kevin/linux
1
Fork 0
Code

lsm: add new securityfs delete function

Browse Source 
When deleting a directory in the security file system, the existing
securityfs_remove requires the directory to be empty, otherwise
it will do nothing. This leads to a potential risk that the security
file system might be in an unclean state when the intended deletion
did not happen.

This commit introduces a new function securityfs_recursive_remove
to recursively delete a directory without leaving an unclean state.

Co-developed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Fan Wu 2024-08-02 23:08:21 -07:00 committed by Paul Moore
parent a8a74df150
commit 7138679ff2
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/security.h
View File

@ -2090,6 +2090,7 @@ struct dentry *securityfs_create_symlink(const char *name,
const char *target, const char *target,
const struct inode_operations *iops); const struct inode_operations *iops);
extern void securityfs_remove(struct dentry *dentry); extern void securityfs_remove(struct dentry *dentry);
extern void securityfs_recursive_remove(struct dentry *dentry);
#else /* CONFIG_SECURITYFS */ #else /* CONFIG_SECURITYFS */

25
security/inode.c
View File

@ -313,6 +313,31 @@ void securityfs_remove(struct dentry *dentry)
} }
EXPORT_SYMBOL_GPL(securityfs_remove); EXPORT_SYMBOL_GPL(securityfs_remove);
static void remove_one(struct dentry *victim)
{
simple_release_fs(&mount, &mount_count);
}
/**
* securityfs_recursive_remove - recursively removes a file or directory
*
* @dentry: a pointer to a the dentry of the file or directory to be removed.
*
* This function recursively removes a file or directory in securityfs that was
* previously created with a call to another securityfs function (like
* securityfs_create_file() or variants thereof.)
*/
void securityfs_recursive_remove(struct dentry *dentry)
{
if (IS_ERR_OR_NULL(dentry))
return;
simple_pin_fs(&fs_type, &mount, &mount_count);
simple_recursive_removal(dentry, remove_one);
simple_release_fs(&mount, &mount_count);
}
EXPORT_SYMBOL_GPL(securityfs_recursive_remove);
#ifdef CONFIG_SECURITY #ifdef CONFIG_SECURITY
static struct dentry *lsm_dentry; static struct dentry *lsm_dentry;
static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count, static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,