path: root/security
diff options
authorDavid Howells <dhowells@redhat.com>2018-11-01 23:07:24 +0000
committerAl Viro <viro@zeniv.linux.org.uk>2019-02-28 03:29:23 -0500
commitda2441fdffbf7602da702aea5bd95ca4dc3d63fc (patch)
tree75443f82b5b8b1e9dc8c5d83e1f232a663455bbd /security
parentvfs: Add configuration parser helpers (diff)
vfs: Add LSM hooks for the new mount API
Add LSM hooks for use by the new mount API and filesystem context code. This includes: (1) Hooks to handle allocation, duplication and freeing of the security record attached to a filesystem context. (2) A hook to snoop source specifications. There may be multiple of these if the filesystem supports it. They will to be local files/devices if fs_context::source_is_dev is true and will be something else, possibly remote server specifications, if false. (3) A hook to snoop superblock configuration options in key[=val] form. If the LSM decides it wants to handle it, it can suppress the option being passed to the filesystem. Note that 'val' may include commas and binary data with the fsopen patch. (4) A hook to perform validation and allocation after the configuration has been done but before the superblock is allocated and set up. (5) A hook to transfer the security from the context to a newly created superblock. (6) A hook to rule on whether a path point can be used as a mountpoint. These are intended to replace: security_sb_copy_data security_sb_kern_mount security_sb_mount security_sb_set_mnt_opts security_sb_clone_mnt_opts security_sb_parse_opts_str [AV -- some of the methods being replaced are already gone, some of the methods are not added for the lack of need] Signed-off-by: David Howells <dhowells@redhat.com> cc: linux-security-module@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'security')
1 files changed, 5 insertions, 0 deletions
diff --git a/security/security.c b/security/security.c
index f1b8d2587639..e5519488327d 100644
--- a/security/security.c
+++ b/security/security.c
@@ -374,6 +374,11 @@ void security_bprm_committed_creds(struct linux_binprm *bprm)
call_void_hook(bprm_committed_creds, bprm);
+int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param)
+ return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
int security_sb_alloc(struct super_block *sb)
return call_int_hook(sb_alloc_security, 0, sb);