From mboxrd@z Thu Jan 1 00:00:00 1970 From: jjohansen@suse.de Subject: [AppArmor 35/45] Allow permission functions to tell between parent and leaf checks Date: Mon, 14 May 2007 04:06:42 -0700 Message-ID: <20070514110620.237075017@suse.de> References: <20070514110607.549397248@suse.de> Cc: linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Andreas Gruenbacher To: linux-kernel@vger.kernel.org Return-path: Content-Disposition: inline; filename=parent-permission.diff Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Set the LOOKUP_CONTINUE flag when checking parent permissions. This allows permission functions to tell between parent and leaf checks. Signed-off-by: Andreas Gruenbacher --- fs/namei.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/namei.c +++ b/fs/namei.c @@ -1409,6 +1409,10 @@ static int may_delete(struct inode *dir, BUG_ON(victim->d_parent->d_inode != dir); audit_inode_child(victim->d_name.name, victim->d_inode, dir); +#if 0 + if (nd) + nd->flags |= LOOKUP_CONTINUE; +#endif error = permission(dir,MAY_WRITE | MAY_EXEC, NULL); if (error) return error; @@ -1446,6 +1450,8 @@ static inline int may_create(struct inod return -EEXIST; if (IS_DEADDIR(dir)) return -ENOENT; + if (nd) + nd->flags |= LOOKUP_CONTINUE; return permission(dir,MAY_WRITE | MAY_EXEC, nd); } --