p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

LSM: Infrastructure management of the superblock 

Move management of the superblock->sb_security blob out of the
individual security modules and into the security infrastructure.
Instead of allocating the blobs from within the modules, the modules
tell the infrastructure how much space is required, and the space is
allocated there.

Cc: John Johansen <john.johansen@canonical.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210422154123.13086-6-mic@digikod.net
Signed-off-by: James Morris <jamorris@linux.microsoft.com>
This commit is contained in:
Casey Schaufler 2021-04-22 17:41:15 +02:00 committed by James Morris
parent afe81f7541
commit 1aea780837
7 changed files with 85 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/lsm_hooks.h
View File

@ -1573,6 +1573,7 @@ struct lsm_blob_sizes {
int lbs_cred; int lbs_cred;
int lbs_file; int lbs_file;
int lbs_inode; int lbs_inode;
int lbs_superblock;
int lbs_ipc; int lbs_ipc;
int lbs_msg_msg; int lbs_msg_msg;
int lbs_task; int lbs_task;

34
security/security.c
View File

@ -203,6 +203,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode); lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
} }
@ -338,6 +339,7 @@ static void __init ordered_lsm_init(void)
init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);
init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
init_debug("task blob size = %d\n", blob_sizes.lbs_task); init_debug("task blob size = %d\n", blob_sizes.lbs_task);
/* /*
@ -670,6 +672,27 @@ static void __init lsm_early_task(struct task_struct *task)
panic("%s: Early task alloc failed.\n", __func__); panic("%s: Early task alloc failed.\n", __func__);
} }
/**
* lsm_superblock_alloc - allocate a composite superblock blob
* @sb: the superblock that needs a blob
*
* Allocate the superblock blob for all the modules
*
* Returns 0, or -ENOMEM if memory can't be allocated.
*/
static int lsm_superblock_alloc(struct super_block *sb)
{
if (blob_sizes.lbs_superblock == 0) {
sb->s_security = NULL;
return 0;
}
sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL);
if (sb->s_security == NULL)
return -ENOMEM;
return 0;
}
/* /*
* The default value of the LSM hook is defined in linux/lsm_hook_defs.h and * The default value of the LSM hook is defined in linux/lsm_hook_defs.h and
* can be accessed with: * can be accessed with:
@ -867,12 +890,21 @@ int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *
int security_sb_alloc(struct super_block *sb) int security_sb_alloc(struct super_block *sb)
{ {
return call_int_hook(sb_alloc_security, 0, sb); int rc = lsm_superblock_alloc(sb);
if (unlikely(rc))
return rc;
rc = call_int_hook(sb_alloc_security, 0, sb);
if (unlikely(rc))
security_sb_free(sb);
return rc;
} }
void security_sb_free(struct super_block *sb) void security_sb_free(struct super_block *sb)
{ {
call_void_hook(sb_free_security, sb); call_void_hook(sb_free_security, sb);
kfree(sb->s_security);
sb->s_security = NULL;
} }
void security_free_mnt_opts(void **mnt_opts) void security_free_mnt_opts(void **mnt_opts)

58
security/selinux/hooks.c
View File

@ -322,7 +322,7 @@ static void inode_free_security(struct inode *inode)
if (!isec) if (!isec)
return; return;
sbsec = inode->i_sb->s_security; sbsec = selinux_superblock(inode->i_sb);
/* /*
* As not all inode security structures are in a list, we check for * As not all inode security structures are in a list, we check for
* empty list outside of the lock to make sure that we won't waste * empty list outside of the lock to make sure that we won't waste
@ -340,13 +340,6 @@ static void inode_free_security(struct inode *inode)
} }
} }
static void superblock_free_security(struct super_block *sb)
{
struct superblock_security_struct *sbsec = sb->s_security;
sb->s_security = NULL;
kfree(sbsec);
}
struct selinux_mnt_opts { struct selinux_mnt_opts {
const char *fscontext, *context, *rootcontext, *defcontext; const char *fscontext, *context, *rootcontext, *defcontext;
}; };
@ -458,7 +451,7 @@ static int selinux_is_genfs_special_handling(struct super_block *sb)
static int selinux_is_sblabel_mnt(struct super_block *sb) static int selinux_is_sblabel_mnt(struct super_block *sb)
{ {
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
/* /*
* IMPORTANT: Double-check logic in this function when adding a new * IMPORTANT: Double-check logic in this function when adding a new
@ -535,7 +528,7 @@ static int sb_check_xattr_support(struct super_block *sb)
static int sb_finish_set_opts(struct super_block *sb) static int sb_finish_set_opts(struct super_block *sb)
{ {
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
struct dentry *root = sb->s_root; struct dentry *root = sb->s_root;
struct inode *root_inode = d_backing_inode(root); struct inode *root_inode = d_backing_inode(root);
int rc = 0; int rc = 0;
@ -626,7 +619,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
unsigned long *set_kern_flags) unsigned long *set_kern_flags)
{ {
const struct cred *cred = current_cred(); const struct cred *cred = current_cred();
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
struct dentry *root = sb->s_root; struct dentry *root = sb->s_root;
struct selinux_mnt_opts *opts = mnt_opts; struct selinux_mnt_opts *opts = mnt_opts;
struct inode_security_struct *root_isec; struct inode_security_struct *root_isec;
@ -863,8 +856,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
static int selinux_cmp_sb_context(const struct super_block *oldsb, static int selinux_cmp_sb_context(const struct super_block *oldsb,
const struct super_block *newsb) const struct super_block *newsb)
{ {
struct superblock_security_struct *old = oldsb->s_security; struct superblock_security_struct *old = selinux_superblock(oldsb);
struct superblock_security_struct *new = newsb->s_security; struct superblock_security_struct *new = selinux_superblock(newsb);
char oldflags = old->flags & SE_MNTMASK; char oldflags = old->flags & SE_MNTMASK;
char newflags = new->flags & SE_MNTMASK; char newflags = new->flags & SE_MNTMASK;
@ -896,8 +889,9 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
unsigned long *set_kern_flags) unsigned long *set_kern_flags)
{ {
int rc = 0; int rc = 0;
const struct superblock_security_struct *oldsbsec = oldsb->s_security; const struct superblock_security_struct *oldsbsec =
struct superblock_security_struct *newsbsec = newsb->s_security; selinux_superblock(oldsb);
struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT); int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
int set_context = (oldsbsec->flags & CONTEXT_MNT); int set_context = (oldsbsec->flags & CONTEXT_MNT);
@ -1076,7 +1070,7 @@ static int show_sid(struct seq_file *m, u32 sid)
static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
{ {
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
int rc; int rc;
if (!(sbsec->flags & SE_SBINITIALIZED)) if (!(sbsec->flags & SE_SBINITIALIZED))
@ -1427,7 +1421,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
if (isec->sclass == SECCLASS_FILE) if (isec->sclass == SECCLASS_FILE)
isec->sclass = inode_mode_to_security_class(inode->i_mode); isec->sclass = inode_mode_to_security_class(inode->i_mode);
sbsec = inode->i_sb->s_security; sbsec = selinux_superblock(inode->i_sb);
if (!(sbsec->flags & SE_SBINITIALIZED)) { if (!(sbsec->flags & SE_SBINITIALIZED)) {
/* Defer initialization until selinux_complete_init, /* Defer initialization until selinux_complete_init,
after the initial policy is loaded and the security after the initial policy is loaded and the security
@ -1778,7 +1772,8 @@ selinux_determine_inode_label(const struct task_security_struct *tsec,
const struct qstr *name, u16 tclass, const struct qstr *name, u16 tclass,
u32 *_new_isid) u32 *_new_isid)
{ {
const struct superblock_security_struct *sbsec = dir->i_sb->s_security; const struct superblock_security_struct *sbsec =
selinux_superblock(dir->i_sb);
if ((sbsec->flags & SE_SBINITIALIZED) && if ((sbsec->flags & SE_SBINITIALIZED) &&
(sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
@ -1809,7 +1804,7 @@ static int may_create(struct inode *dir,
int rc; int rc;
dsec = inode_security(dir); dsec = inode_security(dir);
sbsec = dir->i_sb->s_security; sbsec = selinux_superblock(dir->i_sb);
sid = tsec->sid; sid = tsec->sid;
@ -1958,7 +1953,7 @@ static int superblock_has_perm(const struct cred *cred,
struct superblock_security_struct *sbsec; struct superblock_security_struct *sbsec;
u32 sid = cred_sid(cred); u32 sid = cred_sid(cred);
sbsec = sb->s_security; sbsec = selinux_superblock(sb);
return avc_has_perm(&selinux_state, return avc_has_perm(&selinux_state,
sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
} }
@ -2587,11 +2582,7 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
static int selinux_sb_alloc_security(struct super_block *sb) static int selinux_sb_alloc_security(struct super_block *sb)
{ {
struct superblock_security_struct *sbsec; struct superblock_security_struct *sbsec = selinux_superblock(sb);
sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
if (!sbsec)
return -ENOMEM;
mutex_init(&sbsec->lock); mutex_init(&sbsec->lock);
INIT_LIST_HEAD(&sbsec->isec_head); INIT_LIST_HEAD(&sbsec->isec_head);
@ -2599,16 +2590,10 @@ static int selinux_sb_alloc_security(struct super_block *sb)
sbsec->sid = SECINITSID_UNLABELED; sbsec->sid = SECINITSID_UNLABELED;
sbsec->def_sid = SECINITSID_FILE; sbsec->def_sid = SECINITSID_FILE;
sbsec->mntpoint_sid = SECINITSID_UNLABELED; sbsec->mntpoint_sid = SECINITSID_UNLABELED;
sb->s_security = sbsec;
return 0; return 0;
} }
static void selinux_sb_free_security(struct super_block *sb)
{
superblock_free_security(sb);
}
static inline int opt_len(const char *s) static inline int opt_len(const char *s)
{ {
bool open_quote = false; bool open_quote = false;
@ -2687,7 +2672,7 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
{ {
struct selinux_mnt_opts *opts = mnt_opts; struct selinux_mnt_opts *opts = mnt_opts;
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
u32 sid; u32 sid;
int rc; int rc;
@ -2925,7 +2910,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
int rc; int rc;
char *context; char *context;
sbsec = dir->i_sb->s_security; sbsec = selinux_superblock(dir->i_sb);
newsid = tsec->create_sid; newsid = tsec->create_sid;
@ -3227,7 +3212,7 @@ static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized(&selinux_state))
return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM); return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
sbsec = inode->i_sb->s_security; sbsec = selinux_superblock(inode->i_sb);
if (!(sbsec->flags & SBLABEL_MNT)) if (!(sbsec->flags & SBLABEL_MNT))
return -EOPNOTSUPP; return -EOPNOTSUPP;
@ -3472,13 +3457,14 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
const void *value, size_t size, int flags) const void *value, size_t size, int flags)
{ {
struct inode_security_struct *isec = inode_security_novalidate(inode); struct inode_security_struct *isec = inode_security_novalidate(inode);
struct superblock_security_struct *sbsec = inode->i_sb->s_security; struct superblock_security_struct *sbsec;
u32 newsid; u32 newsid;
int rc; int rc;
if (strcmp(name, XATTR_SELINUX_SUFFIX)) if (strcmp(name, XATTR_SELINUX_SUFFIX))
return -EOPNOTSUPP; return -EOPNOTSUPP;
sbsec = selinux_superblock(inode->i_sb);
if (!(sbsec->flags & SBLABEL_MNT)) if (!(sbsec->flags & SBLABEL_MNT))
return -EOPNOTSUPP; return -EOPNOTSUPP;
@ -6975,6 +6961,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
.lbs_inode = sizeof(struct inode_security_struct), .lbs_inode = sizeof(struct inode_security_struct),
.lbs_ipc = sizeof(struct ipc_security_struct), .lbs_ipc = sizeof(struct ipc_security_struct),
.lbs_msg_msg = sizeof(struct msg_security_struct), .lbs_msg_msg = sizeof(struct msg_security_struct),
.lbs_superblock = sizeof(struct superblock_security_struct),
}; };
#ifdef CONFIG_PERF_EVENTS #ifdef CONFIG_PERF_EVENTS
@ -7075,7 +7062,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds), LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts), LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
LSM_HOOK_INIT(sb_remount, selinux_sb_remount), LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount), LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),

6
security/selinux/include/objsec.h
View File

@ -188,4 +188,10 @@ static inline u32 current_sid(void)
return tsec->sid; return tsec->sid;
} }
static inline struct superblock_security_struct *selinux_superblock(
const struct super_block *superblock)
{
return superblock->s_security + selinux_blob_sizes.lbs_superblock;
}
#endif /* _SELINUX_OBJSEC_H_ */ #endif /* _SELINUX_OBJSEC_H_ */

3
security/selinux/ss/services.c
View File

@ -47,6 +47,7 @@
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/audit.h> #include <linux/audit.h>
#include <linux/vmalloc.h> #include <linux/vmalloc.h>
#include <linux/lsm_hooks.h>
#include <net/netlabel.h> #include <net/netlabel.h>
#include "flask.h" #include "flask.h"
@ -2875,7 +2876,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
struct sidtab *sidtab; struct sidtab *sidtab;
int rc = 0; int rc = 0;
struct ocontext *c; struct ocontext *c;
struct superblock_security_struct *sbsec = sb->s_security; struct superblock_security_struct *sbsec = selinux_superblock(sb);
const char *fstype = sb->s_type->name; const char *fstype = sb->s_type->name;
if (!selinux_initialized(state)) { if (!selinux_initialized(state)) {

6
security/smack/smack.h
View File

@ -357,6 +357,12 @@ static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
return ipc->security + smack_blob_sizes.lbs_ipc; return ipc->security + smack_blob_sizes.lbs_ipc;
} }
static inline struct superblock_smack *smack_superblock(
const struct super_block *superblock)
{
return superblock->s_security + smack_blob_sizes.lbs_superblock;
}
/* /*
* Is the directory transmuting? * Is the directory transmuting?
*/ */

35
security/smack/smack_lsm.c
View File

@ -535,12 +535,7 @@ static int smack_syslog(int typefrom_file)
*/ */
static int smack_sb_alloc_security(struct super_block *sb) static int smack_sb_alloc_security(struct super_block *sb)
{ {
struct superblock_smack *sbsp; struct superblock_smack *sbsp = smack_superblock(sb);
sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL);
if (sbsp == NULL)
return -ENOMEM;
sbsp->smk_root = &smack_known_floor; sbsp->smk_root = &smack_known_floor;
sbsp->smk_default = &smack_known_floor; sbsp->smk_default = &smack_known_floor;
@ -549,22 +544,10 @@ static int smack_sb_alloc_security(struct super_block *sb)
/* /*
* SMK_SB_INITIALIZED will be zero from kzalloc. * SMK_SB_INITIALIZED will be zero from kzalloc.
*/ */
sb->s_security = sbsp;
return 0; return 0;
} }
/**
* smack_sb_free_security - free a superblock blob
* @sb: the superblock getting the blob
*
*/
static void smack_sb_free_security(struct super_block *sb)
{
kfree(sb->s_security);
sb->s_security = NULL;
}
struct smack_mnt_opts { struct smack_mnt_opts {
const char *fsdefault, *fsfloor, *fshat, *fsroot, *fstransmute; const char *fsdefault, *fsfloor, *fshat, *fsroot, *fstransmute;
}; };
@ -772,7 +755,7 @@ static int smack_set_mnt_opts(struct super_block *sb,
{ {
struct dentry *root = sb->s_root; struct dentry *root = sb->s_root;
struct inode *inode = d_backing_inode(root); struct inode *inode = d_backing_inode(root);
struct superblock_smack *sp = sb->s_security; struct superblock_smack *sp = smack_superblock(sb);
struct inode_smack *isp; struct inode_smack *isp;
struct smack_known *skp; struct smack_known *skp;
struct smack_mnt_opts *opts = mnt_opts; struct smack_mnt_opts *opts = mnt_opts;
@ -871,7 +854,7 @@ static int smack_set_mnt_opts(struct super_block *sb,
*/ */
static int smack_sb_statfs(struct dentry *dentry) static int smack_sb_statfs(struct dentry *dentry)
{ {
struct superblock_smack *sbp = dentry->d_sb->s_security; struct superblock_smack *sbp = smack_superblock(dentry->d_sb);
int rc; int rc;
struct smk_audit_info ad; struct smk_audit_info ad;
@ -905,7 +888,7 @@ static int smack_bprm_creds_for_exec(struct linux_binprm *bprm)
if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
return 0; return 0;
sbsp = inode->i_sb->s_security; sbsp = smack_superblock(inode->i_sb);
if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
isp->smk_task != sbsp->smk_root) isp->smk_task != sbsp->smk_root)
return 0; return 0;
@ -1157,7 +1140,7 @@ static int smack_inode_rename(struct inode *old_inode,
*/ */
static int smack_inode_permission(struct inode *inode, int mask) static int smack_inode_permission(struct inode *inode, int mask)
{ {
struct superblock_smack *sbsp = inode->i_sb->s_security; struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
struct smk_audit_info ad; struct smk_audit_info ad;
int no_block = mask & MAY_NOT_BLOCK; int no_block = mask & MAY_NOT_BLOCK;
int rc; int rc;
@ -1400,7 +1383,7 @@ static int smack_inode_removexattr(struct user_namespace *mnt_userns,
*/ */
if (strcmp(name, XATTR_NAME_SMACK) == 0) { if (strcmp(name, XATTR_NAME_SMACK) == 0) {
struct super_block *sbp = dentry->d_sb; struct super_block *sbp = dentry->d_sb;
struct superblock_smack *sbsp = sbp->s_security; struct superblock_smack *sbsp = smack_superblock(sbp);
isp->smk_inode = sbsp->smk_default; isp->smk_inode = sbsp->smk_default;
} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
@ -1670,7 +1653,7 @@ static int smack_mmap_file(struct file *file,
isp = smack_inode(file_inode(file)); isp = smack_inode(file_inode(file));
if (isp->smk_mmap == NULL) if (isp->smk_mmap == NULL)
return 0; return 0;
sbsp = file_inode(file)->i_sb->s_security; sbsp = smack_superblock(file_inode(file)->i_sb);
if (sbsp->smk_flags & SMK_SB_UNTRUSTED && if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
isp->smk_mmap != sbsp->smk_root) isp->smk_mmap != sbsp->smk_root)
return -EACCES; return -EACCES;
@ -3285,7 +3268,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
return; return;
sbp = inode->i_sb; sbp = inode->i_sb;
sbsp = sbp->s_security; sbsp = smack_superblock(sbp);
/* /*
* We're going to use the superblock default label * We're going to use the superblock default label
* if there's no label on the file. * if there's no label on the file.
@ -4700,6 +4683,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
.lbs_inode = sizeof(struct inode_smack), .lbs_inode = sizeof(struct inode_smack),
.lbs_ipc = sizeof(struct smack_known *), .lbs_ipc = sizeof(struct smack_known *),
.lbs_msg_msg = sizeof(struct smack_known *), .lbs_msg_msg = sizeof(struct smack_known *),
.lbs_superblock = sizeof(struct superblock_smack),
}; };
static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
@ -4711,7 +4695,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param), LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security), LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),
LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts), LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),
LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts), LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts),
LSM_HOOK_INIT(sb_statfs, smack_sb_statfs), LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),