Hi Casey/Al/all,
A patch that utilizes Al Viro's concerns on previous smack parser
and solves pevious parser bugs discovered by Ahmed Darwish. By now,
no problem will occur if given smack rules are fragmented over
multiple write() calls.
CC: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
---
A similar patch for parsing CIPSO rules will be sent soon.
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 88b3f7b..9b56281 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -67,6 +67,39 @@ static int smack_cipso_count;
struct smk_list_entry *smack_list;
/*
+ * Disable concurrent writing open() operations
+ */
+static struct semaphore smack_write_sem;
+
+/*
+ * States for parsing /smack/load rules
+ */
+enum load_state {
+ subject = 0,
+ object = 1,
+ access = 2,
+ eol = 3,
+};
+
+/*
+ * Represent current parsing state of /smack/load. Struct
+ * also stores data needed between an open-release session's
+ * multiple write() calls
+ */
+static struct smack_load_state {
+ enum load_state state;
+ struct smack_rule rule;
+ int label_len;
+ char subject[SMK_LABELLEN];
+ char object[SMK_LABELLEN];
+} *load_state;
+
+static inline int isblank(char c)
+{
+ return (c == ' ' || c == '\t');
+}
+
+/*
* Seq_file read operations for /smack/load
*/
@@ -127,12 +160,43 @@ static struct seq_operations load_seq_ops = {
* @inode: inode structure representing file
* @file: "load" file pointer
*
- * Connect our load_seq_* operations with /smack/load
- * file_operations
+ * For reading, use load_seq_* seq_file reading operations.
+ * For writing, prepare a load_state struct to parse
+ * incoming rules.
*/
static int smk_open_load(struct inode *inode, struct file *file)
{
- return seq_open(file, &load_seq_ops);
+ if ((file->f_flags & O_ACCMODE) == O_RDONLY)
+ return seq_open(file, &load_seq_ops);
+
+ if (do...
