From e606758e59f0a821b1db8387f1199931d4cd307f Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 29 Dec 2003 23:43:03 -0800 Subject: [PATCH] [PATCH] Remove use of nameidata by selinux_inode_permission From: Stephen Smalley This patch removes the use of nameidata by selinux_inode_permission, as this appears to be unsafe in certain cases (e.g. path_walk call from rpc_lookup_parent), leading to an Oops if d_path is subsequently called by avc_audit on the (mnt,dentry) pair to generate a pathname for an audit message. The change does not affect the ability of SELinux to perform its permission check (which only requires the inode), only the set of information that is available for audit messages. We'll investigate better approaches for the SELinux audit generation in the future. --- security/selinux/hooks.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 34bcfcc7aaa98..0faf0a68cce1f 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1738,10 +1738,6 @@ static int selinux_inode_permission(struct inode *inode, int mask, return 0; } - if (nd && nd->dentry) - return dentry_has_perm(current, nd->mnt, nd->dentry, - file_mask_to_av(inode->i_mode, mask)); - return inode_has_perm(current, inode, file_mask_to_av(inode->i_mode, mask), NULL, NULL); } -- 2.53.0