[PATCH] selinux: clean up binary mount data

From: James Morris <jmorris@redhat.com>

selinux is currently inspecting the filesystem name ("nfs" vs "coda" vs
watever) to work out whether it needs to hanbdle binary mount data.

Eliminate all that by adding a flag to file_system_type.fs_flags.

diff --git a/fs/afs/super.c b/fs/afs/super.c
index 6e225ff8564cc9a0472deb5b7d685d5bbf93d69a..bcf81d358df0bbc0b0635e2113472664513d75c1 100644 (file)
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -53,6 +53,7 @@ static struct file_system_type afs_fs_type = {
        .name           = "afs",
        .get_sb         = afs_get_sb,
        .kill_sb        = kill_anon_super,
+       .fs_flags       = FS_BINARY_MOUNTDATA,
 };
 
 static struct super_operations afs_super_ops = {

diff --git a/fs/coda/inode.c b/fs/coda/inode.c
index 7c6d48dc96774c896415d8daccb75a172ab751ca..35508b184aa51c3a01feb4f601b7f97a27ac4bf3 100644 (file)
--- a/fs/coda/inode.c
+++ b/fs/coda/inode.c
@@ -309,5 +309,6 @@ struct file_system_type coda_fs_type = {
        .name           = "coda",
        .get_sb         = coda_get_sb,
        .kill_sb        = kill_anon_super,
+       .fs_flags       = FS_BINARY_MOUNTDATA,
 };
 

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index f23707e5ecb264db626c3cd046f1ec02222327ef..6f7442bd799e820dcbade833c1519565dc5de117 100644 (file)
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1352,7 +1352,7 @@ static struct file_system_type nfs_fs_type = {
        .name           = "nfs",
        .get_sb         = nfs_get_sb,
        .kill_sb        = nfs_kill_super,
-       .fs_flags       = FS_ODD_RENAME|FS_REVAL_DOT,
+       .fs_flags       = FS_ODD_RENAME|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
 };
 
 #ifdef CONFIG_NFS_V4
@@ -1666,7 +1666,7 @@ static struct file_system_type nfs4_fs_type = {
        .name           = "nfs4",
        .get_sb         = nfs4_get_sb,
        .kill_sb        = nfs_kill_super,
-       .fs_flags       = FS_ODD_RENAME|FS_REVAL_DOT,
+       .fs_flags       = FS_ODD_RENAME|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
 };
 
 #define nfs4_zero_state(nfsi) \

diff --git a/fs/smbfs/inode.c b/fs/smbfs/inode.c
index e94e2cf594b688a926e2be9cb4d86d6d444006b1..02cf8f08500dc1784468ea7f4062c9d1b77adf13 100644 (file)
--- a/fs/smbfs/inode.c
+++ b/fs/smbfs/inode.c
@@ -779,6 +779,7 @@ static struct file_system_type smb_fs_type = {
        .name           = "smbfs",
        .get_sb         = smb_get_sb,
        .kill_sb        = kill_anon_super,
+       .fs_flags       = FS_BINARY_MOUNTDATA,
 };
 
 static int __init init_smb_fs(void)

diff --git a/fs/super.c b/fs/super.c
index a18c0672275fe122c8a0c9f7a8df1def9f7ce71e..780143fd912d2fad76a6a53e469f47385cff51f8 100644 (file)
--- a/fs/super.c
+++ b/fs/super.c
@@ -745,7 +745,7 @@ do_kern_mount(const char *fstype, int flags, const char *name, void *data)
                        goto out_mnt;
                }
 
-               error = security_sb_copy_data(fstype, data, secdata);
+               error = security_sb_copy_data(type, data, secdata);
                if (error) {
                        sb = ERR_PTR(error);
                        goto out_free_secdata;

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 514f61d08d81cb8840ab47170525b3d07b75bfb5..b424acbe1016fc22d8abc3201c9d3184b1fee924 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -89,6 +89,7 @@ extern int leases_enable, dir_notify_enable, lease_break_time;
 
 /* public flags for file_system_type */
 #define FS_REQUIRES_DEV 1 
+#define FS_BINARY_MOUNTDATA 2
 #define FS_REVAL_DOT   16384   /* Check the paths ".", ".." for staleness */
 #define FS_ODD_RENAME  32768   /* Temporary stuff; will go away as soon
                                  * as nfs_rename() will be cleaned up

diff --git a/include/linux/security.h b/include/linux/security.h
index 05d4684216110cfd5b1d4e58236006aae4d25965..9baa2ed4ac96954b0f2b426acd4b3cf0cb98ec31 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -177,7 +177,7 @@ struct swap_info_struct;
  *     options cleanly (a filesystem may modify the data e.g. with strsep()).
  *     This also allows the original mount data to be stripped of security-
  *     specific options to avoid having to make filesystems aware of them.
- *     @fstype the type of filesystem being mounted.
+ *     @type the type of filesystem being mounted.
  *     @orig the original mount data copied from userspace.
  *     @copy copied data which will be passed to the security module.
  *     Returns 0 if the copy was successful.
@@ -1033,7 +1033,8 @@ struct security_operations {
 
        int (*sb_alloc_security) (struct super_block * sb);
        void (*sb_free_security) (struct super_block * sb);
-       int (*sb_copy_data)(const char *fstype, void *orig, void *copy);
+       int (*sb_copy_data)(struct file_system_type *type,
+                           void *orig, void *copy);
        int (*sb_kern_mount) (struct super_block *sb, void *data);
        int (*sb_statfs) (struct super_block * sb);
        int (*sb_mount) (char *dev_name, struct nameidata * nd,
@@ -1318,9 +1319,10 @@ static inline void security_sb_free (struct super_block *sb)
        security_ops->sb_free_security (sb);
 }
 
-static inline int security_sb_copy_data (const char *fstype, void *orig, void *copy)
+static inline int security_sb_copy_data (struct file_system_type *type,
+                                        void *orig, void *copy)
 {
-       return security_ops->sb_copy_data (fstype, orig, copy);
+       return security_ops->sb_copy_data (type, orig, copy);
 }
 
 static inline int security_sb_kern_mount (struct super_block *sb, void *data)
@@ -1988,7 +1990,8 @@ static inline int security_sb_alloc (struct super_block *sb)
 static inline void security_sb_free (struct super_block *sb)
 { }
 
-static inline int security_sb_copy_data (const char *fstype, void *orig, void *copy)
+static inline int security_sb_copy_data (struct file_system_type *type,
+                                        void *orig, void *copy)
 {
        return 0;
 }

diff --git a/security/dummy.c b/security/dummy.c
index 32d43ccd06624c8a0e50694c23edb7bc534b34ba..35c29b1124ffaa4a5d1ea74b8f3354368a436062 100644 (file)
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -194,7 +194,8 @@ static void dummy_sb_free_security (struct super_block *sb)
        return;
 }
 
-static int dummy_sb_copy_data (const char *fstype, void *orig, void *copy)
+static int dummy_sb_copy_data (struct file_system_type *type,
+                              void *orig, void *copy)
 {
        return 0;
 }

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 302f86be2fa6f02c592a5d294820a5e9f955cbf9..7c41be689898dedf18a767e9761d7d6e31d8b668 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -331,25 +331,24 @@ static int try_context_mount(struct super_block *sb, void *data)
 
        name = sb->s_type->name;
 
-       /* Ignore these fileystems with binary mount option data. */
-       if (!strcmp(name, "coda") ||
-           !strcmp(name, "afs") || !strcmp(name, "smbfs"))
-               goto out;
+       if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 
-       /* NFS we understand. */
-       if (!strcmp(name, "nfs")) {
-               struct nfs_mount_data *d = data;
+               /* NFS we understand. */
+               if (!strcmp(name, "nfs")) {
+                       struct nfs_mount_data *d = data;
 
-               if (d->version <  NFS_MOUNT_VERSION)
-                       goto out;
+                       if (d->version <  NFS_MOUNT_VERSION)
+                               goto out;
 
-               if (d->context[0]) {
-                       context = d->context;
-                       seen |= Opt_context;
-               }
+                       if (d->context[0]) {
+                               context = d->context;
+                               seen |= Opt_context;
+                       }
+               } else
+                       goto out;
 
-       /* Standard string-based options. */
        } else {
+               /* Standard string-based options. */
                char *p, *options = data;
 
                while ((p = strsep(&options, ",")) != NULL) {
@@ -1885,7 +1884,7 @@ static inline void take_option(char **to, char *from, int *first, int len)
        *to += len;
 }
 
-static int selinux_sb_copy_data(const char *fstype, void *orig, void *copy)
+static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
 {
        int fnosec, fsec, rc = 0;
        char *in_save, *in_curr, *in_end;
@@ -1895,8 +1894,7 @@ static int selinux_sb_copy_data(const char *fstype, void *orig, void *copy)
        sec_curr = copy;
 
        /* Binary mount data: just copy */
-       if (!strcmp(fstype, "nfs") || !strcmp(fstype, "coda") ||
-           !strcmp(fstype, "smbfs") || !strcmp(fstype, "afs")) {
+       if (type->fs_flags & FS_BINARY_MOUNTDATA) {
                copy_page(sec_curr, in_curr);
                goto out;
        }