smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()

[linux-2.6-block.git] / security / smack / smack_lsm.c

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 25ade3819aff02e058ac3613d109e8b05722c2b4..679156601a10d39ae8f452212e1c170394129339 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -52,7 +52,14 @@
 #define SMK_RECEIVING  1
 #define SMK_SENDING    2
 
-#define SMACK_INODE_INIT_XATTRS 1
+/*
+ * Smack uses multiple xattrs.
+ * SMACK64 - for access control,
+ * SMACK64TRANSMUTE - label initialization,
+ * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
+ * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
+ */
+#define SMACK_INODE_INIT_XATTRS 2
 
 #ifdef SMACK_IPV6_PORT_LABELING
 static DEFINE_MUTEX(smack_ipv6_lock);
@@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
                                     struct xattr *xattrs, int *xattr_count)
 {
        struct task_smack *tsp = smack_cred(current_cred());
-       struct inode_smack *issp = smack_inode(inode);
        struct smack_known *skp = smk_of_task(tsp);
        struct smack_known *isp = smk_of_inode(inode);
        struct smack_known *dsp = smk_of_inode(dir);
@@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
                if ((tsp->smk_task == tsp->smk_transmuted) ||
                    (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
                     smk_inode_transmutable(dir))) {
+                       struct xattr *xattr_transmute;
+
                        /*
                         * The caller of smack_dentry_create_files_as()
                         * should have overridden the current cred, so the
@@ -971,7 +979,18 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
                         */
                        if (tsp->smk_task != tsp->smk_transmuted)
                                isp = dsp;
-                       issp->smk_flags |= SMK_INODE_CHANGED;
+                       xattr_transmute = lsm_get_xattr_slot(xattrs,
+                                                            xattr_count);
+                       if (xattr_transmute) {
+                               xattr_transmute->value = kmemdup(TRANS_TRUE,
+                                                                TRANS_TRUE_SIZE,
+                                                                GFP_NOFS);
+                               if (!xattr_transmute->value)
+                                       return -ENOMEM;
+
+                               xattr_transmute->value_len = TRANS_TRUE_SIZE;
+                               xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+                       }
                }
 
                xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
@@ -3518,20 +3537,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
                         * If there is a transmute attribute on the
                         * directory mark the inode.
                         */
-                       if (isp->smk_flags & SMK_INODE_CHANGED) {
-                               isp->smk_flags &= ~SMK_INODE_CHANGED;
-                               rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
-                                       XATTR_NAME_SMACKTRANSMUTE,
-                                       TRANS_TRUE, TRANS_TRUE_SIZE,
-                                       0);
-                       } else {
-                               rc = __vfs_getxattr(dp, inode,
-                                       XATTR_NAME_SMACKTRANSMUTE, trattr,
-                                       TRANS_TRUE_SIZE);
-                               if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
-                                                      TRANS_TRUE_SIZE) != 0)
-                                       rc = -EINVAL;
-                       }
+                       rc = __vfs_getxattr(dp, inode,
+                                           XATTR_NAME_SMACKTRANSMUTE, trattr,
+                                           TRANS_TRUE_SIZE);
+                       if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
+                                              TRANS_TRUE_SIZE) != 0)
+                               rc = -EINVAL;
                        if (rc >= 0)
                                transflag = SMK_INODE_TRANSMUTE;
                }