[apparmor] [PATCH 3/4] security: add security_path_access hook

[Christian Boltz]

Hello,

basically what we are just discussing in
    [PATCH 1/4] security: add security_path_chdir hook
also applies here:

Am Donnerstag, 28. November 2013 schrieb Seth Arnold:
> On Tue, Nov 05, 2013 at 05:35:00AM -0800, John Johansen wrote:
> > diff --git a/fs/open.c b/fs/open.c
> > index 9505fc5..f3e276e 100644
> > --- a/fs/open.c
> > +++ b/fs/open.c
> > @@ -343,6 +343,10 @@ retry:
> >  			goto out_path_release;
> >  	}
> > 
> > +	res = security_path_access(&path, mode | MAY_ACCESS);
> > +	if (res)
> > +		goto out_path_release;
> > +
> > 
> >  	res = inode_permission(inode, mode | MAY_ACCESS);
> >  	/* SuS v2 requires we report a read only fs too */
> >  	if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))

Please insert the hook _after_ checking the file/directory permissions, 
not before.


Regards,

Christian Boltz
-- 
> Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten 
> haben. Da hat der eine den anderen auch nicht verstanden.
Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;)
[> Martin Borchert und Bernd Brodesser in suse-linux]