Unverified Commit bd14e462 authored by Andrey Albershteyn's avatar Andrey Albershteyn Committed by Christian Brauner
Browse files

selinux: implement inode_file_[g|s]etattr hooks 



These hooks are called on inode extended attribute retrieval/change.

Cc: selinux@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>

Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarAndrey Albershteyn <aalbersh@kernel.org>
Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-3-c4e3bc35227b@kernel.org


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent defdd02d

security/selinux/hooks.c

+14 −0
Original line number Diff line number Diff line
@@ -3480,6 +3480,18 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap, 
	return -EACCES;

}



static int selinux_inode_file_setattr(struct dentry *dentry,

				      struct fileattr *fa)

{

	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);

}



static int selinux_inode_file_getattr(struct dentry *dentry,

				      struct fileattr *fa)

{

	return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);

}



static int selinux_path_notify(const struct path *path, u64 mask,

						unsigned int obj_type)

{
@@ -7350,6 +7362,8 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { 
	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),

	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),

	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),

	LSM_HOOK_INIT(inode_file_getattr, selinux_inode_file_getattr),

	LSM_HOOK_INIT(inode_file_setattr, selinux_inode_file_setattr),

	LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),

	LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),

	LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),