From patchwork Mon Aug 22 21:22:06 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Gruenbacher X-Patchwork-Id: 9294419 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EACB960574 for ; Mon, 22 Aug 2016 21:25:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D9790287EE for ; Mon, 22 Aug 2016 21:25:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C9A0928A9C; Mon, 22 Aug 2016 21:25:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6957F287EE for ; Mon, 22 Aug 2016 21:25:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756739AbcHVVZB (ORCPT ); Mon, 22 Aug 2016 17:25:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47536 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754577AbcHVVY1 (ORCPT ); Mon, 22 Aug 2016 17:24:27 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0D8FFC05678C; Mon, 22 Aug 2016 21:23:49 +0000 (UTC) Received: from nux.redhat.com (vpn1-5-3.ams2.redhat.com [10.36.5.3]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u7MLM9YR025532; Mon, 22 Aug 2016 17:23:44 -0400 From: Andreas Gruenbacher To: Alexander Viro Cc: Andreas Gruenbacher , linux-fsdevel@vger.kernel.org, Tyler Hicks , ecryptfs@vger.kernel.org, Miklos Szeredi , linux-unionfs@vger.kernel.org, David Howells , Serge Hallyn , Dmitry Kasatkin , linux-ima-devel@lists.sourceforge.net, Paul Moore , Stephen Smalley , Eric Paris , Casey Schaufler , Oleg Drokin , Andreas Dilger Subject: [PATCH v4 18/20] vfs: Check for the IOP_XATTR flag in listxattr Date: Mon, 22 Aug 2016 23:22:06 +0200 Message-Id: <1471900928-21588-19-git-send-email-agruenba@redhat.com> In-Reply-To: <1471900928-21588-1-git-send-email-agruenba@redhat.com> References: <1471900928-21588-1-git-send-email-agruenba@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Mon, 22 Aug 2016 21:23:49 +0000 (UTC) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When an inode doesn't support xattrs, turn listxattr off as well. (When xattrs are "turned off", the VFS still passes security xattr operations through to security modules, which can still expose inode security labels that way.) Signed-off-by: Andreas Gruenbacher --- fs/xattr.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index 54a4115..e1ccf2b 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -326,18 +326,19 @@ nolsm: EXPORT_SYMBOL_GPL(vfs_getxattr); ssize_t -vfs_listxattr(struct dentry *d, char *list, size_t size) +vfs_listxattr(struct dentry *dentry, char *list, size_t size) { + struct inode *inode = d_inode(dentry); ssize_t error; - error = security_inode_listxattr(d); + error = security_inode_listxattr(dentry); if (error) return error; - error = -EOPNOTSUPP; - if (d->d_inode->i_op->listxattr) { - error = d->d_inode->i_op->listxattr(d, list, size); + if (inode->i_op->listxattr && (inode->i_opflags & IOP_XATTR)) { + error = -EOPNOTSUPP; + error = inode->i_op->listxattr(dentry, list, size); } else { - error = security_inode_listsecurity(d->d_inode, list, size); + error = security_inode_listsecurity(inode, list, size); if (size && error > size) error = -ERANGE; }