[PATCH v3 -next 07/18] LSM: pass struct path and struct file to the inode posix acl hooks
From: Cai Xinchen
Date: Tue Oct 27 2026 - 07:43:34 EST
The inode_set_acl, inode_get_acl and inode_remove_acl hooks are
called from fs/posix_acl.c, whose helpers now hold a struct path and
used to derive the dentry from it just for the hook calls.
Convert the hooks and their SELinux, Smack, EVM and IMA
implementations to take a const struct path, keeping the idmap as a
separate argument. The implementations derive the dentry they still
need from the path, so this is a purely mechanical change with no
behavior change.
Also pass the struct file through which a posix acl operation is
requested, when there is one, so that LSMs can later authorize
file descriptor-based operations (fsetxattr(2), fgetxattr(2) and
fremovexattr(2) on the system.posix_acl_access and
system.posix_acl_default names, the *xattrat(2) syscalls with
AT_EMPTY_PATH, and io_uring's IORING_OP_FSETXATTR and
IORING_OP_FGETXATTR) with the rights available at open(2) time.
The file is threaded through vfs_set_acl(), vfs_get_acl(),
vfs_remove_acl(), do_set_acl() and do_get_acl(), and set to NULL
for path-based operations and for in-kernel users: overlayfs,
ecryptfs and the SMB server. No implementation uses the file yet,
so this part is a purely mechanical change with no behavior change
either.
Signed-off-by: Cai Xinchen <caixinchen1@xxxxxxxxxx>
---
fs/ecryptfs/inode.c | 5 ++--
fs/internal.h | 11 +++++---
fs/overlayfs/inode.c | 4 +--
fs/overlayfs/overlayfs.h | 6 +++--
fs/posix_acl.c | 26 +++++++++++-------
fs/smb/server/vfs.c | 2 +-
fs/xattr.c | 7 ++---
include/linux/lsm_hook_defs.h | 9 ++++---
include/linux/posix_acl.h | 14 +++++-----
include/linux/security.h | 25 +++++++++++-------
security/integrity/evm/evm_main.c | 22 ++++++++++------
security/integrity/ima/ima_appraise.c | 15 ++++++-----
security/security.c | 32 +++++++++++++---------
security/selinux/hooks.c | 17 +++++++-----
security/smack/smack_lsm.c | 38 ++++++++++++++++-----------
15 files changed, 140 insertions(+), 93 deletions(-)
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 782bcca83874..fcb5b4de897e 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -1097,7 +1097,8 @@ static struct posix_acl *ecryptfs_get_acl(const struct mnt_idmap *idmap,
{
struct path lower_path = ecryptfs_lower_path(dentry);
- return vfs_get_acl(idmap, &lower_path, posix_acl_xattr_name(type));
+ return vfs_get_acl(idmap, &lower_path, posix_acl_xattr_name(type),
+ NULL);
}
static int ecryptfs_set_acl(const struct mnt_idmap *idmap,
@@ -1109,7 +1110,7 @@ static int ecryptfs_set_acl(const struct mnt_idmap *idmap,
struct inode *lower_inode = d_inode(lower_path.dentry);
rc = vfs_set_acl(&nop_mnt_idmap, &lower_path,
- posix_acl_xattr_name(type), acl);
+ posix_acl_xattr_name(type), acl, NULL);
if (!rc)
fsstack_copy_attr_all(d_inode(dentry), lower_inode);
return rc;
diff --git a/fs/internal.h b/fs/internal.h
index e90de99de5ea..4ba895665889 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -307,20 +307,23 @@ int may_write_xattr(const struct mnt_idmap *idmap, struct inode *inode);
#ifdef CONFIG_FS_POSIX_ACL
int do_set_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, const void *kvalue, size_t size);
+ const char *acl_name, const void *kvalue, size_t size,
+ struct file *file);
ssize_t do_get_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, void *kvalue, size_t size);
+ const char *acl_name, void *kvalue, size_t size,
+ struct file *file);
#else
static inline int do_set_acl(const struct mnt_idmap *idmap,
const struct path *path, const char *acl_name,
- const void *kvalue, size_t size)
+ const void *kvalue, size_t size,
+ struct file *file)
{
return -EOPNOTSUPP;
}
static inline ssize_t do_get_acl(const struct mnt_idmap *idmap,
const struct path *path,
const char *acl_name, void *kvalue,
- size_t size)
+ size_t size, struct file *file)
{
return -EOPNOTSUPP;
}
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index c50c9899ab09..eb408284df08 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -414,7 +414,7 @@ struct posix_acl *ovl_get_acl_path(const struct path *path,
if (noperm)
real_acl = get_inode_acl(realinode, posix_acl_type(acl_name));
else
- real_acl = vfs_get_acl(idmap, path, acl_name);
+ real_acl = vfs_get_acl(idmap, path, acl_name, NULL);
if (IS_ERR_OR_NULL(real_acl))
return real_acl;
@@ -503,7 +503,7 @@ static int ovl_set_or_remove_acl(struct dentry *dentry, struct inode *inode,
ovl_path_lower(dentry, &realpath);
with_ovl_creds(dentry->d_sb)
real_acl = vfs_get_acl(mnt_idmap(realpath.mnt),
- &realpath, acl_name);
+ &realpath, acl_name, NULL);
if (IS_ERR(real_acl)) {
err = PTR_ERR(real_acl);
goto out;
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 9ffa985fe8f2..9e969ab6ec40 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -378,7 +378,8 @@ static inline int ovl_do_set_acl(struct ovl_fs *ofs, struct dentry *dentry,
.dentry = dentry,
};
- return vfs_set_acl(ovl_upper_mnt_idmap(ofs), &path, acl_name, acl);
+ return vfs_set_acl(ovl_upper_mnt_idmap(ofs), &path, acl_name, acl,
+ NULL);
}
static inline int ovl_do_remove_acl(struct ovl_fs *ofs, struct dentry *dentry,
@@ -389,7 +390,8 @@ static inline int ovl_do_remove_acl(struct ovl_fs *ofs, struct dentry *dentry,
.dentry = dentry,
};
- return vfs_remove_acl(ovl_upper_mnt_idmap(ofs), &path, acl_name);
+ return vfs_remove_acl(ovl_upper_mnt_idmap(ofs), &path, acl_name,
+ NULL);
}
static inline int ovl_do_rename_rd(struct renamedata *rd)
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 1dbc59f50932..487e17e91e2b 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -1085,6 +1085,7 @@ static int vfs_set_acl_idmapped_mnt(const struct mnt_idmap *idmap,
* @path: the path based on which to set the posix acls
* @acl_name: the name of the posix acl
* @kacl: the posix acls in the appropriate VFS format
+ * @file: file through which the posix acls are set, or NULL
*
* This function sets @kacl. The caller must all posix_acl_release() on @kacl
* afterwards.
@@ -1092,7 +1093,8 @@ static int vfs_set_acl_idmapped_mnt(const struct mnt_idmap *idmap,
* Return: On success 0, on error negative errno.
*/
int vfs_set_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, struct posix_acl *kacl)
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file)
{
struct dentry *dentry = path->dentry;
int acl_type;
@@ -1128,7 +1130,7 @@ int vfs_set_acl(const struct mnt_idmap *idmap, const struct path *path,
if (error)
goto out_inode_unlock;
- error = security_inode_set_acl(idmap, dentry, acl_name, kacl);
+ error = security_inode_set_acl(idmap, path, acl_name, kacl, file);
if (error)
goto out_inode_unlock;
@@ -1163,6 +1165,7 @@ EXPORT_SYMBOL_GPL(vfs_set_acl);
* @idmap: idmap of the mount the posix acls are retrieved through
* @path: the path based on which to retrieve the posix acls
* @acl_name: the name of the posix acl
+ * @file: file through which the posix acls are retrieved, or NULL
*
* This function retrieves @kacl from the filesystem. The caller must all
* posix_acl_release() on @kacl.
@@ -1171,7 +1174,7 @@ EXPORT_SYMBOL_GPL(vfs_set_acl);
*/
struct posix_acl *vfs_get_acl(const struct mnt_idmap *idmap,
const struct path *path,
- const char *acl_name)
+ const char *acl_name, struct file *file)
{
struct dentry *dentry = path->dentry;
struct inode *inode = d_inode(dentry);
@@ -1186,7 +1189,7 @@ struct posix_acl *vfs_get_acl(const struct mnt_idmap *idmap,
* The VFS has no restrictions on reading POSIX ACLs so calling
* something like xattr_permission() isn't needed. Only LSMs get a say.
*/
- error = security_inode_get_acl(idmap, dentry, acl_name);
+ error = security_inode_get_acl(idmap, path, acl_name, file);
if (error)
return ERR_PTR(error);
@@ -1210,13 +1213,14 @@ EXPORT_SYMBOL_GPL(vfs_get_acl);
* @idmap: idmap of the mount the posix acls are removed through
* @path: the path based on which to retrieve the posix acls
* @acl_name: the name of the posix acl
+ * @file: file through which the posix acls are removed, or NULL
*
* This function removes posix acls.
*
* Return: On success 0, on error negative errno.
*/
int vfs_remove_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name)
+ const char *acl_name, struct file *file)
{
struct dentry *dentry = path->dentry;
int acl_type;
@@ -1239,7 +1243,7 @@ int vfs_remove_acl(const struct mnt_idmap *idmap, const struct path *path,
if (error)
goto out_inode_unlock;
- error = security_inode_remove_acl(idmap, dentry, acl_name);
+ error = security_inode_remove_acl(idmap, path, acl_name, file);
if (error)
goto out_inode_unlock;
@@ -1270,7 +1274,8 @@ int vfs_remove_acl(const struct mnt_idmap *idmap, const struct path *path,
EXPORT_SYMBOL_GPL(vfs_remove_acl);
int do_set_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, const void *kvalue, size_t size)
+ const char *acl_name, const void *kvalue, size_t size,
+ struct file *file)
{
int error;
struct posix_acl *acl = NULL;
@@ -1285,18 +1290,19 @@ int do_set_acl(const struct mnt_idmap *idmap, const struct path *path,
return PTR_ERR(acl);
}
- error = vfs_set_acl(idmap, path, acl_name, acl);
+ error = vfs_set_acl(idmap, path, acl_name, acl, file);
posix_acl_release(acl);
return error;
}
ssize_t do_get_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, void *kvalue, size_t size)
+ const char *acl_name, void *kvalue, size_t size,
+ struct file *file)
{
ssize_t error;
struct posix_acl *acl;
- acl = vfs_get_acl(idmap, path, acl_name);
+ acl = vfs_get_acl(idmap, path, acl_name, file);
if (IS_ERR(acl))
return PTR_ERR(acl);
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index cfb9a811363e..54b5f17995c3 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1564,7 +1564,7 @@ int ksmbd_vfs_remove_acl_xattrs(const struct mnt_idmap *idmap,
sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1) ||
!strncmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1)) {
- err = vfs_remove_acl(idmap, path, name);
+ err = vfs_remove_acl(idmap, path, name, NULL);
if (err)
ksmbd_debug(SMB,
"remove acl xattr failed : %s\n", name);
diff --git a/fs/xattr.c b/fs/xattr.c
index 747c041e66fa..7ef3d28e5979 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -670,7 +670,7 @@ static int do_setxattr(const struct mnt_idmap *idmap, const struct path *path,
{
if (is_posix_acl_xattr(ctx->kname->name))
return do_set_acl(idmap, path, ctx->kname->name,
- ctx->kvalue, ctx->size);
+ ctx->kvalue, ctx->size, file);
return vfs_setxattr(idmap, path, ctx->kname->name,
ctx->kvalue, ctx->size, ctx->flags, file);
@@ -816,7 +816,8 @@ do_getxattr(const struct mnt_idmap *idmap, const struct path *path,
}
if (is_posix_acl_xattr(kname))
- error = do_get_acl(idmap, path, kname, kvalue, ctx->size);
+ error = do_get_acl(idmap, path, kname, kvalue,
+ ctx->size, file);
else
error = vfs_getxattr(idmap, path, kname, kvalue,
ctx->size, file);
@@ -1048,7 +1049,7 @@ removexattr(const struct mnt_idmap *idmap, const struct path *path,
const char *name, struct file *file)
{
if (is_posix_acl_xattr(name))
- return vfs_remove_acl(idmap, path, name);
+ return vfs_remove_acl(idmap, path, name, file);
return vfs_removexattr(idmap, path, name, file);
}
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 2315961b6d71..8b191df5b169 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -171,13 +171,16 @@ LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry,
LSM_HOOK(int, 0, inode_file_setattr, struct dentry *dentry, struct file_kattr *fa)
LSM_HOOK(int, 0, inode_file_getattr, struct dentry *dentry, struct file_kattr *fa)
LSM_HOOK(int, 0, inode_set_acl, const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name, struct posix_acl *kacl)
+ const struct path *path, const char *acl_name,
+ struct posix_acl *kacl, struct file *file)
LSM_HOOK(void, LSM_RET_VOID, inode_post_set_acl, struct dentry *dentry,
const char *acl_name, struct posix_acl *kacl)
LSM_HOOK(int, 0, inode_get_acl, const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path, const char *acl_name,
+ struct file *file)
LSM_HOOK(int, 0, inode_remove_acl, const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path, const char *acl_name,
+ struct file *file)
LSM_HOOK(void, LSM_RET_VOID, inode_post_remove_acl, const struct mnt_idmap *idmap,
struct dentry *dentry, const char *acl_name)
LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry)
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index 4bd2ed8378c9..f5e381553fee 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -106,12 +106,13 @@ static inline void cache_no_acl(struct inode *inode)
}
int vfs_set_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name, struct posix_acl *kacl);
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file);
struct posix_acl *vfs_get_acl(const struct mnt_idmap *idmap,
const struct path *path,
- const char *acl_name);
+ const char *acl_name, struct file *file);
int vfs_remove_acl(const struct mnt_idmap *idmap, const struct path *path,
- const char *acl_name);
+ const char *acl_name, struct file *file);
int posix_acl_listxattr(struct inode *inode, char **buffer,
ssize_t *remaining_size);
#else
@@ -144,21 +145,22 @@ static inline void forget_all_cached_acls(struct inode *inode)
static inline int vfs_set_acl(const struct mnt_idmap *idmap,
const struct path *path, const char *name,
- struct posix_acl *acl)
+ struct posix_acl *acl, struct file *file)
{
return -EOPNOTSUPP;
}
static inline struct posix_acl *vfs_get_acl(const struct mnt_idmap *idmap,
const struct path *path,
- const char *acl_name)
+ const char *acl_name,
+ struct file *file)
{
return ERR_PTR(-EOPNOTSUPP);
}
static inline int vfs_remove_acl(const struct mnt_idmap *idmap,
const struct path *path,
- const char *acl_name)
+ const char *acl_name, struct file *file)
{
return -EOPNOTSUPP;
}
diff --git a/include/linux/security.h b/include/linux/security.h
index 35693bc328d3..27291542a7e2 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -441,14 +441,16 @@ int security_inode_setxattr(const struct mnt_idmap *idmap,
const void *value, size_t size, int flags,
struct file *file);
int security_inode_set_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name,
- struct posix_acl *kacl);
+ const struct path *path, const char *acl_name,
+ struct posix_acl *kacl, struct file *file);
void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
struct posix_acl *kacl);
int security_inode_get_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name);
+ const struct path *path, const char *acl_name,
+ struct file *file);
int security_inode_remove_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name);
+ const struct path *path, const char *acl_name,
+ struct file *file);
void security_inode_post_remove_acl(const struct mnt_idmap *idmap,
struct dentry *dentry,
const char *acl_name);
@@ -1028,9 +1030,10 @@ static inline int security_inode_setxattr(const struct mnt_idmap *idmap,
}
static inline int security_inode_set_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry,
+ const struct path *path,
const char *acl_name,
- struct posix_acl *kacl)
+ struct posix_acl *kacl,
+ struct file *file)
{
return 0;
}
@@ -1041,15 +1044,17 @@ static inline void security_inode_post_set_acl(struct dentry *dentry,
{ }
static inline int security_inode_get_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry,
- const char *acl_name)
+ const struct path *path,
+ const char *acl_name,
+ struct file *file)
{
return 0;
}
static inline int security_inode_remove_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry,
- const char *acl_name)
+ const struct path *path,
+ const char *acl_name,
+ struct file *file)
{
return 0;
}
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 2e1978cbe369..5c24111a9ba7 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -690,10 +690,11 @@ static inline int evm_inode_set_acl_change(const struct mnt_idmap *idmap,
/**
* evm_inode_set_acl - protect the EVM extended attribute from posix acls
- * @idmap: idmap of the idmapped mount
- * @dentry: pointer to the affected dentry
+ * @idmap: idmap of the mount
+ * @path: pointer to the affected object
* @acl_name: name of the posix acl
* @kacl: pointer to the posix acls
+ * @file: file through which the posix acls are set, if any
*
* Prevent modifying posix acls causing the EVM HMAC to be re-calculated
* and 'security.evm' xattr updated, unless the existing 'security.evm' is
@@ -701,10 +702,13 @@ static inline int evm_inode_set_acl_change(const struct mnt_idmap *idmap,
*
* Return: zero on success, -EPERM on failure.
*/
-static int evm_inode_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
- const char *acl_name, struct posix_acl *kacl)
+static int evm_inode_set_acl(const struct mnt_idmap *idmap,
+ const struct path *path,
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file)
{
enum integrity_status evm_status;
+ struct dentry *dentry = path->dentry;
/* Policy permits modification of the protected xattrs even though
* there's no HMAC key loaded
@@ -744,8 +748,9 @@ static int evm_inode_set_acl(const struct mnt_idmap *idmap, struct dentry *dentr
/**
* evm_inode_remove_acl - Protect the EVM extended attribute from posix acls
* @idmap: idmap of the mount
- * @dentry: pointer to the affected dentry
+ * @path: pointer to the affected object
* @acl_name: name of the posix acl
+ * @file: file through which the posix acls are removed, if any
*
* Prevent removing posix acls causing the EVM HMAC to be re-calculated
* and 'security.evm' xattr updated, unless the existing 'security.evm' is
@@ -753,10 +758,11 @@ static int evm_inode_set_acl(const struct mnt_idmap *idmap, struct dentry *dentr
*
* Return: zero on success, -EPERM on failure.
*/
-static int evm_inode_remove_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
- const char *acl_name)
+static int evm_inode_remove_acl(const struct mnt_idmap *idmap,
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
- return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
+ return evm_inode_set_acl(idmap, path, acl_name, NULL, file);
}
static void evm_reset_status(struct inode *inode)
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index ebf050195cf0..a231f1f419f7 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -795,11 +795,13 @@ static int ima_inode_setxattr(const struct mnt_idmap *idmap,
return result;
}
-static int ima_inode_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
- const char *acl_name, struct posix_acl *kacl)
+static int ima_inode_set_acl(const struct mnt_idmap *idmap,
+ const struct path *path,
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file)
{
if (evm_revalidate_status(acl_name))
- ima_reset_appraise_flags(d_backing_inode(dentry), -1);
+ ima_reset_appraise_flags(d_backing_inode(path->dentry), -1);
return 0;
}
@@ -821,10 +823,11 @@ static int ima_inode_removexattr(const struct mnt_idmap *idmap,
return result;
}
-static int ima_inode_remove_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
- const char *acl_name)
+static int ima_inode_remove_acl(const struct mnt_idmap *idmap,
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
- return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
+ return ima_inode_set_acl(idmap, path, acl_name, NULL, file);
}
static struct security_hook_list ima_appraise_hooks[] __ro_after_init = {
diff --git a/security/security.c b/security/security.c
index 83132d40cc9c..af1777f2aa5e 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1970,9 +1970,10 @@ int security_inode_setxattr(const struct mnt_idmap *idmap,
/**
* security_inode_set_acl() - Check if setting posix acls is allowed
* @idmap: idmap of the mount
- * @dentry: file
+ * @path: file (the VFS makes no guarantees with regard to @path->mnt)
* @acl_name: acl name
* @kacl: acl struct
+ * @file: file through which the posix acls are set, if any
*
* Check permission before setting posix acls, the posix acls in @kacl are
* identified by @acl_name.
@@ -1980,12 +1981,13 @@ int security_inode_setxattr(const struct mnt_idmap *idmap,
* Return: Returns 0 if permission is granted.
*/
int security_inode_set_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name,
- struct posix_acl *kacl)
+ const struct path *path, const char *acl_name,
+ struct posix_acl *kacl, struct file *file)
{
- if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
+ if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
return 0;
- return call_int_hook(inode_set_acl, idmap, dentry, acl_name, kacl);
+ return call_int_hook(inode_set_acl, idmap, path, acl_name, kacl,
+ file);
}
/**
@@ -2008,8 +2010,9 @@ void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
/**
* security_inode_get_acl() - Check if reading posix acls is allowed
* @idmap: idmap of the mount
- * @dentry: file
+ * @path: file (the VFS makes no guarantees with regard to @path->mnt)
* @acl_name: acl name
+ * @file: file through which the posix acls are retrieved, if any
*
* Check permission before getting osix acls, the posix acls are identified by
* @acl_name.
@@ -2017,18 +2020,20 @@ void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
* Return: Returns 0 if permission is granted.
*/
int security_inode_get_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path, const char *acl_name,
+ struct file *file)
{
- if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
+ if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
return 0;
- return call_int_hook(inode_get_acl, idmap, dentry, acl_name);
+ return call_int_hook(inode_get_acl, idmap, path, acl_name, file);
}
/**
* security_inode_remove_acl() - Check if removing a posix acl is allowed
* @idmap: idmap of the mount
- * @dentry: file
+ * @path: file (the VFS makes no guarantees with regard to @path->mnt)
* @acl_name: acl name
+ * @file: file through which the posix acls are removed, if any
*
* Check permission before removing posix acls, the posix acls are identified
* by @acl_name.
@@ -2036,11 +2041,12 @@ int security_inode_get_acl(const struct mnt_idmap *idmap,
* Return: Returns 0 if permission is granted.
*/
int security_inode_remove_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path, const char *acl_name,
+ struct file *file)
{
- if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
+ if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
return 0;
- return call_int_hook(inode_remove_acl, idmap, dentry, acl_name);
+ return call_int_hook(inode_remove_acl, idmap, path, acl_name, file);
}
/**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4a88bcdbd99a..2b5efe041bc1 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3477,22 +3477,25 @@ static int selinux_inode_setxattr(const struct mnt_idmap *idmap,
}
static int selinux_inode_set_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name,
- struct posix_acl *kacl)
+ const struct path *path,
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file)
{
- return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+ return dentry_has_perm(current_cred(), path->dentry, FILE__SETATTR);
}
static int selinux_inode_get_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
- return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
+ return dentry_has_perm(current_cred(), path->dentry, FILE__GETATTR);
}
static int selinux_inode_remove_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
- return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+ return dentry_has_perm(current_cred(), path->dentry, FILE__SETATTR);
}
static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index f739756acb3e..e3445a4f6a45 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1551,68 +1551,74 @@ static int smack_inode_removexattr(const struct mnt_idmap *idmap,
/**
* smack_inode_set_acl - Smack check for setting posix acls
* @idmap: idmap of the mnt this request came from
- * @dentry: the object
+ * @path: the object
* @acl_name: name of the posix acl
* @kacl: the posix acls
+ * @file: file through which the posix acls are set, if any
*
* Returns 0 if access is permitted, an error code otherwise
*/
static int smack_inode_set_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name,
- struct posix_acl *kacl)
+ const struct path *path,
+ const char *acl_name, struct posix_acl *kacl,
+ struct file *file)
{
struct smk_audit_info ad;
int rc;
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
- smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+ smk_ad_setfield_u_fs_path_dentry(&ad, path->dentry);
- rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
- rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
+ rc = smk_curacc(smk_of_inode(d_backing_inode(path->dentry)), MAY_WRITE, &ad);
+ rc = smk_bu_inode(d_backing_inode(path->dentry), MAY_WRITE, rc);
return rc;
}
/**
* smack_inode_get_acl - Smack check for getting posix acls
* @idmap: idmap of the mnt this request came from
- * @dentry: the object
+ * @path: the object
* @acl_name: name of the posix acl
+ * @file: file through which the posix acls are retrieved, if any
*
* Returns 0 if access is permitted, an error code otherwise
*/
static int smack_inode_get_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
struct smk_audit_info ad;
int rc;
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
- smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+ smk_ad_setfield_u_fs_path_dentry(&ad, path->dentry);
- rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
- rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
+ rc = smk_curacc(smk_of_inode(d_backing_inode(path->dentry)), MAY_READ, &ad);
+ rc = smk_bu_inode(d_backing_inode(path->dentry), MAY_READ, rc);
return rc;
}
/**
* smack_inode_remove_acl - Smack check for getting posix acls
* @idmap: idmap of the mnt this request came from
- * @dentry: the object
+ * @path: the object
* @acl_name: name of the posix acl
+ * @file: file through which the posix acls are removed, if any
*
* Returns 0 if access is permitted, an error code otherwise
*/
static int smack_inode_remove_acl(const struct mnt_idmap *idmap,
- struct dentry *dentry, const char *acl_name)
+ const struct path *path,
+ const char *acl_name, struct file *file)
{
struct smk_audit_info ad;
int rc;
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
- smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+ smk_ad_setfield_u_fs_path_dentry(&ad, path->dentry);
- rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
- rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
+ rc = smk_curacc(smk_of_inode(d_backing_inode(path->dentry)), MAY_WRITE, &ad);
+ rc = smk_bu_inode(d_backing_inode(path->dentry), MAY_WRITE, rc);
return rc;
}
--
2.18.0.huawei.25