]> www.infradead.org Git - users/jedix/linux-maple.git/commit
landlock: Prepare to use credential instead of domain for fowner
authorMickaël Salaün <mic@digikod.net>
Thu, 20 Mar 2025 19:06:56 +0000 (20:06 +0100)
committerMickaël Salaün <mic@digikod.net>
Wed, 26 Mar 2025 12:59:37 +0000 (13:59 +0100)
commit79625f1b3a3df63d3289a0781fdf121bc42966f7
treedfa07c48a247c97196ffab5256cafeea8f82bc0e
parent8d20efa9dc6cb471b71fd388923753f767ab13ce
landlock: Prepare to use credential instead of domain for fowner

This cosmetic change is needed for audit support, specifically to be
able to filter according to cross-execution boundaries.

struct landlock_file_security's size stay the same for now but it will
increase with struct landlock_cred_security's size.

Only save Landlock domain in hook_file_set_fowner() if the current
domain has LANDLOCK_SCOPE_SIGNAL, which was previously done for each
hook_file_send_sigiotask() calls.  This should improve a bit
performance.

Replace hardcoded LANDLOCK_SCOPE_SIGNAL with the signal_scope.scope
variable.

Use scoped guards for RCU read-side critical sections.

Cc: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-8-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
security/landlock/fs.c
security/landlock/fs.h
security/landlock/task.c