[PATCH v2 15/25] security: call evm fscaps hooks from generic security hooks

Seth Forshee (DigitalOcean)
2024-02-21T21:25:06Z

Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
---
security/security.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/security/security.c b/security/security.c
index 0d210da9862c..f515d8430318 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2365,9 +2365,14 @@ int security_inode_remove_acl(struct mnt_idmap *idmap,
int security_inode_set_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
const struct vfs_caps *caps, int flags)
{
+ int ret;
+
if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
return 0;
- return call_int_hook(inode_set_fscaps, 0, idmap, dentry, caps, flags);
+ ret = call_int_hook(inode_set_fscaps, 0, idmap, dentry, caps, flags);
+ if (ret)
+ return ret;
+ return evm_inode_set_fscaps(idmap, dentry, caps, flags);
}

/**
@@ -2387,6 +2392,7 @@ void security_inode_post_set_fscaps(struct mnt_idmap *idmap,
if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
return;
call_void_hook(inode_post_set_fscaps, idmap, dentry, caps, flags);
+ evm_inode_post_set_fscaps(idmap, dentry, caps, flags);
}

/**
@@ -2415,9 +2421,14 @@ int security_inode_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry)
*/
int security_inode_remove_fscaps(struct mnt_idmap *idmap, struct dentry *dentry)
{
+ int ret;
+
if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
return 0;
- return call_int_hook(inode_remove_fscaps, 0, idmap, dentry);
+ ret = call_int_hook(inode_remove_fscaps, 0, idmap, dentry);
+ if (ret)
+ return ret;
+ return evm_inode_remove_fscaps(dentry);
}

/**

--
2.43.0