[Cluster-devel] [PATCH v4 7/7] gfs2: Invalide security labels of inodes when they go invalid

[Cluster-devel] [PATCH v4 7/7] gfs2: Invalide security labels of inodes when they go invalid

[Andreas Gruenbacher]

When gfs2 releases the glock of an inode, it must invalidate all
information cached for that inode, including the page cache and acls.  Use
the new security_inode_invalidate_secctx hook to also invalidate security
labels in that case.  These items will be reread from disk when needed
after reacquiring the glock.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Bob Peterson <rpeterso@redhat.com>
Cc: cluster-devel at redhat.com
---
 fs/gfs2/glops.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 1f6c9c3..0833076 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -13,6 +13,7 @@
 #include <linux/gfs2_ondisk.h>
 #include <linux/bio.h>
 #include <linux/posix_acl.h>
+#include <linux/security.h>
 
 #include "gfs2.h"
 #include "incore.h"
@@ -262,6 +263,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
 		if (ip) {
 			set_bit(GIF_INVALID, &ip->i_flags);
 			forget_all_cached_acls(&ip->i_inode);
+			security_inode_invalidate_secctx(&ip->i_inode);
 			gfs2_dir_hash_inval(ip);
 		}
 	}
-- 
2.5.0

[Cluster-devel] [PATCH v4 7/7] gfs2: Invalide security labels of inodes when they go invalid

[Bob Peterson]

----- Original Message -----
> When gfs2 releases the glock of an inode, it must invalidate all
> information cached for that inode, including the page cache and acls.  Use
> the new security_inode_invalidate_secctx hook to also invalidate security
> labels in that case.  These items will be reread from disk when needed
> after reacquiring the glock.
> 
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> Cc: Steven Whitehouse <swhiteho@redhat.com>
> Cc: Bob Peterson <rpeterso@redhat.com>
> Cc: cluster-devel at redhat.com
> ---
>  fs/gfs2/glops.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
> index 1f6c9c3..0833076 100644
> --- a/fs/gfs2/glops.c
> +++ b/fs/gfs2/glops.c
> @@ -13,6 +13,7 @@
>  #include <linux/gfs2_ondisk.h>
>  #include <linux/bio.h>
>  #include <linux/posix_acl.h>
> +#include <linux/security.h>
>  
>  #include "gfs2.h"
>  #include "incore.h"
> @@ -262,6 +263,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int
> flags)
>  		if (ip) {
>  			set_bit(GIF_INVALID, &ip->i_flags);
>  			forget_all_cached_acls(&ip->i_inode);
> +			security_inode_invalidate_secctx(&ip->i_inode);
>  			gfs2_dir_hash_inval(ip);
>  		}
>  	}
> --
> 2.5.0
> 
> 
Hi,

Acked-by: Bob Peterson <rpeterso@redhat.com>

Bob Peterson
Red Hat File Systems

[Cluster-devel] [PATCH v4 7/7] gfs2: Invalide security labels of inodes when they go invalid

[Steven Whitehouse]

Hi,

Acked-by: Steven Whitehouse <swhiteho@redhat.com>

Steve.

On 29/10/15 00:47, Andreas Gruenbacher wrote:
> When gfs2 releases the glock of an inode, it must invalidate all
> information cached for that inode, including the page cache and acls.  Use
> the new security_inode_invalidate_secctx hook to also invalidate security
> labels in that case.  These items will be reread from disk when needed
> after reacquiring the glock.
>
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> Cc: Steven Whitehouse <swhiteho@redhat.com>
> Cc: Bob Peterson <rpeterso@redhat.com>
> Cc: cluster-devel at redhat.com
> ---
>   fs/gfs2/glops.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
> index 1f6c9c3..0833076 100644
> --- a/fs/gfs2/glops.c
> +++ b/fs/gfs2/glops.c
> @@ -13,6 +13,7 @@
>   #include <linux/gfs2_ondisk.h>
>   #include <linux/bio.h>
>   #include <linux/posix_acl.h>
> +#include <linux/security.h>
>   
>   #include "gfs2.h"
>   #include "incore.h"
> @@ -262,6 +263,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
>   		if (ip) {
>   			set_bit(GIF_INVALID, &ip->i_flags);
>   			forget_all_cached_acls(&ip->i_inode);
> +			security_inode_invalidate_secctx(&ip->i_inode);
>   			gfs2_dir_hash_inval(ip);
>   		}
>   	}