lkml.org 
[lkml]   [2019]   [Jun]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH bpf-next v9 01/10] fs,security: Add a new file access type: MAY_CHROOT
    Date
    For compatibility reason, MAY_CHROOT is always set with MAY_CHDIR.
    However, this new flag enable to differentiate a chdir form a chroot.

    This is needed for the Landlock LSM to be able to evaluate a new root
    directory.

    Signed-off-by: Mickaël Salaün <mic@digikod.net>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Casey Schaufler <casey@schaufler-ca.com>
    Cc: James Morris <jmorris@namei.org>
    Cc: John Johansen <john.johansen@canonical.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Paul Moore <paul@paul-moore.com>
    Cc: "Serge E. Hallyn" <serge@hallyn.com>
    Cc: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: linux-fsdevel@vger.kernel.org
    ---
    fs/open.c | 3 ++-
    include/linux/fs.h | 1 +
    2 files changed, 3 insertions(+), 1 deletion(-)

    diff --git a/fs/open.c b/fs/open.c
    index b5b80469b93d..e8767318fd03 100644
    --- a/fs/open.c
    +++ b/fs/open.c
    @@ -494,7 +494,8 @@ int ksys_chroot(const char __user *filename)
    if (error)
    goto out;

    - error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
    + error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR |
    + MAY_CHROOT);
    if (error)
    goto dput_and_out;

    diff --git a/include/linux/fs.h b/include/linux/fs.h
    index f7fdfe93e25d..fa6c9d0c152b 100644
    --- a/include/linux/fs.h
    +++ b/include/linux/fs.h
    @@ -99,6 +99,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
    #define MAY_CHDIR 0x00000040
    /* called from RCU mode, don't block */
    #define MAY_NOT_BLOCK 0x00000080
    +#define MAY_CHROOT 0x00000100

    /*
    * flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-06-26 00:04    [W:3.467 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site