bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

lsm: introduce new hooks for setting/getting inode fsxattr

Browse Source 
Introduce new hooks for setting and getting filesystem extended
attributes on inode (FS_IOC_FSGETXATTR).

Cc: selinux@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>

Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-2-c4e3bc35227b@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Andrey Albershteyn
2025-06-30 18:20:12 +02:00
committed by Christian Brauner
parent 2f952c9e8f
commit defdd02d78
4 changed files with 66 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
security/security.c
View File

@@ -2622,6 +2622,36 @@ void security_inode_post_removexattr(struct dentry *dentry, const char *name)
call_void_hook(inode_post_removexattr, dentry, name);
}
/**
* security_inode_file_setattr() - check if setting fsxattr is allowed
* @dentry: file to set filesystem extended attributes on
* @fa: extended attributes to set on the inode
*
* Called when file_setattr() syscall or FS_IOC_FSSETXATTR ioctl() is called on
* inode
*
* Return: Returns 0 if permission is granted.
*/
int security_inode_file_setattr(struct dentry *dentry, struct fileattr *fa)
{
return call_int_hook(inode_file_setattr, dentry, fa);
}
/**
* security_inode_file_getattr() - check if retrieving fsxattr is allowed
* @dentry: file to retrieve filesystem extended attributes from
* @fa: extended attributes to get
*
* Called when file_getattr() syscall or FS_IOC_FSGETXATTR ioctl() is called on
* inode
*
* Return: Returns 0 if permission is granted.
*/
int security_inode_file_getattr(struct dentry *dentry, struct fileattr *fa)
{
return call_int_hook(inode_file_getattr, dentry, fa);
}
/**
* security_inode_need_killpriv() - Check if security_inode_killpriv() required
* @dentry: associated dentry