diff options
| author | Hyunchul Lee <cheol.lee@lge.com> | 2017-03-03 16:44:03 +0900 |
|---|---|---|
| committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2020-04-15 01:24:40 +0200 |
| commit | d10f87775bdc2cbf7f906136dfa119215472b5fc (patch) | |
| tree | f52471a9880395ece7dcfd2575fb261300a185c0 | |
| parent | 88722f44e36f1a354a98b29c62282d94ec98f9a9 (diff) | |
ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels
When write syscall is called, every time security label is searched to
determine that file's privileges should be changed.
If LSM(Linux Security Model) is not used, this is useless.
So introduce CONFIG_UBIFS_SECURITY to disable security labels. it's default
value is "y".
Signed-off-by: Hyunchul Lee <cheol.lee@lge.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
(cherry picked from commit 8326c1eec2449f0e868f7b19a5fa7bfa0386ab48)
| -rw-r--r-- | fs/ubifs/Kconfig | 13 | ||||
| -rw-r--r-- | fs/ubifs/ubifs.h | 12 | ||||
| -rw-r--r-- | fs/ubifs/xattr.c | 6 |
3 files changed, 30 insertions, 1 deletions
diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig index 7ff7712f284e..15fb49c053df 100644 --- a/fs/ubifs/Kconfig +++ b/fs/ubifs/Kconfig @@ -50,3 +50,16 @@ config UBIFS_ATIME_SUPPORT strictatime is the "heavy", relatime is "lighter", etc. If unsure, say 'N' + +config UBIFS_FS_SECURITY + bool "UBIFS Security Labels" + depends on UBIFS_FS + default y + help + Security labels provide an access control facility to support Linux + Security Models (LSMs) accepted by AppArmor, SELinux, Smack and TOMOYO + Linux. This option enables an extended attribute handler for file + security labels in the ubifs filesystem, so that it requires enabling + the extended attribute support in advance. + + If you are not using a security module, say N. diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h index 096035eb29d0..9a0d575e1dca 100644 --- a/fs/ubifs/ubifs.h +++ b/fs/ubifs/ubifs.h @@ -1741,8 +1741,18 @@ int ubifs_getattr(struct vfsmount *mnt, struct dentry *dentry, /* xattr.c */ extern const struct xattr_handler *ubifs_xattr_handlers[]; ssize_t ubifs_listxattr(struct dentry *dentry, char *buffer, size_t size); -int ubifs_init_security(struct inode *dentry, struct inode *inode, + +#ifdef CONFIG_UBIFS_FS_SECURITY +extern int ubifs_init_security(struct inode *dentry, struct inode *inode, const struct qstr *qstr); +#else +static inline int ubifs_init_security(struct inode *dentry, + struct inode *inode, const struct qstr *qstr) +{ + return 0; +} +#endif + /* super.c */ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum); diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c index 3979d767a0cb..a0b86160a5fa 100644 --- a/fs/ubifs/xattr.c +++ b/fs/ubifs/xattr.c @@ -534,6 +534,7 @@ out_free: return err; } +#ifdef CONFIG_UBIFS_FS_SECURITY static int init_xattrs(struct inode *inode, const struct xattr *xattr_array, void *fs_info) { @@ -574,6 +575,7 @@ int ubifs_init_security(struct inode *dentry, struct inode *inode, } return err; } +#endif static int ubifs_xattr_get(const struct xattr_handler *handler, struct dentry *dentry, struct inode *inode, @@ -615,15 +617,19 @@ static const struct xattr_handler ubifs_trusted_xattr_handler = { .set = ubifs_xattr_set, }; +#ifdef CONFIG_UBIFS_FS_SECURITY static const struct xattr_handler ubifs_security_xattr_handler = { .prefix = XATTR_SECURITY_PREFIX, .get = ubifs_xattr_get, .set = ubifs_xattr_set, }; +#endif const struct xattr_handler *ubifs_xattr_handlers[] = { &ubifs_user_xattr_handler, &ubifs_trusted_xattr_handler, +#ifdef CONFIG_UBIFS_FS_SECURITY &ubifs_security_xattr_handler, +#endif NULL }; |