linux

iv/linux

History

Mickaël Salaün 63817febd1

landlock: Use f_cred in security_file_open() hook

Use landlock_cred(file->f_cred)->domain instead of
landlock_get_current_domain() in security_file_open() hook
implementation.

This should not change the current behavior but could avoid potential
race conditions in case of current task's credentials change.

This will also ensure consistency with upcoming audit support relying on
file->f_cred.

Add and use a new get_fs_domain() helper to mask non-filesystem domains.

file->f_cred is set by path_openat()/alloc_empty_file()/init_file() just
before calling security_file_alloc().

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240307095203.1467189-1-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

2024-03-08 18:22:16 +01:00

.kunitconfig

landlock: Add support for KUnit tests

2024-02-27 11:21:45 +01:00

common.h

landlock: Add support for KUnit tests

2024-02-27 11:21:45 +01:00

cred.c

LSM: Identify modules by more than name

2023-11-12 22:54:42 -05:00

cred.h

landlock: Format with clang-format