CRED: Pass credentials through dentry_open()

Pass credentials through dentry_open() so that the COW creds patch can have
SELinux's flush_unauthorized_files() pass the appropriate creds back to itself
when it opens its null chardev.

The security_dentry_open() call also now takes a creds pointer, as does the
dentry_open hook in struct security_operations.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>

3 files changed, 9 insertions, 6 deletions

diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 3504cf9df358..a75026d35d16 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -691,7 +691,8 @@ int ecryptfs_init_kthread(void);
 void ecryptfs_destroy_kthread(void);
 int ecryptfs_privileged_open(struct file **lower_file,
                              struct dentry *lower_dentry,
-                             struct vfsmount *lower_mnt);
+                             struct vfsmount *lower_mnt,
+                             const struct cred *cred);
 int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry);
 
 #endif /* #ifndef ECRYPTFS_KERNEL_H */
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index c440c6b58b2d..c6d7a4d748a0 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -73,7 +73,7 @@ static int ecryptfs_threadfn(void *ignored)
                                 mntget(req->lower_mnt);
                                 (*req->lower_file) = dentry_open(
                                         req->lower_dentry, req->lower_mnt,
-                                        (O_RDWR | O_LARGEFILE));
+                                        (O_RDWR | O_LARGEFILE), current_cred());
                                 req->flags |= ECRYPTFS_REQ_PROCESSED;
                         }
                         wake_up(&req->wait);
@@ -132,7 +132,8 @@ void ecryptfs_destroy_kthread(void)
  */
 int ecryptfs_privileged_open(struct file **lower_file,
                              struct dentry *lower_dentry,
-                             struct vfsmount *lower_mnt)
+                             struct vfsmount *lower_mnt,
+                             const struct cred *cred)
 {
         struct ecryptfs_open_req *req;
         int rc = 0;
@@ -143,7 +144,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
         dget(lower_dentry);
         mntget(lower_mnt);
         (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                    (O_RDWR | O_LARGEFILE));
+                                    (O_RDWR | O_LARGEFILE), cred);
         if (!IS_ERR(*lower_file))
                 goto out;
         req = kmem_cache_alloc(ecryptfs_open_req_cache, GFP_KERNEL);
@@ -184,7 +185,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
                 dget(lower_dentry);
                 mntget(lower_mnt);
                 (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                            (O_RDONLY | O_LARGEFILE));
+                                            (O_RDONLY | O_LARGEFILE), cred);
                 if (IS_ERR(*lower_file)) {
                         rc = PTR_ERR(*req->lower_file);
                         (*lower_file) = NULL;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 64d2ba980df4..fd630713c5c7 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -115,6 +115,7 @@ void __ecryptfs_printk(const char *fmt, ...)
  */
 int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
 {
+        const struct cred *cred = current_cred();
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
         int rc = 0;
@@ -127,7 +128,7 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
 
                 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
                 rc = ecryptfs_privileged_open(&inode_info->lower_file,
-                                                     lower_dentry, lower_mnt);
+                                              lower_dentry, lower_mnt, cred);
                 if (rc || IS_ERR(inode_info->lower_file)) {
                         printk(KERN_ERR "Error opening lower persistent file "
                                "for lower_dentry [0x%p] and lower_mnt [0x%p]; "