From: Kentaro Takeda <takedakn@nttdata.co.jp>
To: akpm@linux-foundation.org
Cc: linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Subject: [TOMOYO #6 retry 03/21] Add wrapper functions for VFS helper functions.
Date: Wed, 09 Jan 2008 09:53:23 +0900 [thread overview]
Message-ID: <20080109005418.967825467@nttdata.co.jp> (raw)
In-Reply-To: 20080109005320.323184643@nttdata.co.jp
This patch allows LSM hooks refer previously associated "struct vfsmount"
parameter so that they can calculate pathname of given "struct dentry".
AppArmor's approach is to add "struct vfsmount" parameter to all related
functions, while my approach is to store "struct vfsmount" parameter
in "struct task_struct". My approach resembles to "syscall auditing" because
"syscall auditing" saves parameters at the entrance of a system call
in "struct audit_context" of "struct task_struct"
instead of adding parameters needed for auditing to all functions.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
include/linux/fs.h | 138 +++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 138 insertions(+)
--- linux-2.6-mm.orig/include/linux/fs.h
+++ linux-2.6-mm/include/linux/fs.h
@@ -1081,6 +1081,116 @@ extern int vfs_rmdir(struct inode *, str
extern int vfs_unlink(struct inode *, struct dentry *);
extern int vfs_rename(struct inode *, struct dentry *, struct inode *, struct dentry *);
+#include <linux/mount.h>
+#include <linux/sched.h>
+
+static inline int vfs_create2(struct inode *dir, struct dentry *dentry,
+ int mode, struct nameidata *nd)
+{
+ int ret;
+ struct vfsmount *mnt = nd ? nd->path.mnt : NULL;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_create(dir, dentry, mode, nd);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_mkdir2(struct inode *dir, struct dentry *dentry,
+ struct vfsmount *mnt, int mode)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_mkdir(dir, dentry, mode);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_mknod2(struct inode *dir, struct dentry *dentry,
+ struct vfsmount *mnt, int mode, dev_t dev)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_mknod(dir, dentry, mode, dev);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_symlink2(struct inode *dir, struct dentry *dentry,
+ struct vfsmount *mnt, const char *oldname,
+ int mode)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_symlink(dir, dentry, oldname, mode);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_link2(struct dentry *old_dentry, struct inode *dir,
+ struct dentry *new_dentry, struct vfsmount *mnt)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_link(old_dentry, dir, new_dentry);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_rmdir2(struct inode *dir, struct dentry *dentry,
+ struct vfsmount *mnt)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_rmdir(dir, dentry);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_unlink2(struct inode *dir, struct dentry *dentry,
+ struct vfsmount *mnt)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_unlink(dir, dentry);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
+static inline int vfs_rename2(struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_dir, struct dentry *new_dentry,
+ struct vfsmount *mnt)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = vfs_rename(old_dir, old_dentry, new_dir, new_dentry);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
/*
* VFS dentry helper functions.
*/
@@ -1558,6 +1668,21 @@ static inline int break_lease(struct ino
extern int do_truncate(struct dentry *, loff_t start, unsigned int time_attrs,
struct file *filp);
+
+static inline int do_truncate2(struct dentry *dentry, struct vfsmount *mnt,
+ loff_t length, unsigned int time_attrs,
+ struct file *filp)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = do_truncate(dentry, length, time_attrs, filp);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
extern long do_sys_open(int dfd, const char __user *filename, int flags,
int mode);
extern struct file * dentry_open(struct dentry *, struct vfsmount *, int);
@@ -1718,6 +1843,19 @@ extern int permission(struct inode *, in
extern int generic_permission(struct inode *, int,
int (*check_acl)(struct inode *, int));
+static inline int notify_change2(struct dentry *dentry, struct vfsmount *mnt,
+ struct iattr *attr)
+{
+ int ret;
+ struct task_struct *task = current;
+ struct vfsmount *prev_mnt = task->last_vfsmount;
+ task->last_vfsmount = mntget(mnt);
+ ret = notify_change(dentry, attr);
+ task->last_vfsmount = prev_mnt;
+ mntput(mnt);
+ return ret;
+}
+
extern int get_write_access(struct inode *);
extern int deny_write_access(struct file *);
static inline void put_write_access(struct inode * inode)
--
next prev parent reply other threads:[~2008-01-09 0:56 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-01-09 0:53 [TOMOYO #6 retry 00/21] TOMOYO Linux - MAC based on process invocation history Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 01/21] TOMOYO Linux documentation Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 02/21] Add struct vfsmount to struct task_struct Kentaro Takeda
2008-01-15 21:16 ` Serge E. Hallyn
2008-01-16 0:22 ` Kentaro Takeda
2008-01-16 14:39 ` Serge E. Hallyn
2008-01-17 4:55 ` Kentaro Takeda
2008-01-09 0:53 ` Kentaro Takeda [this message]
2008-01-09 0:53 ` [TOMOYO #6 retry 04/21] Replace VFS with wrapper functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 05/21] Add packet filtering based on processs security context Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 06/21] Data structures and prototype defitions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 07/21] Memory and pathname management functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 08/21] Utility functions and policy manipulation interface Kentaro Takeda
2008-01-09 4:25 ` James Morris
2008-01-09 4:29 ` James Morris
2008-01-12 2:06 ` [TOMOYO #6 retry 08/21] Utility functions and policy manipulationinterface Tetsuo Handa
2008-01-12 3:06 ` James Morris
2008-01-12 4:45 ` Greg KH
2008-01-12 7:34 ` [TOMOYO #6 retry 08/21] Utility functions and policymanipulationinterface Tetsuo Handa
2008-01-09 4:31 ` [TOMOYO #6 retry 08/21] Utility functions and policy manipulation interface Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 09/21] Domain transition functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 10/21] Auditing interface Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 11/21] File access control functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 12/21] argv0 check functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 13/21] environment variable name " Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 14/21] Network access control functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 15/21] Namespace manipulation " Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 16/21] Signal " Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 17/21] Capability access " Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 18/21] LSM adapter functions Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 19/21] Conditional permission support Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 20/21] Kconfig and Makefile Kentaro Takeda
2008-01-09 0:53 ` [TOMOYO #6 retry 21/21] Add signal hooks at sleepable location Kentaro Takeda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080109005418.967825467@nttdata.co.jp \
--to=takedakn@nttdata.co.jp \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox