From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 31 Aug 2022 16:23:16 +0000 (-0700)
Subject: Merge tag 'lsm-pr-20220829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
X-Git-Url: https://repo.jachan.dev/J-linux.git/commitdiff_plain/9c9d1896fa92e05e7af5a7a47e335f834aa4248c?hp=-c

Merge tag 'lsm-pr-20220829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull LSM support for IORING_OP_URING_CMD from Paul Moore:
 "Add SELinux and Smack controls to the io_uring IORING_OP_URING_CMD.

  These are necessary as without them the IORING_OP_URING_CMD remains
  outside the purview of the LSMs (Luis' LSM patch, Casey's Smack patch,
  and my SELinux patch). They have been discussed at length with the
  io_uring folks, and Jens has given his thumbs-up on the relevant
  patches (see the commit descriptions).

  There is one patch that is not strictly necessary, but it makes
  testing much easier and is very trivial: the /dev/null
  IORING_OP_URING_CMD patch."

* tag 'lsm-pr-20220829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  Smack: Provide read control for io_uring_cmd
  /dev/null: add IORING_OP_URING_CMD support
  selinux: implement the security_uring_cmd() LSM hook
  lsm,io_uring: add LSM hooks for the new uring_cmd file op
---

9c9d1896fa92e05e7af5a7a47e335f834aa4248c
diff --combined io_uring/uring_cmd.c
index b9989ae7b957,0f7ad956ddcb..e78b6f980d77
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@@ -3,6 -3,7 +3,7 @@@
  #include <linux/errno.h>
  #include <linux/file.h>
  #include <linux/io_uring.h>
+ #include <linux/security.h>
  
  #include <uapi/linux/io_uring.h>
  
@@@ -88,6 -89,10 +89,10 @@@ int io_uring_cmd(struct io_kiocb *req, 
  	if (!req->file->f_op->uring_cmd)
  		return -EOPNOTSUPP;
  
+ 	ret = security_uring_cmd(ioucmd);
+ 	if (ret)
+ 		return ret;
+ 
  	if (ctx->flags & IORING_SETUP_SQE128)
  		issue_flags |= IO_URING_F_SQE128;
  	if (ctx->flags & IORING_SETUP_CQE32)
@@@ -112,7 -117,7 +117,7 @@@
  		if (ret < 0)
  			req_set_fail(req);
  		io_req_set_res(req, ret, 0);
 -		return IOU_OK;
 +		return ret;
  	}
  
  	return IOU_ISSUE_SKIP_COMPLETE;