smack: Implement filesystem context security hooks

Implement filesystem context security hooks for the smack LSM.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Casey Schaufler <casey@schaufler-ca.com>
cc: linux-security-module@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/security/smack/smack.h b/security/smack/smack.h
index f7db791fb5660ad14479af3d4b48e104d8bc37ed..0380a9c89d3b0086558aeef74a31535578b8e1d5 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -195,22 +195,13 @@ struct smack_known_list_elem {
 
 enum {
        Opt_error = -1,
-       Opt_fsdefault = 1,
-       Opt_fsfloor = 2,
-       Opt_fshat = 3,
-       Opt_fsroot = 4,
-       Opt_fstransmute = 5,
+       Opt_fsdefault = 0,
+       Opt_fsfloor = 1,
+       Opt_fshat = 2,
+       Opt_fsroot = 3,
+       Opt_fstransmute = 4,
 };
 
-/*
- * Mount options
- */
-#define SMK_FSDEFAULT  "smackfsdef="
-#define SMK_FSFLOOR    "smackfsfloor="
-#define SMK_FSHAT      "smackfshat="
-#define SMK_FSROOT     "smackfsroot="
-#define SMK_FSTRANS    "smackfstransmute="
-
 #define SMACK_DELETE_OPTION    "-DELETE"
 #define SMACK_CIPSO_OPTION     "-CIPSO"
 

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 430d4f35e55c0f2a77cfd81c3f3685b8c8390500..5f93c4f843842baa0964286c2db3ae86b856fb0a 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -43,6 +43,8 @@
 #include <linux/shm.h>
 #include <linux/binfmts.h>
 #include <linux/parser.h>
+#include <linux/fs_context.h>
+#include <linux/fs_parser.h>
 #include "smack.h"
 
 #define TRANS_TRUE     "TRUE"
@@ -541,7 +543,6 @@ static int smack_syslog(int typefrom_file)
        return rc;
 }
 
-
 /*
  * Superblock Hooks.
  */
@@ -646,6 +647,44 @@ out_opt_err:
        return -EINVAL;
 }
 
+static const struct fs_parameter_spec smack_param_specs[] = {
+       fsparam_string("fsdefault",     Opt_fsdefault),
+       fsparam_string("fsfloor",       Opt_fsfloor),
+       fsparam_string("fshat",         Opt_fshat),
+       fsparam_string("fsroot",        Opt_fsroot),
+       fsparam_string("fstransmute",   Opt_fstransmute),
+       {}
+};
+
+static const struct fs_parameter_description smack_fs_parameters = {
+       .name           = "smack",
+       .specs          = smack_param_specs,
+};
+
+/**
+ * smack_fs_context_parse_param - Parse a single mount parameter
+ * @fc: The new filesystem context being constructed.
+ * @param: The parameter.
+ *
+ * Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on
+ * error.
+ */
+static int smack_fs_context_parse_param(struct fs_context *fc,
+                                       struct fs_parameter *param)
+{
+       struct fs_parse_result result;
+       int opt, rc;
+
+       opt = fs_parse(fc, &smack_fs_parameters, param, &result);
+       if (opt < 0)
+               return opt;
+
+       rc = smack_add_opt(opt, param->string, &fc->security);
+       if (!rc)
+               param->string = NULL;
+       return rc;
+}
+
 static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts)
 {
        char *from = options, *to = options;
@@ -4587,6 +4626,8 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
        LSM_HOOK_INIT(syslog, smack_syslog),
 
+       LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
+
        LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
        LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),
        LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),