linux-kernel - [PATCH v6 3/6] selinux: implement inode_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250630-xattrat-syscall-v6-3-c4e3bc35227b@kernel.org>
Date: Mon, 30 Jun 2025 18:20:13 +0200
From: Andrey Albershteyn <aalbersh@...hat.com>
To: Amir Goldstein <amir73il@...il.com>, Arnd Bergmann <arnd@...db.de>, 
 Casey Schaufler <casey@...aufler-ca.com>, 
 Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, 
 Pali Rohár <pali@...nel.org>, 
 Paul Moore <paul@...l-moore.com>
Cc: linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
 linux-kernel@...r.kernel.org, linux-xfs@...r.kernel.org, 
 selinux@...r.kernel.org, Andrey Albershteyn <aalbersh@...nel.org>
Subject: [PATCH v6 3/6] selinux: implement inode_file_[g|s]etattr hooks

These hooks are called on inode extended attribute retrieval/change.

Cc: selinux@...r.kernel.org
Cc: Paul Moore <paul@...l-moore.com>

Acked-by: Paul Moore <paul@...l-moore.com>
Signed-off-by: Andrey Albershteyn <aalbersh@...nel.org>
---
 security/selinux/hooks.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 595ceb314aeb..be7aca2269fa 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3480,6 +3480,18 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap,
 	return -EACCES;
 }
 
+static int selinux_inode_file_setattr(struct dentry *dentry,
+				      struct fileattr *fa)
+{
+	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+}
+
+static int selinux_inode_file_getattr(struct dentry *dentry,
+				      struct fileattr *fa)
+{
+	return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
+}
+
 static int selinux_path_notify(const struct path *path, u64 mask,
 						unsigned int obj_type)
 {
@@ -7350,6 +7362,8 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
+	LSM_HOOK_INIT(inode_file_getattr, selinux_inode_file_getattr),
+	LSM_HOOK_INIT(inode_file_setattr, selinux_inode_file_setattr),
 	LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
 	LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
 	LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),

-- 
2.47.2