CRED: Pass credentials through dentry_open()

Pass credentials through dentry_open() so that the COW creds patch can have
SELinux's flush_unauthorized_files() pass the appropriate creds back to itself
when it opens its null chardev.

The security_dentry_open() call also now takes a creds pointer, as does the
dentry_open hook in struct security_operations.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>

11 files changed, 37 insertions, 20 deletions

diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 625abf5422e2..ec16255d27dd 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -307,7 +307,8 @@ static int autofs_dev_ioctl_open_mountpoint(const char *path, dev_t devid)
                         goto out;
                 }
 
-                filp = dentry_open(nd.path.dentry, nd.path.mnt, O_RDONLY);
+                filp = dentry_open(nd.path.dentry, nd.path.mnt, O_RDONLY,
+                                   current_cred());
                 if (IS_ERR(filp)) {
                         err = PTR_ERR(filp);
                         goto out;
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 3504cf9df358..a75026d35d16 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -691,7 +691,8 @@ int ecryptfs_init_kthread(void);
 void ecryptfs_destroy_kthread(void);
 int ecryptfs_privileged_open(struct file **lower_file,
                              struct dentry *lower_dentry,
-                             struct vfsmount *lower_mnt);
+                             struct vfsmount *lower_mnt,
+                             const struct cred *cred);
 int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry);
 
 #endif /* #ifndef ECRYPTFS_KERNEL_H */
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index c440c6b58b2d..c6d7a4d748a0 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -73,7 +73,7 @@ static int ecryptfs_threadfn(void *ignored)
                                 mntget(req->lower_mnt);
                                 (*req->lower_file) = dentry_open(
                                         req->lower_dentry, req->lower_mnt,
-                                        (O_RDWR | O_LARGEFILE));
+                                        (O_RDWR | O_LARGEFILE), current_cred());
                                 req->flags |= ECRYPTFS_REQ_PROCESSED;
                         }
                         wake_up(&req->wait);
@@ -132,7 +132,8 @@ void ecryptfs_destroy_kthread(void)
  */
 int ecryptfs_privileged_open(struct file **lower_file,
                              struct dentry *lower_dentry,
-                             struct vfsmount *lower_mnt)
+                             struct vfsmount *lower_mnt,
+                             const struct cred *cred)
 {
         struct ecryptfs_open_req *req;
         int rc = 0;
@@ -143,7 +144,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
         dget(lower_dentry);
         mntget(lower_mnt);
         (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                    (O_RDWR | O_LARGEFILE));
+                                    (O_RDWR | O_LARGEFILE), cred);
         if (!IS_ERR(*lower_file))
                 goto out;
         req = kmem_cache_alloc(ecryptfs_open_req_cache, GFP_KERNEL);
@@ -184,7 +185,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
                 dget(lower_dentry);
                 mntget(lower_mnt);
                 (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                            (O_RDONLY | O_LARGEFILE));
+                                            (O_RDONLY | O_LARGEFILE), cred);
                 if (IS_ERR(*lower_file)) {
                         rc = PTR_ERR(*req->lower_file);
                         (*lower_file) = NULL;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 64d2ba980df4..fd630713c5c7 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -115,6 +115,7 @@ void __ecryptfs_printk(const char *fmt, ...)
  */
 int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
 {
+        const struct cred *cred = current_cred();
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
         int rc = 0;
@@ -127,7 +128,7 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
 
                 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
                 rc = ecryptfs_privileged_open(&inode_info->lower_file,
-                                                     lower_dentry, lower_mnt);
+                                              lower_dentry, lower_mnt, cred);
                 if (rc || IS_ERR(inode_info->lower_file)) {
                         printk(KERN_ERR "Error opening lower persistent file "
                                "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 80246bad1b7f..ec1fb918200f 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/sched.h>
 
 #define dprintk(fmt, args...) do{}while(0)
 
@@ -249,6 +250,7 @@ static int filldir_one(void * __buf, const char * name, int len,
 static int get_name(struct vfsmount *mnt, struct dentry *dentry,
                 char *name, struct dentry *child)
 {
+        const struct cred *cred = current_cred();
         struct inode *dir = dentry->d_inode;
         int error;
         struct file *file;
@@ -263,7 +265,7 @@ static int get_name(struct vfsmount *mnt, struct dentry *dentry,
         /*
          * Open the directory ...
          */
-        file = dentry_open(dget(dentry), mntget(mnt), O_RDONLY);
+        file = dentry_open(dget(dentry), mntget(mnt), O_RDONLY, cred);
         error = PTR_ERR(file);
         if (IS_ERR(file))
                 goto out;
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 2b3d1828db99..795e2c130ad7 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -426,6 +426,7 @@ static int file_mode(int fmode)
 
 static int hppfs_open(struct inode *inode, struct file *file)
 {
+        const struct cred *cred = current_cred();
         struct hppfs_private *data;
         struct vfsmount *proc_mnt;
         struct dentry *proc_dentry;
@@ -446,7 +447,7 @@ static int hppfs_open(struct inode *inode, struct file *file)
 
         /* XXX This isn't closed anywhere */
         data->proc_file = dentry_open(dget(proc_dentry), mntget(proc_mnt),
-                                      file_mode(file->f_mode));
+                                      file_mode(file->f_mode), cred);
         err = PTR_ERR(data->proc_file);
         if (IS_ERR(data->proc_file))
                 goto out_free1;
@@ -489,6 +490,7 @@ static int hppfs_open(struct inode *inode, struct file *file)
 
 static int hppfs_dir_open(struct inode *inode, struct file *file)
 {
+        const struct cred *cred = current_cred();
         struct hppfs_private *data;
         struct vfsmount *proc_mnt;
         struct dentry *proc_dentry;
@@ -502,7 +504,7 @@ static int hppfs_dir_open(struct inode *inode, struct file *file)
         proc_dentry = HPPFS_I(inode)->proc_dentry;
         proc_mnt = inode->i_sb->s_fs_info;
         data->proc_file = dentry_open(dget(proc_dentry), mntget(proc_mnt),
-                                      file_mode(file->f_mode));
+                                      file_mode(file->f_mode), cred);
         err = PTR_ERR(data->proc_file);
         if (IS_ERR(data->proc_file))
                 goto out_free;
diff --git a/fs/nfsctl.c b/fs/nfsctl.c
index aed8145d9087..cc4ef2642a51 100644
--- a/fs/nfsctl.c
+++ b/fs/nfsctl.c
@@ -41,7 +41,8 @@ static struct file *do_open(char *name, int flags)
                 error = may_open(&nd, MAY_WRITE, FMODE_WRITE);
 
         if (!error)
-                return dentry_open(nd.path.dentry, nd.path.mnt, flags);
+                return dentry_open(nd.path.dentry, nd.path.mnt, flags,
+                                   current_cred());
 
         path_put(&nd.path);
         return ERR_PTR(error);
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index a5e14e8695ea..632a50b4b371 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -226,7 +226,8 @@ nfsd4_list_rec_dir(struct dentry *dir, recdir_func *f)
 
         nfs4_save_user(&uid, &gid);
 
-        filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY);
+        filp = dentry_open(dget(dir), mntget(rec_dir.mnt), O_RDONLY,
+                           current_cred());
         status = PTR_ERR(filp);
         if (IS_ERR(filp))
                 goto out;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 890d9a68c852..b59ec5a6ed24 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -671,6 +671,7 @@ __be32
 nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                         int access, struct file **filp)
 {
+        const struct cred *cred = current_cred();
         struct dentry   *dentry;
         struct inode    *inode;
         int             flags = O_RDONLY|O_LARGEFILE;
@@ -725,7 +726,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                 DQUOT_INIT(inode);
         }
         *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
-                                flags);
+                            flags, cred);
         if (IS_ERR(*filp))
                 host_err = PTR_ERR(*filp);
 out_nfserr:
diff --git a/fs/open.c b/fs/open.c
index b1238e195e7e..f96eaab280a3 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -783,7 +783,8 @@ static inline int __get_file_write_access(struct inode *inode,
 
 static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                                         int flags, struct file *f,
-                                        int (*open)(struct inode *, struct file *))
+                                        int (*open)(struct inode *, struct file *),
+                                        const struct cred *cred)
 {
         struct inode *inode;
         int error;
@@ -807,7 +808,7 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
         f->f_op = fops_get(inode->i_fop);
         file_move(f, &inode->i_sb->s_files);
 
-        error = security_dentry_open(f);
+        error = security_dentry_open(f, cred);
         if (error)
                 goto cleanup_all;
 
@@ -882,6 +883,8 @@ cleanup_file:
 struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry,
                 int (*open)(struct inode *, struct file *))
 {
+        const struct cred *cred = current_cred();
+
         if (IS_ERR(nd->intent.open.file))
                 goto out;
         if (IS_ERR(dentry))
@@ -889,7 +892,7 @@ struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry
         nd->intent.open.file = __dentry_open(dget(dentry), mntget(nd->path.mnt),
                                              nd->intent.open.flags - 1,
                                              nd->intent.open.file,
-                                             open);
+                                             open, cred);
 out:
         return nd->intent.open.file;
 out_err:
@@ -908,6 +911,7 @@ EXPORT_SYMBOL_GPL(lookup_instantiate_filp);
  */
 struct file *nameidata_to_filp(struct nameidata *nd, int flags)
 {
+        const struct cred *cred = current_cred();
         struct file *filp;
 
         /* Pick up the filp from the open intent */
@@ -915,7 +919,7 @@ struct file *nameidata_to_filp(struct nameidata *nd, int flags)
         /* Has the filesystem initialised the file for us? */
         if (filp->f_path.dentry == NULL)
                 filp = __dentry_open(nd->path.dentry, nd->path.mnt, flags, filp,
-                                     NULL);
+                                     NULL, cred);
         else
                 path_put(&nd->path);
         return filp;
@@ -925,7 +929,8 @@ struct file *nameidata_to_filp(struct nameidata *nd, int flags)
  * dentry_open() will have done dput(dentry) and mntput(mnt) if it returns an
  * error.
  */
-struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
+struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags,
+                         const struct cred *cred)
 {
         int error;
         struct file *f;
@@ -950,7 +955,7 @@ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
                 return ERR_PTR(error);
         }
 
-        return __dentry_open(dentry, mnt, flags, f, NULL);
+        return __dentry_open(dentry, mnt, flags, f, NULL, cred);
 }
 EXPORT_SYMBOL(dentry_open);
 
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index 67c72aec97e6..281cbd5a25cf 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -256,6 +256,7 @@ xfs_open_by_handle(
         struct file             *parfilp,
         struct inode            *parinode)
 {
+        const struct cred       *cred = current_cred();
         int                     error;
         int                     new_fd;
         int                     permflag;
@@ -321,7 +322,7 @@ xfs_open_by_handle(
         mntget(parfilp->f_path.mnt);
 
         /* Create file pointer. */
-        filp = dentry_open(dentry, parfilp->f_path.mnt, hreq.oflags);
+        filp = dentry_open(dentry, parfilp->f_path.mnt, hreq.oflags, cred);
         if (IS_ERR(filp)) {
                 put_unused_fd(new_fd);
                 return -XFS_ERROR(-PTR_ERR(filp));