security: make LSMs explicitly mask off permissions

SELinux needs to pass the MAY_ACCESS flag so it can handle auditting correctly. Presently the masking of MAY_* flags is done in the VFS. In order to allow LSMs to decide what flags they care about and what flags they don't just pass them all and the each LSM mask off what they don't need. This patch should contain no functional changes to either the VFS or any LSM. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>

security: make LSMs explicitly mask off permissions
SELinux needs to pass the MAY_ACCESS flag so it can handle auditting correctly. Presently the masking of MAY_* flags is done in the VFS. In order to allow LSMs to decide what flags they care about and what flags they don't just pass them all and the each LSM mask off what they don't need. This patch should contain no functional changes to either the VFS or any LSM. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
Eric Paris · James Morris
1 parent 9cfcac810e
Showing 3 changed files with 5 additions and 2 deletions Side-by-side Diff
fs/namei.c
security/selinux/hooks.c
security/smack/smack_lsm.c
@@ -282,8 +282,7 @@
 	if (retval)
 		return retval;
  
-	return security_inode_permission(inode,
-			mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
+	return security_inode_permission(inode, mask);
 }
  
 /**
@@ -2645,6 +2645,8 @@
 {
 	const struct cred *cred = current_cred();
  
+	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
+
 	if (!mask) {
 		/* No permission to check.  Existence test. */
 		return 0;
@@ -598,6 +598,8 @@
 static int smack_inode_permission(struct inode *inode, int mask)
 {
 	struct smk_audit_info ad;
+
+	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
 	/*
 	 * No permission to check. Existence test. Yup, it's there.
 	 */
...	...	@@ -282,8 +282,7 @@
282	282	if (retval)
283	283	return retval;
284	284
285		- return security_inode_permission(inode,
286		- mask & (MAY_READ\|MAY_WRITE\|MAY_EXEC\|MAY_APPEND));
	285	+ return security_inode_permission(inode, mask);
287	286	}
288	287
289	288	/**
...	...	@@ -2645,6 +2645,8 @@
2645	2645	{
2646	2646	const struct cred *cred = current_cred();
2647	2647
	2648	+ mask &= (MAY_READ\|MAY_WRITE\|MAY_EXEC\|MAY_APPEND);
	2649	+
2648	2650	if (!mask) {
2649	2651	/* No permission to check. Existence test. */
2650	2652	return 0;
...	...	@@ -598,6 +598,8 @@
598	598	static int smack_inode_permission(struct inode *inode, int mask)
599	599	{
600	600	struct smk_audit_info ad;
	601	+
	602	+ mask &= (MAY_READ\|MAY_WRITE\|MAY_EXEC\|MAY_APPEND);
601	603	/*
602	604	* No permission to check. Existence test. Yup, it's there.
603	605	*/