^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /* CacheFiles security management
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Written by David Howells (dhowells@redhat.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/fs.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/cred.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include "internal.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * determine the security context within which we access the cache from within
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * the kernel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) int cachefiles_get_security_ID(struct cachefiles_cache *cache)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) struct cred *new;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) _enter("{%s}", cache->secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) new = prepare_kernel_cred(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) if (!new) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) if (cache->secctx) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) ret = set_security_override_from_ctx(new, cache->secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) put_cred(new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) pr_err("Security denies permission to nominate security context: error %d\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) cache->cache_cred = new;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) _leave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) * see if mkdir and create can be performed in the root directory
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) struct dentry *root)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) ret = security_inode_mkdir(d_backing_inode(root), root, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) pr_err("Security denies permission to make dirs: error %d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) ret = security_inode_create(d_backing_inode(root), root, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) pr_err("Security denies permission to create files: error %d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * check the security details of the on-disk cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) * - must be called with security override in force
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * - must return with a security override in force - even in the case of an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) * error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) struct dentry *root,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) const struct cred **_saved_cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct cred *new;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) _enter("");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) /* duplicate the cache creds for COW (the override is currently in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) * force, so we can use prepare_creds() to do this) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) new = prepare_creds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) if (!new)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) cachefiles_end_secure(cache, *_saved_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) /* use the cache root dir's security context as the basis with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) * which create files */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) ret = set_create_files_as(new, d_backing_inode(root));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) abort_creds(new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) cachefiles_begin_secure(cache, _saved_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) _leave(" = %d [cfa]", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) put_cred(cache->cache_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) cache->cache_cred = new;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) cachefiles_begin_secure(cache, _saved_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) ret = cachefiles_check_cache_dir(cache, root);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) if (ret == -EOPNOTSUPP)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) _leave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags