mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
85 lines
2.7 KiB
Diff
85 lines
2.7 KiB
Diff
Index: linux-2.6/fs/open.c
|
|
===================================================================
|
|
--- linux-2.6.orig/fs/open.c
|
|
+++ linux-2.6/fs/open.c
|
|
@@ -483,6 +483,10 @@ asmlinkage long sys_chroot(const char __
|
|
if (!capable(CAP_SYS_CHROOT))
|
|
goto dput_and_out;
|
|
|
|
+ error = security_chroot(&nd);
|
|
+ if (error)
|
|
+ goto dput_and_out;
|
|
+
|
|
set_fs_root(current->fs, nd.mnt, nd.dentry);
|
|
set_fs_altroot();
|
|
error = 0;
|
|
Index: linux-2.6/include/linux/security.h
|
|
===================================================================
|
|
--- linux-2.6.orig/include/linux/security.h
|
|
+++ linux-2.6/include/linux/security.h
|
|
@@ -247,6 +247,9 @@ struct request_sock;
|
|
* Update module state after a successful pivot.
|
|
* @old_nd contains the nameidata structure for the old root.
|
|
* @new_nd contains the nameidata structure for the new root.
|
|
+ * @sb_chroot:
|
|
+ * Check permission before chroot to chroot to point named by @nd
|
|
+ * @nd contains the nameidata object for the new root
|
|
*
|
|
* Security hooks for inode operations.
|
|
*
|
|
@@ -1211,6 +1214,7 @@ struct security_operations {
|
|
struct nameidata * new_nd);
|
|
void (*sb_post_pivotroot) (struct nameidata * old_nd,
|
|
struct nameidata * new_nd);
|
|
+ int (*sb_chroot) (struct nameidata * nd);
|
|
|
|
int (*inode_alloc_security) (struct inode *inode);
|
|
void (*inode_free_security) (struct inode *inode);
|
|
@@ -1610,6 +1614,11 @@ static inline void security_sb_post_pivo
|
|
security_ops->sb_post_pivotroot (old_nd, new_nd);
|
|
}
|
|
|
|
+static inline int security_chroot (struct nameidata *nd)
|
|
+{
|
|
+ return security_ops->sb_chroot (nd);
|
|
+}
|
|
+
|
|
static inline int security_inode_alloc (struct inode *inode)
|
|
{
|
|
inode->i_security = NULL;
|
|
@@ -2362,6 +2371,11 @@ static inline void security_sb_post_pivo
|
|
struct nameidata *new_nd)
|
|
{ }
|
|
|
|
+static inline int security_sb_chroot (struct nameidata *nd)
|
|
+{
|
|
+ return 0;
|
|
+}
|
|
+
|
|
static inline int security_inode_alloc (struct inode *inode)
|
|
{
|
|
return 0;
|
|
Index: linux-2.6/security/dummy.c
|
|
===================================================================
|
|
--- linux-2.6.orig/security/dummy.c
|
|
+++ linux-2.6/security/dummy.c
|
|
@@ -248,6 +248,11 @@ static void dummy_sb_post_pivotroot (str
|
|
return;
|
|
}
|
|
|
|
+static int dummy_sb_chroot (struct nameidata *nd)
|
|
+{
|
|
+ return 0;
|
|
+}
|
|
+
|
|
static int dummy_inode_alloc_security (struct inode *inode)
|
|
{
|
|
return 0;
|
|
@@ -1004,6 +1009,7 @@ void security_fixup_ops (struct security
|
|
set_to_dummy_if_null(ops, sb_post_addmount);
|
|
set_to_dummy_if_null(ops, sb_pivotroot);
|
|
set_to_dummy_if_null(ops, sb_post_pivotroot);
|
|
+ set_to_dummy_if_null(ops, sb_chroot);
|
|
set_to_dummy_if_null(ops, inode_alloc_security);
|
|
set_to_dummy_if_null(ops, inode_free_security);
|
|
set_to_dummy_if_null(ops, inode_init_security);
|