Skip to content

Commit

Permalink
Smack: Restore the smackfsdef mount option and add missing prefixes
Browse files Browse the repository at this point in the history
The 5.1 mount system rework changed the smackfsdef mount option to
smackfsdefault.  This fixes the regression by making smackfsdef treated
the same way as smackfsdefault.

Also fix the smack_param_specs[] to have "smack" prefixes on all the
names.  This isn't visible to a user unless they either:

 (a) Try to mount a filesystem that's converted to the internal mount API
     and that implements the ->parse_monolithic() context operation - and
     only then if they call security_fs_context_parse_param() rather than
     security_sb_eat_lsm_opts().

     There are no examples of this upstream yet, but nfs will probably want
     to do this for nfs2 or nfs3.

 (b) Use fsconfig() to configure the filesystem - in which case
     security_fs_context_parse_param() will be called.

This issue is that smack_sb_eat_lsm_opts() checks for the "smack" prefix
on the options, but smack_fs_context_parse_param() does not.

Fixes: c3300aa ("smack: get rid of match_token()")
Fixes: 2febd25 ("smack: Implement filesystem context security hooks")
Cc: [email protected]
Reported-by: Jose Bollo <[email protected]>
Signed-off-by: Casey Schaufler <[email protected]>
Signed-off-by: David Howells <[email protected]>
Tested-by: Casey Schaufler <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
cschaufler authored and torvalds committed Jun 15, 2019
1 parent 72a20ce commit 6e7739f
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions security/smack/smack_lsm.c
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ static struct {
int len;
int opt;
} smk_mount_opts[] = {
{"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault},
A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute)
};
#undef A
Expand Down Expand Up @@ -682,11 +683,12 @@ static int smack_fs_context_dup(struct fs_context *fc,
}

static const struct fs_parameter_spec smack_param_specs[] = {
fsparam_string("fsdefault", Opt_fsdefault),
fsparam_string("fsfloor", Opt_fsfloor),
fsparam_string("fshat", Opt_fshat),
fsparam_string("fsroot", Opt_fsroot),
fsparam_string("fstransmute", Opt_fstransmute),
fsparam_string("smackfsdef", Opt_fsdefault),
fsparam_string("smackfsdefault", Opt_fsdefault),
fsparam_string("smackfsfloor", Opt_fsfloor),
fsparam_string("smackfshat", Opt_fshat),
fsparam_string("smackfsroot", Opt_fsroot),
fsparam_string("smackfstransmute", Opt_fstransmute),
{}
};

Expand Down

0 comments on commit 6e7739f

Please sign in to comment.