Messages in this thread Patch in this message | | | From | felix <> | Subject | [PATCH -next] lsm: fix default return value for inode_set(remove)xattr | Date | Mon, 29 Apr 2024 19:46:36 +0800 |
| |
From: Felix Fu <fuzhen5@huawei.com>
The return value of security_inode_set(remove)xattr should be 1. If it return 0, cap_inode_setxattr would not be executed when no lsm exist, which is not what we expected, any user could set some security.* xattr for a file.
Before commit 260017f31a8c ("lsm: use default hook return value in call_int_hook()") was approved, this issue would still happened when lsm only include bpf, because bpf_lsm_ inode_setxattr return 0 by default which cause cap_inode_set xattr to be not executed.
Fixes: 260017f31a8c ("lsm: use default hook return value in call_int_hook()") Signed-off-by: Felix Fu <fuzhen5@huawei.com> --- include/linux/lsm_hook_defs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index f804b76cde44..9c768b954264 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -144,14 +144,14 @@ LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry, LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap, struct dentry *dentry, int ia_valid) LSM_HOOK(int, 0, inode_getattr, const struct path *path) -LSM_HOOK(int, 0, inode_setxattr, struct mnt_idmap *idmap, +LSM_HOOK(int, 1, inode_setxattr, struct mnt_idmap *idmap, struct dentry *dentry, const char *name, const void *value, size_t size, int flags) LSM_HOOK(void, LSM_RET_VOID, inode_post_setxattr, struct dentry *dentry, const char *name, const void *value, size_t size, int flags) LSM_HOOK(int, 0, inode_getxattr, struct dentry *dentry, const char *name) LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry) -LSM_HOOK(int, 0, inode_removexattr, struct mnt_idmap *idmap, +LSM_HOOK(int, 1, inode_removexattr, struct mnt_idmap *idmap, struct dentry *dentry, const char *name) LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry, const char *name) -- 2.34.1
| |