From 5d97173d2e8a1c19cab92df7937dec2055a274c2 Mon Sep 17 00:00:00 2001 From: Vivek Goyal Date: Wed, 13 Jul 2016 10:44:53 -0400 Subject: [PATCH] selinux: Implement dentry_create_files_as() hook Calculate what would be the label of newly created file and set that secid in the passed creds. Context of the task which is actually creating file is retrieved from set of creds passed in. (old->security). Signed-off-by: Vivek Goyal Acked-by: Stephen Smalley Signed-off-by: Paul Moore Orabug: 25684456 (backport upstream commit a518b0a5b0d7f3397e065acb956bca9635aa892d) Signed-off-by: Anand Jain Acked-by: James Morris Reviewed-by: James Morris Conflict fix: security/selinux/hooks.c --- security/selinux/hooks.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6a9513fcabc5..a3d06b3f4dbe 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2777,6 +2777,27 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode, return security_sid_to_context(newsid, (char **)ctx, ctxlen); } +static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, + struct qstr *name, + const struct cred *old, + struct cred *new) +{ + u32 newsid; + int rc; + struct task_security_struct *tsec; + + rc = selinux_determine_inode_label(old->security, + d_inode(dentry->d_parent), name, + inode_mode_to_security_class(mode), + &newsid); + if (rc) + return rc; + + tsec = new->security; + tsec->create_sid = newsid; + return 0; +} + static int selinux_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const char **name, @@ -5932,6 +5953,7 @@ static struct security_operations selinux_ops = { .sb_parse_opts_str = selinux_parse_opts_str, .dentry_init_security = selinux_dentry_init_security, + .dentry_create_files_as = selinux_dentry_create_files_as, .inode_alloc_security = selinux_inode_alloc_security, .inode_free_security = selinux_inode_free_security, -- 2.50.1