diff options
| author | Andi Kleen <[email protected]> | 2011-04-22 00:23:19 +0000 |
|---|---|---|
| committer | Eric Paris <[email protected]> | 2011-04-25 14:20:32 +0000 |
| commit | 1c9904297451f558191e211a48d8838b4bf792b0 (patch) | |
| tree | 9c7cabec6ce3d6604147de73953cfaca672f1c0d /security/security.c | |
| parent | SELinux: security_read_policy should take a size_t not ssize_t (diff) | |
| download | kernel-1c9904297451f558191e211a48d8838b4bf792b0.tar.gz kernel-1c9904297451f558191e211a48d8838b4bf792b0.zip | |
SECURITY: Move exec_permission RCU checks into security modules
Right now all RCU walks fall back to reference walk when CONFIG_SECURITY
is enabled, even though just the standard capability module is active.
This is because security_inode_exec_permission unconditionally fails
RCU walks.
Move this decision to the low level security module. This requires
passing the RCU flags down the security hook. This way at least
the capability module and a few easy cases in selinux/smack work
with RCU walks with CONFIG_SECURITY=y
Signed-off-by: Andi Kleen <[email protected]>
Signed-off-by: Eric Paris <[email protected]>
Diffstat (limited to 'security/security.c')
| -rw-r--r-- | security/security.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/security/security.c b/security/security.c index 47b8a447118f..7e34f98bf433 100644 --- a/security/security.c +++ b/security/security.c @@ -514,16 +514,14 @@ int security_inode_permission(struct inode *inode, int mask) { if (unlikely(IS_PRIVATE(inode))) return 0; - return security_ops->inode_permission(inode, mask); + return security_ops->inode_permission(inode, mask, 0); } int security_inode_exec_permission(struct inode *inode, unsigned int flags) { if (unlikely(IS_PRIVATE(inode))) return 0; - if (flags) - return -ECHILD; - return security_ops->inode_permission(inode, MAY_EXEC); + return security_ops->inode_permission(inode, MAY_EXEC, flags); } int security_inode_setattr(struct dentry *dentry, struct iattr *attr) |