security: make LSMs explicitly mask off permissions

SELinux needs to pass the MAY_ACCESS flag so it can handle auditting
correctly.  Presently the masking of MAY_* flags is done in the VFS.  In
order to allow LSMs to decide what flags they care about and what flags
they don't just pass them all and the each LSM mask off what they don't
need.  This patch should contain no functional changes to either the VFS or
any LSM.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by:  Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/fs/namei.c b/fs/namei.c
index fe34c2b879f4be26c4483f019aa85812e281dce7..42d2d28fb827c41f5aad101e0faa340ac2dfa332 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -282,8 +282,7 @@ int inode_permission(struct inode *inode, int mask)
        if (retval)
                return retval;
 
-       return security_inode_permission(inode,
-                       mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
+       return security_inode_permission(inode, mask);
 }
 
 /**

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 85338f0c048127f317ec25e158ae439eb8a542ab..0c98846f188d4701eb2c22737587b62b951c9348 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2645,6 +2645,8 @@ static int selinux_inode_permission(struct inode *inode, int mask)
 {
        const struct cred *cred = current_cred();
 
+       mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
+
        if (!mask) {
                /* No permission to check.  Existence test. */
                return 0;

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 07abc9ce72f20bb393dfabae6d81412304b85d38..9192ba366a4c90971c11ed25904ee9bc7e4d675d 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -598,6 +598,8 @@ static int smack_inode_rename(struct inode *old_inode,
 static int smack_inode_permission(struct inode *inode, int mask)
 {
        struct smk_audit_info ad;
+
+       mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
        /*
         * No permission to check. Existence test. Yup, it's there.
         */