introduce cloning of fs_context

new primitive: vfs_dup_fs_context().  Comes with fs_context
method (->dup()) for copying the filesystem-specific parts
of fs_context, along with LSM one (->fs_context_dup()) for
doing the same to LSM parts.

[needs better commit message, and change of Author:, anyway]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

3 files changed, 93 insertions, 0 deletions

diff --git a/security/security.c b/security/security.c
index e5519488327d..5759339319dc 100644
--- a/security/security.c
+++ b/security/security.c
@@ -374,6 +374,11 @@ void security_bprm_committed_creds(struct linux_binprm *bprm)
         call_void_hook(bprm_committed_creds, bprm);
 }
 
+int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
+{
+        return call_int_hook(fs_context_dup, 0, fc, src_fc);
+}
+
 int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param)
 {
         return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f99381e97d73..4ba83de5fa80 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2764,6 +2764,44 @@ static int selinux_umount(struct vfsmount *mnt, int flags)
                                    FILESYSTEM__UNMOUNT, NULL);
 }
 
+static int selinux_fs_context_dup(struct fs_context *fc,
+                                  struct fs_context *src_fc)
+{
+        const struct selinux_mnt_opts *src = src_fc->security;
+        struct selinux_mnt_opts *opts;
+
+        if (!src)
+                return 0;
+
+        fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
+        if (!fc->security)
+                return -ENOMEM;
+
+        opts = fc->security;
+
+        if (src->fscontext) {
+                opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
+                if (!opts->fscontext)
+                        return -ENOMEM;
+        }
+        if (src->context) {
+                opts->context = kstrdup(src->context, GFP_KERNEL);
+                if (!opts->context)
+                        return -ENOMEM;
+        }
+        if (src->rootcontext) {
+                opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
+                if (!opts->rootcontext)
+                        return -ENOMEM;
+        }
+        if (src->defcontext) {
+                opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
+                if (!opts->defcontext)
+                        return -ENOMEM;
+        }
+        return 0;
+}
+
 static const struct fs_parameter_spec selinux_param_specs[] = {
         fsparam_string(CONTEXT_STR,     Opt_context),
         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
@@ -6745,6 +6783,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
 
+        LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
 
         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 5f93c4f84384..03176f600a87 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -647,6 +647,54 @@ out_opt_err:
         return -EINVAL;
 }
 
+/**
+ * smack_fs_context_dup - Duplicate the security data on fs_context duplication
+ * @fc: The new filesystem context.
+ * @src_fc: The source filesystem context being duplicated.
+ *
+ * Returns 0 on success or -ENOMEM on error.
+ */
+static int smack_fs_context_dup(struct fs_context *fc,
+                                struct fs_context *src_fc)
+{
+        struct smack_mnt_opts *dst, *src = src_fc->security;
+
+        if (!src)
+                return 0;
+
+        fc->security = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
+        if (!fc->security)
+                return -ENOMEM;
+        dst = fc->security;
+
+        if (src->fsdefault) {
+                dst->fsdefault = kstrdup(src->fsdefault, GFP_KERNEL);
+                if (!dst->fsdefault)
+                        return -ENOMEM;
+        }
+        if (src->fsfloor) {
+                dst->fsfloor = kstrdup(src->fsfloor, GFP_KERNEL);
+                if (!dst->fsfloor)
+                        return -ENOMEM;
+        }
+        if (src->fshat) {
+                dst->fshat = kstrdup(src->fshat, GFP_KERNEL);
+                if (!dst->fshat)
+                        return -ENOMEM;
+        }
+        if (src->fsroot) {
+                dst->fsroot = kstrdup(src->fsroot, GFP_KERNEL);
+                if (!dst->fsroot)
+                        return -ENOMEM;
+        }
+        if (src->fstransmute) {
+                dst->fstransmute = kstrdup(src->fstransmute, GFP_KERNEL);
+                if (!dst->fstransmute)
+                        return -ENOMEM;
+        }
+        return 0;
+}
+
 static const struct fs_parameter_spec smack_param_specs[] = {
         fsparam_string("fsdefault",     Opt_fsdefault),
         fsparam_string("fsfloor",       Opt_fsfloor),
@@ -4626,6 +4674,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
         LSM_HOOK_INIT(syslog, smack_syslog),
 
+        LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup),
         LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
 
         LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),