diff options
| author | Andrey Albershteyn <[email protected]> | 2025-06-30 16:20:13 +0000 |
|---|---|---|
| committer | Christian Brauner <[email protected]> | 2025-07-01 20:44:29 +0000 |
| commit | bd14e462bb52f5bbfc56f10f758f617c05dbd63c (patch) | |
| tree | 642ab51268fdfbff63f26edc8c6ff5a7bbad98c3 | |
| parent | lsm: introduce new hooks for setting/getting inode fsxattr (diff) | |
| download | kernel-bd14e462bb52f5bbfc56f10f758f617c05dbd63c.tar.gz kernel-bd14e462bb52f5bbfc56f10f758f617c05dbd63c.zip | |
selinux: implement inode_file_[g|s]etattr hooks
These hooks are called on inode extended attribute retrieval/change.
Cc: [email protected]
Cc: Paul Moore <[email protected]>
Acked-by: Paul Moore <[email protected]>
Signed-off-by: Andrey Albershteyn <[email protected]>
Link: https://lore.kernel.org/[email protected]
Signed-off-by: Christian Brauner <[email protected]>
| -rw-r--r-- | security/selinux/hooks.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 595ceb314aeb..be7aca2269fa 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3480,6 +3480,18 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap, return -EACCES; } +static int selinux_inode_file_setattr(struct dentry *dentry, + struct fileattr *fa) +{ + return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); +} + +static int selinux_inode_file_getattr(struct dentry *dentry, + struct fileattr *fa) +{ + return dentry_has_perm(current_cred(), dentry, FILE__GETATTR); +} + static int selinux_path_notify(const struct path *path, u64 mask, unsigned int obj_type) { @@ -7350,6 +7362,8 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr), LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr), LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr), + LSM_HOOK_INIT(inode_file_getattr, selinux_inode_file_getattr), + LSM_HOOK_INIT(inode_file_setattr, selinux_inode_file_setattr), LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl), LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl), LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl), |