diff options
| author | Roberto Sassu <roberto.sassu@huawei.com> | 2024-02-15 11:31:02 +0100 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-02-15 23:43:43 -0500 |
| commit | 08abce60d63fb55f440c393f4508e99064f2fd91 (patch) | |
| tree | bc903aa7b37fbbb9c9f71a5b705838b18c0b4489 /fs | |
| parent | f09068b5a114ed28d2df2e82a7d30dde0145dc69 (diff) | |
| download | linux-stable-08abce60d63fb55f440c393f4508e99064f2fd91.tar.gz linux-stable-08abce60d63fb55f440c393f4508e99064f2fd91.tar.bz2 linux-stable-08abce60d63fb55f440c393f4508e99064f2fd91.zip | |
security: Introduce path_post_mknod hook
In preparation for moving IMA and EVM to the LSM infrastructure, introduce
the path_post_mknod hook.
IMA-appraisal requires all existing files in policy to have a file
hash/signature stored in security.ima. An exception is made for empty files
created by mknod, by tagging them as new files.
LSMs could also take some action after files are created.
The new hook cannot return an error and cannot cause the operation to be
reverted.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Acked-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/namei.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/namei.c b/fs/namei.c index ef867f1d6704..9280aa5d60a7 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -4063,6 +4063,11 @@ retry: dentry, mode, 0); break; } + + if (error) + goto out2; + + security_path_post_mknod(idmap, dentry); out2: done_path_create(&path, dentry); if (retry_estale(error, lookup_flags)) { |