leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/tomoyo: Add a special case to handle accesses through the internal proc mount.

Browse Source 
With the change of sys_sysctl going through the internal proc mount we no
longer need to handle security_sysctl in tomoyo as we have valid pathnames
for all sysctl accesses.  There is one slight caveat to that in that
all of the paths from the internal mount look like
"/sys/net/ipv4/ip_local_port_range" instead of
"/proc/sys/net/ipv4/ip_local_port_range" so tomoyo needs to add the
"/proc" portion manually when resolving to full path names to get what it expects.

This change teaches tomoyo perform that modification.

Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2009-11-20 09:12:22 -08:00
parent 6d4561110a
commit a4054b6b20
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/tomoyo/realpath.c
View File

@ -108,6 +108,15 @@ int tomoyo_realpath_from_path2(struct path *path, char *newname,
spin_unlock(&dcache_lock); spin_unlock(&dcache_lock);
path_put(&root); path_put(&root);
path_put(&ns_root); path_put(&ns_root);
/* Prepend "/proc" prefix if using internal proc vfs mount. */
if (!IS_ERR(sp) && (path->mnt->mnt_parent == path->mnt) &&
(strcmp(path->mnt->mnt_sb->s_type->name, "proc") == 0)) {
sp -= 5;
if (sp >= newname)
memcpy(sp, "/proc", 5);
else
sp = ERR_PTR(-ENOMEM);
}
} }
if (IS_ERR(sp)) if (IS_ERR(sp))
error = PTR_ERR(sp); error = PTR_ERR(sp);