security, overlayfs: provide copy up security hook for unioned files

Provide a security hook to label new file correctly when a file is copied
up from lower layer to upper layer of a overlay/union mount.

This hook can prepare a new set of creds which are suitable for new file
creation during copy up. Caller will use new creds to create file and then
revert back to old creds and release new creds.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: whitespace cleanup to appease checkpatch.pl]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Orabug: 25684456

(backport upstream commit d8ad8b49618410ddeafd78465b63a6cedd6c9484)

Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Conflict fix:
	include/linux/security.h
	security/security.c
	security/capability.c

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 779be609abce4ca849bab8c95c01f897b384c37d..2f149dc68e01e8032d334947a7a9df85f4d5cf58 100644 (file)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -215,6 +215,8 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
        struct dentry *upper = NULL;
        umode_t mode = stat->mode;
        int err;
+       const struct cred *old_creds = NULL;
+       struct cred *new_creds = NULL;
 
        newdentry = ovl_lookup_temp(workdir, dentry);
        err = PTR_ERR(newdentry);
@@ -227,10 +229,23 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
        if (IS_ERR(upper))
                goto out1;
 
+       err = security_inode_copy_up(dentry, &new_creds);
+       if (err < 0)
+               goto out2;
+
+       if (new_creds)
+               old_creds = override_creds(new_creds);
+
        /* Can't properly set mode on creation because of the umask */
        stat->mode &= S_IFMT;
        err = ovl_create_real(wdir, newdentry, stat, link, NULL, true);
        stat->mode = mode;
+
+       if (new_creds) {
+               revert_creds(old_creds);
+               put_cred(new_creds);
+       }
+
        if (err)
                goto out2;
 

diff --git a/include/linux/security.h b/include/linux/security.h
index 00b7bbf2311efd0e1cefd8946ce238cb9525510f..3a32ec884ba2e1e4527a05188bbeec7bcf506605 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -562,6 +562,15 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *     @inode contains a pointer to the inode.
  *     @secid contains a pointer to the location where result will be saved.
  *     In case of failure, @secid will be set to zero.
+ * @inode_copy_up:
+ *     A file is about to be copied up from lower layer to upper layer of
+ *     overlay filesystem. Security module can prepare a set of new creds
+ *     and modify as need be and return new creds. Caller will switch to
+ *     new creds temporarily to create new file and release newly allocated
+ *     creds.
+ *     @src indicates the union dentry of file that is being copied up.
+ *     @new pointer to pointer to return newly allocated creds.
+ *     Returns 0 on success or a negative error code on error.
  *
  * Security hooks for file operations
  *
@@ -1570,6 +1579,7 @@ struct security_operations {
        int (*inode_setsecurity) (struct inode *inode, const char *name, const void *value, size_t size, int flags);
        int (*inode_listsecurity) (struct inode *inode, char *buffer, size_t buffer_size);
        void (*inode_getsecid) (const struct inode *inode, u32 *secid);
+       int (*inode_copy_up)(struct dentry *src, struct cred **new);
 
        int (*file_permission) (struct file *file, int mask);
        int (*file_alloc_security) (struct file *file);
@@ -1856,6 +1866,7 @@ int security_inode_getsecurity(const struct inode *inode, const char *name, void
 int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
 int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
 void security_inode_getsecid(const struct inode *inode, u32 *secid);
+int security_inode_copy_up(struct dentry *src, struct cred **new);
 int security_file_permission(struct file *file, int mask);
 int security_file_alloc(struct file *file);
 void security_file_free(struct file *file);
@@ -2320,6 +2331,11 @@ static inline void security_inode_getsecid(const struct inode *inode, u32 *secid
        *secid = 0;
 }
 
+static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
+{
+       return 0;
+}
+
 static inline int security_file_permission(struct file *file, int mask)
 {
        return 0;

diff --git a/security/capability.c b/security/capability.c
index 0d03fcc489a49ee3221b1369ca2c1ff931c691cd..359fd2f3013006e356e27ffdf13e299c75f7ae59 100644 (file)
--- a/security/capability.c
+++ b/security/capability.c
@@ -268,6 +268,11 @@ static void cap_inode_getsecid(const struct inode *inode, u32 *secid)
        *secid = 0;
 }
 
+static int cap_inode_copy_up(struct dentry *src, struct cred **new)
+{
+       return 0;
+}
+
 #ifdef CONFIG_SECURITY_PATH
 static int cap_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
                          unsigned int dev)
@@ -1008,6 +1013,7 @@ void __init security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, inode_setsecurity);
        set_to_cap_if_null(ops, inode_listsecurity);
        set_to_cap_if_null(ops, inode_getsecid);
+       set_to_cap_if_null(ops, inode_copy_up);
 #ifdef CONFIG_SECURITY_PATH
        set_to_cap_if_null(ops, path_mknod);
        set_to_cap_if_null(ops, path_mkdir);

diff --git a/security/security.c b/security/security.c
index 391496b0c87741483ca3bb5114ffb50d6e8b09dd..85bf122235dcd948741297ab87627ffff4f3a724 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -706,6 +706,12 @@ void security_inode_getsecid(const struct inode *inode, u32 *secid)
        security_ops->inode_getsecid(inode, secid);
 }
 
+int security_inode_copy_up(struct dentry *src, struct cred **new)
+{
+       security_ops->inode_copy_up(src, new);
+}
+EXPORT_SYMBOL(security_inode_copy_up);
+
 int security_file_permission(struct file *file, int mask)
 {
        int ret;