aleph/lkl_linux
1
0
Fork 0
mirror of https://github.com/lkl/linux.git synced 2025-12-19 16:13:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

security: Create file_truncate hook from path_truncate hook

Browse Source 
Like path_truncate, the file_truncate hook also restricts file
truncation, but is called in the cases where truncation is attempted
on an already-opened file.

This is required in a subsequent commit to handle ftruncate()
operations differently to truncate() operations.

Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20221018182216.301684-2-gnoack3000@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Günther Noack
2022-10-18 20:22:06 +02:00
committed by Mickaël Salaün
parent 9abf2313ad
commit 3350607dc5
8 changed files with 42 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
include/linux/lsm_hooks.h
View File

@@ -409,7 +409,9 @@
* @attr is the iattr structure containing the new file attributes.
* Return 0 if permission is granted.
* @path_truncate:
* Check permission before truncating a file.
* Check permission before truncating the file indicated by path.
* Note that truncation permissions may also be checked based on
* already opened files, using the @file_truncate hook.
* @path contains the path structure for the file.
* Return 0 if permission is granted.
* @inode_getattr:
@@ -598,6 +600,12 @@
* to receive an open file descriptor via socket IPC.
* @file contains the file structure being received.
* Return 0 if permission is granted.
* @file_truncate:
* Check permission before truncating a file, i.e. using ftruncate.
* Note that truncation permission may also be checked based on the path,
* using the @path_truncate hook.
* @file contains the file structure for the file.
* Return 0 if permission is granted.
* @file_open:
* Save open-time permission checking state for later use upon
* file_permission, and recheck access if anything has changed