinkage long sys_rmdir(const char __u
int vfs_unlink(struct nameidata2 *nd, struct dentry *dentry)
{
struct inode *dir = nd->dentry->d_inode;
@@ -42,7 +42,7 @@
if (error)
return error;
@@ -2480,14 +2481,14 @@ int vfs_rename(struct nameidata2 *old_nd
@@ -2479,14 +2480,14 @@ int vfs_rename(struct nameidata2 *old_nd
if (old_dentry->d_inode == new_dentry->d_inode)
return 0;

View File

@@ -0,0 +1,32 @@
---
fs/nfsd/vfs.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1808,6 +1808,10 @@ nfsd_statfs(struct svc_rqst *rqstp, stru
__be32
nfsd_permission(struct svc_export *exp, struct dentry *dentry, int acc)
{
+ struct nameidata2 nd = {
+ .dentry = dentry,
+ .mnt = exp->ex_mnt,
+ };
struct inode *inode = dentry->d_inode;
int err;
@@ -1873,12 +1877,12 @@ nfsd_permission(struct svc_export *exp,
inode->i_uid == current->fsuid)
return 0;
- err = permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC), NULL);
+ err = permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC), &nd);
/* Allow read access to binaries even when mode 111 */
if (err == -EACCES && S_ISREG(inode->i_mode) &&
acc == (MAY_READ | MAY_OWNER_OVERRIDE))
- err = permission(inode, MAY_EXEC, NULL);
+ err = permission(inode, MAY_EXEC, &nd);
return err? nfserrno(err) : 0;
}

View File

@@ -67,3 +67,4 @@ apparmor-sysctl-pathname.diff
# vfs_unlink-args.diff
# may_delete-args.diff
# lookup_parent.diff
# nfsd_permission-nameidata.diff

View File

@@ -74,7 +74,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
fs/libfs.c | 2 +-
fs/minix/namei.c | 4 ++--
fs/msdos/namei.c | 4 ++--
fs/namei.c | 38 ++++++++++++++++++++------------------
fs/namei.c | 41 +++++++++++++++++++++--------------------
fs/ncpfs/dir.c | 14 +++++++-------
fs/nfs/dir.c | 30 +++++++++++++++---------------
fs/nfs/nfs3proc.c | 2 +-
@@ -124,7 +124,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
security/apparmor/lsm.c | 2 +-
security/dummy.c | 2 +-
security/selinux/hooks.c | 2 +-
108 files changed, 272 insertions(+), 250 deletions(-)
108 files changed, 273 insertions(+), 252 deletions(-)
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -1247,16 +1247,17 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
if (unlikely(status <= 0)) {
/*
* The dentry failed validation.
@@ -455,7 +455,7 @@ static int exec_permission_lite(struct i
@@ -428,8 +428,7 @@ static struct dentry * cached_lookup(str
* short-cut DAC fails, then call permission() to do more
* complete permission check.
*/
-static int exec_permission_lite(struct inode *inode,
- struct nameidata *nd)
+static int exec_permission_lite(struct inode *inode, struct nameidata2 *nd)
{
umode_t mode = inode->i_mode;
return -EACCES;
ok:
- return security_inode_permission(inode, MAY_EXEC, nd);
+ return security_inode_permission(inode, MAY_EXEC, ND2(nd));
}
/*
@@ -491,7 +491,7 @@ static struct dentry * real_lookup(struc
@@ -491,7 +490,7 @@ static struct dentry * real_lookup(struc
struct dentry * dentry = d_alloc(parent, name);
result = ERR_PTR(-ENOMEM);
if (dentry) {
@@ -1265,16 +1266,19 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
if (result)
dput(dentry);
else
@@ -832,7 +832,7 @@ static fastcall int __link_path_walk(con
@@ -830,9 +829,9 @@ static fastcall int __link_path_walk(con
unsigned int c;
nd->flags |= LOOKUP_CONTINUE;
err = exec_permission_lite(inode, nd);
- err = exec_permission_lite(inode, nd);
+ err = exec_permission_lite(inode, ND2(nd));
if (err == -EAGAIN)
- err = vfs_permission(nd, MAY_EXEC);
+ err = vfs_permission(ND2(nd), MAY_EXEC);
if (err)
break;
@@ -978,7 +978,8 @@ return_reval:
@@ -978,7 +977,8 @@ return_reval:
(nd->dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)) {
err = -ESTALE;
/* Note: we do not d_invalidate() */
@@ -1284,7 +1288,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
break;
}
return_base:
@@ -1194,7 +1195,7 @@ static int __path_lookup_intent_open(int
@@ -1194,7 +1194,7 @@ static int __path_lookup_intent_open(int
path_release(nd);
}
} else if (err != 0)
@@ -1293,7 +1297,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
return err;
}
@@ -1255,7 +1256,7 @@ static struct dentry * __lookup_hash(str
@@ -1255,7 +1255,7 @@ static struct dentry * __lookup_hash(str
int err;
inode = base->d_inode;
@@ -1302,7 +1306,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
dentry = ERR_PTR(err);
if (err)
goto out;
@@ -1277,7 +1278,7 @@ static struct dentry * __lookup_hash(str
@@ -1277,7 +1277,7 @@ static struct dentry * __lookup_hash(str
dentry = ERR_PTR(-ENOMEM);
if (!new)
goto out;
@@ -1311,7 +1315,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
if (!dentry)
dentry = new;
else
@@ -1422,7 +1423,7 @@ static int may_delete(struct inode *dir,
@@ -1422,7 +1422,7 @@ static int may_delete(struct inode *dir,
* 4. We can't do it if dir is immutable (done in permission())
*/
static inline int may_create(struct inode *dir, struct dentry *child,
@@ -1320,7 +1324,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
{
if (child->d_inode)
return -EEXIST;
@@ -1492,7 +1493,7 @@ void unlock_rename(struct dentry *p1, st
@@ -1492,7 +1492,7 @@ void unlock_rename(struct dentry *p1, st
}
int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
@@ -1329,7 +1333,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
{
int error = may_create(dir, dentry, nd);
@@ -1528,7 +1529,7 @@ int may_open(struct nameidata *nd, int a
@@ -1528,7 +1528,7 @@ int may_open(struct nameidata *nd, int a
if (S_ISDIR(inode->i_mode) && (flag & FMODE_WRITE))
return -EISDIR;
@@ -1338,7 +1342,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
if (error)
return error;
@@ -1601,7 +1602,7 @@ static int open_namei_create(struct name
@@ -1601,7 +1601,7 @@ static int open_namei_create(struct name
if (!IS_POSIXACL(dir->d_inode))
mode &= ~current->fs->umask;
@@ -1347,7 +1351,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
mutex_unlock(&dir->d_inode->i_mutex);
dput(nd->dentry);
nd->dentry = path->dentry;
@@ -1734,7 +1735,7 @@ exit_dput:
@@ -1734,7 +1734,7 @@ exit_dput:
dput_path(&path, nd);
exit:
if (!IS_ERR(nd->intent.open.file))
@@ -1356,7 +1360,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
path_release(nd);
return error;
@@ -1762,7 +1763,7 @@ do_link:
@@ -1762,7 +1762,7 @@ do_link:
* me so stupid? Anathema to whoever designed this non-sense
* with "intent.open".
*/
@@ -1365,7 +1369,7 @@ Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
return error;
}
nd->flags &= ~LOOKUP_PARENT;
@@ -1887,7 +1888,8 @@ asmlinkage long sys_mknodat(int dfd, con
@@ -1887,7 +1887,8 @@ asmlinkage long sys_mknodat(int dfd, con
if (!IS_ERR(dentry)) {
switch (mode & S_IFMT) {
case 0: case S_IFREG:

View File

@@ -42,7 +42,7 @@
"Failure to create underlying file\n");
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1496,9 +1496,9 @@ void unlock_rename(struct dentry *p1, st
@@ -1495,9 +1495,9 @@ void unlock_rename(struct dentry *p1, st
}
}
@@ -54,7 +54,7 @@
int error = may_create(dir, dentry, nd);
if (error)
@@ -1606,7 +1606,7 @@ static int open_namei_create(struct name
@@ -1605,7 +1605,7 @@ static int open_namei_create(struct name
if (!IS_POSIXACL(dir->d_inode))
mode &= ~current->fs->umask;
@@ -63,7 +63,7 @@
mutex_unlock(&dir->d_inode->i_mutex);
dput(nd->dentry);
nd->dentry = path->dentry;
@@ -1892,8 +1892,7 @@ asmlinkage long sys_mknodat(int dfd, con
@@ -1891,8 +1891,7 @@ asmlinkage long sys_mknodat(int dfd, con
if (!IS_ERR(dentry)) {
switch (mode & S_IFMT) {
case 0: case S_IFREG:

View File

@@ -6,7 +6,7 @@
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1504,7 +1504,7 @@ int vfs_create(struct inode *dir, struct
@@ -1503,7 +1503,7 @@ int vfs_create(struct inode *dir, struct
return -EACCES; /* shouldn't it be ENOSYS? */
mode &= S_IALLUGO;
mode |= S_IFREG;

View File

@@ -57,7 +57,7 @@
return rc;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2255,15 +2255,18 @@ asmlinkage long sys_symlink(const char _
@@ -2254,15 +2254,18 @@ asmlinkage long sys_symlink(const char _
return sys_symlinkat(oldname, AT_FDCWD, newname);
}
@@ -78,7 +78,7 @@
if (error)
return error;
@@ -2280,8 +2283,8 @@ int vfs_link(struct dentry *old_dentry,
@@ -2279,8 +2282,8 @@ int vfs_link(struct dentry *old_dentry,
if (S_ISDIR(old_dentry->d_inode->i_mode))
return -EPERM;
@@ -89,7 +89,7 @@
if (error)
return error;
@@ -2334,8 +2337,7 @@ asmlinkage long sys_linkat(int olddfd, c
@@ -2333,8 +2336,7 @@ asmlinkage long sys_linkat(int olddfd, c
error = PTR_ERR(new_dentry);
if (IS_ERR(new_dentry))
goto out_unlock;

View File

@@ -45,7 +45,7 @@
return rc;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1922,10 +1922,10 @@ asmlinkage long sys_mknod(const char __u
@@ -1921,10 +1921,10 @@ asmlinkage long sys_mknod(const char __u
return sys_mknodat(AT_FDCWD, filename, mode, dev);
}
@@ -59,7 +59,7 @@
if (error)
return error;
@@ -1934,7 +1934,7 @@ int vfs_mkdir(struct inode *dir, struct
@@ -1933,7 +1933,7 @@ int vfs_mkdir(struct inode *dir, struct
return -EPERM;
mode &= (S_IRWXUGO|S_ISVTX);
@@ -68,7 +68,7 @@
if (error)
return error;
@@ -1967,7 +1967,7 @@ asmlinkage long sys_mkdirat(int dfd, con
@@ -1966,7 +1966,7 @@ asmlinkage long sys_mkdirat(int dfd, con
if (!IS_POSIXACL(nd.dentry->d_inode))
mode &= ~current->fs->umask;

View File

@@ -43,7 +43,7 @@
return rc;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1842,10 +1842,10 @@ fail:
@@ -1841,10 +1841,10 @@ fail:
}
EXPORT_SYMBOL_GPL(lookup_create);
@@ -57,7 +57,7 @@
if (error)
return error;
@@ -1856,7 +1856,7 @@ int vfs_mknod(struct inode *dir, struct
@@ -1855,7 +1855,7 @@ int vfs_mknod(struct inode *dir, struct
if (!dir->i_op || !dir->i_op->mknod)
return -EPERM;
@@ -66,7 +66,7 @@
if (error)
return error;
@@ -1895,12 +1895,11 @@ asmlinkage long sys_mknodat(int dfd, con
@@ -1894,12 +1894,11 @@ asmlinkage long sys_mknodat(int dfd, con
error = vfs_create(ND2(&nd), dentry, mode);
break;
case S_IFCHR: case S_IFBLK:

View File

@@ -54,7 +54,7 @@
dput(lower_new_dentry);
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2388,10 +2388,11 @@ asmlinkage long sys_link(const char __us
@@ -2387,10 +2387,11 @@ asmlinkage long sys_link(const char __us
* ->i_mutex on parents, which works but leads to some truely excessive
* locking].
*/
@@ -69,7 +69,7 @@
int error = 0;
struct inode *target;
@@ -2400,13 +2401,13 @@ static int vfs_rename_dir(struct inode *
@@ -2399,13 +2400,13 @@ static int vfs_rename_dir(struct inode *
* we'll need to flip '..'.
*/
if (new_dir != old_dir) {
@@ -86,7 +86,7 @@
if (error)
return error;
@@ -2433,15 +2434,18 @@ static int vfs_rename_dir(struct inode *
@@ -2432,15 +2433,18 @@ static int vfs_rename_dir(struct inode *
return error;
}
@@ -110,7 +110,7 @@
if (error)
return error;
@@ -2463,10 +2467,11 @@ static int vfs_rename_other(struct inode
@@ -2462,10 +2466,11 @@ static int vfs_rename_other(struct inode
return error;
}
@@ -125,7 +125,7 @@
int error;
int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
const char *old_name;
@@ -2479,7 +2484,7 @@ int vfs_rename(struct inode *old_dir, st
@@ -2478,7 +2483,7 @@ int vfs_rename(struct inode *old_dir, st
return error;
if (!new_dentry->d_inode)
@@ -134,7 +134,7 @@
else
error = may_delete(new_dir, new_dentry, is_dir);
if (error)
@@ -2494,11 +2499,10 @@ int vfs_rename(struct inode *old_dir, st
@@ -2493,11 +2498,10 @@ int vfs_rename(struct inode *old_dir, st
old_name = fsnotify_oldname_init(old_dentry->d_name.name);
if (is_dir)
@@ -149,7 +149,7 @@
if (!error) {
const char *new_name = old_dentry->d_name.name;
fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
@@ -2570,8 +2574,7 @@ static int do_rename(int olddfd, const c
@@ -2569,8 +2573,7 @@ static int do_rename(int olddfd, const c
if (new_dentry == trap)
goto exit5;

View File

@@ -42,7 +42,7 @@
dput(dentry);
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2009,8 +2009,9 @@ void dentry_unhash(struct dentry *dentry
@@ -2008,8 +2008,9 @@ void dentry_unhash(struct dentry *dentry
spin_unlock(&dcache_lock);
}
@@ -53,7 +53,7 @@
int error = may_delete(dir, dentry, 1);
if (error)
@@ -2019,7 +2020,7 @@ int vfs_rmdir(struct inode *dir, struct
@@ -2018,7 +2019,7 @@ int vfs_rmdir(struct inode *dir, struct
if (!dir->i_op || !dir->i_op->rmdir)
return -EPERM;
@@ -62,7 +62,7 @@
if (error)
return error;
@@ -2074,7 +2075,7 @@ static long do_rmdir(int dfd, const char
@@ -2073,7 +2074,7 @@ static long do_rmdir(int dfd, const char
error = PTR_ERR(dentry);
if (IS_ERR(dentry))
goto exit2;

View File

@@ -55,7 +55,7 @@
d_drop(dentry);
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2190,10 +2190,11 @@ asmlinkage long sys_unlink(const char __
@@ -2189,10 +2189,11 @@ asmlinkage long sys_unlink(const char __
return do_unlinkat(AT_FDCWD, pathname);
}
@@ -69,7 +69,7 @@
if (error)
return error;
@@ -2201,7 +2202,7 @@ int vfs_symlink(struct inode *dir, struc
@@ -2200,7 +2201,7 @@ int vfs_symlink(struct inode *dir, struc
if (!dir->i_op || !dir->i_op->symlink)
return -EPERM;
@@ -78,7 +78,7 @@
if (error)
return error;
@@ -2237,8 +2238,7 @@ asmlinkage long sys_symlinkat(const char
@@ -2236,8 +2237,7 @@ asmlinkage long sys_symlinkat(const char
if (IS_ERR(dentry))
goto out_unlock;

View File

@@ -54,7 +54,7 @@
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2091,8 +2091,9 @@ asmlinkage long sys_rmdir(const char __u
@@ -2090,8 +2090,9 @@ asmlinkage long sys_rmdir(const char __u
return do_rmdir(AT_FDCWD, pathname);
}
@@ -65,7 +65,7 @@
int error = may_delete(dir, dentry, 0);
if (error)
@@ -2107,7 +2108,7 @@ int vfs_unlink(struct inode *dir, struct
@@ -2106,7 +2107,7 @@ int vfs_unlink(struct inode *dir, struct
if (d_mountpoint(dentry))
error = -EBUSY;
else {
@@ -74,7 +74,7 @@
if (!error)
error = dir->i_op->unlink(dir, dentry);
}
@@ -2155,7 +2156,7 @@ static long do_unlinkat(int dfd, const c
@@ -2154,7 +2155,7 @@ static long do_unlinkat(int dfd, const c
inode = dentry->d_inode;
if (inode)
atomic_inc(&inode->i_count);