diff options
| author | Max Kellermann <[email protected]> | 2024-12-13 13:50:05 +0000 |
|---|---|---|
| committer | Christian Brauner <[email protected]> | 2024-12-20 21:07:56 +0000 |
| commit | e5a8b6446c0d370716f193771ccacf3260a57534 (patch) | |
| tree | 946f5d2ef90355d7b10ab6e6467887e1935b8653 /fs/cachefiles/security.c | |
| parent | nfs: Fix oops in nfs_netfs_init_request() when copying to cache (diff) | |
| download | kernel-e5a8b6446c0d370716f193771ccacf3260a57534.tar.gz kernel-e5a8b6446c0d370716f193771ccacf3260a57534.zip | |
cachefiles: Parse the "secctx" immediately
Instead of storing an opaque string, call security_secctx_to_secid()
right in the "secctx" command handler and store only the numeric
"secid". This eliminates an unnecessary string allocation and allows
the daemon to receive errors when writing the "secctx" command instead
of postponing the error to the "bind" command handler. For example,
if the kernel was built without `CONFIG_SECURITY`, "bind" will return
`EOPNOTSUPP`, but the daemon doesn't know why. With this patch, the
"secctx" will instead return `EOPNOTSUPP` which is the right context
for this error.
This patch adds a boolean flag `have_secid` because I'm not sure if we
can safely assume that zero is the special secid value for "not set".
This appears to be true for SELinux, Smack and AppArmor, but since
this attribute is not documented, I'm unable to derive a stable
guarantee for that.
Signed-off-by: Max Kellermann <[email protected]>
Signed-off-by: David Howells <[email protected]>
Link: https://lore.kernel.org/r/[email protected]/
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Christian Brauner <[email protected]>
Diffstat (limited to 'fs/cachefiles/security.c')
| -rw-r--r-- | fs/cachefiles/security.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c index fe777164f1d8..fc6611886b3b 100644 --- a/fs/cachefiles/security.c +++ b/fs/cachefiles/security.c @@ -18,7 +18,7 @@ int cachefiles_get_security_ID(struct cachefiles_cache *cache) struct cred *new; int ret; - _enter("{%s}", cache->secctx); + _enter("{%u}", cache->have_secid ? cache->secid : 0); new = prepare_kernel_cred(current); if (!new) { @@ -26,8 +26,8 @@ int cachefiles_get_security_ID(struct cachefiles_cache *cache) goto error; } - if (cache->secctx) { - ret = set_security_override_from_ctx(new, cache->secctx); + if (cache->have_secid) { + ret = set_security_override(new, cache->secid); if (ret < 0) { put_cred(new); pr_err("Security denies permission to nominate security context: error %d\n", |