security/landlock/fs.c
Source file repositories/reference/linux-study-clean/security/landlock/fs.c
File Facts
- System
- Linux kernel
- Corpus path
security/landlock/fs.c- Extension
.c- Size
- 65329 bytes
- Lines
- 2038
- Domain
- Core OS
- Bucket
- Security And Isolation
- Inferred role
- Core OS: implementation source
- Status
- source implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
asm/ioctls.hkunit/test.hlinux/atomic.hlinux/bitops.hlinux/bits.hlinux/compiler_types.hlinux/dcache.hlinux/err.hlinux/falloc.hlinux/fs.hlinux/init.hlinux/kernel.hlinux/limits.hlinux/list.hlinux/lsm_audit.hlinux/lsm_hooks.hlinux/mount.hlinux/namei.hlinux/net.hlinux/path.hlinux/pid.hlinux/rcupdate.hlinux/sched/signal.hlinux/spinlock.hlinux/stat.hlinux/types.hlinux/wait_bit.hlinux/workqueue.hnet/af_unix.huapi/linux/fiemap.huapi/linux/landlock.haccess.h
Detected Declarations
function release_inodefunction do_vfs_ioctlfunction is_masked_device_ioctl_compatfunction landlock_append_fs_rulefunction find_rulefunction mountablefunction may_referfunction rightsfunction test_no_more_accessfunction is_layer_masks_allowedfunction scope_to_requestfunction test_scope_to_request_with_exec_nonefunction test_scope_to_request_with_exec_somefunction test_scope_to_request_without_accessfunction is_eaccesfunction test_is_eacces_with_nonefunction test_is_eacces_with_referfunction test_is_eacces_with_writefunction sourcefunction current_check_access_pathfunction get_mode_accessfunction maybe_removefunction is_access_to_paths_allowedfunction filefunction hook_inode_free_security_rcufunction hook_sb_deletefunction release_inodefunction log_fs_change_topology_pathfunction log_fs_change_topology_dentryfunction topologyfunction hook_move_mountfunction hook_sb_umountfunction hook_sb_remountfunction pivot_rootfunction hook_path_linkfunction hook_path_renamefunction hook_path_mkdirfunction hook_path_mknodfunction hook_path_symlinkfunction hook_path_unlinkfunction hook_path_rmdirfunction hook_path_truncatefunction domain_is_scopedfunction hook_unix_findfunction get_required_file_open_accessfunction hook_file_alloc_securityfunction is_devicefunction hook_file_open
Annotated Snippet
if (likely(refcount_inc_not_zero(&object->usage))) {
rcu_read_unlock();
return object;
}
/*
* We are racing with release_inode(), the object is going
* away. Wait for release_inode(), then retry.
*/
spin_lock(&object->lock);
spin_unlock(&object->lock);
goto retry;
}
rcu_read_unlock();
/*
* If there is no object tied to @inode, then create a new one (without
* holding any locks).
*/
new_object = landlock_create_object(&landlock_fs_underops, inode);
if (IS_ERR(new_object))
return new_object;
/*
* Protects against concurrent calls to get_inode_object() or
* hook_sb_delete().
*/
spin_lock(&inode->i_lock);
if (unlikely(rcu_access_pointer(inode_sec->object))) {
/* Someone else just created the object, bail out and retry. */
spin_unlock(&inode->i_lock);
kfree(new_object);
rcu_read_lock();
goto retry;
}
/*
* @inode will be released by hook_sb_delete() on its superblock
* shutdown, or by release_inode() when no more ruleset references the
* related object.
*/
ihold(inode);
rcu_assign_pointer(inode_sec->object, new_object);
spin_unlock(&inode->i_lock);
return new_object;
}
/* All access rights that can be tied to files. */
/* clang-format off */
#define ACCESS_FILE ( \
LANDLOCK_ACCESS_FS_EXECUTE | \
LANDLOCK_ACCESS_FS_WRITE_FILE | \
LANDLOCK_ACCESS_FS_READ_FILE | \
LANDLOCK_ACCESS_FS_TRUNCATE | \
LANDLOCK_ACCESS_FS_IOCTL_DEV | \
LANDLOCK_ACCESS_FS_RESOLVE_UNIX)
/* clang-format on */
/*
* @path: Should have been checked by get_path_from_fd().
*/
int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
const struct path *const path,
access_mask_t access_rights, const u32 flags)
{
int err;
struct landlock_id id = {
.type = LANDLOCK_KEY_INODE,
};
/* Files only get access rights that make sense. */
if (!d_is_dir(path->dentry) &&
!access_mask_subset(access_rights, ACCESS_FILE))
return -EINVAL;
if (WARN_ON_ONCE(ruleset->num_layers != 1))
return -EINVAL;
/* Transforms relative access rights to absolute ones. */
access_rights |= LANDLOCK_MASK_ACCESS_FS &
~landlock_get_fs_access_mask(ruleset, 0);
id.key.object = get_inode_object(d_backing_inode(path->dentry));
if (IS_ERR(id.key.object))
return PTR_ERR(id.key.object);
mutex_lock(&ruleset->lock);
err = landlock_insert_rule(ruleset, id, access_rights, flags);
mutex_unlock(&ruleset->lock);
/*
* No need to check for an error because landlock_insert_rule()
* increments the refcount for the new object if needed.
*/
Annotation
- Immediate include surface: `asm/ioctls.h`, `kunit/test.h`, `linux/atomic.h`, `linux/bitops.h`, `linux/bits.h`, `linux/compiler_types.h`, `linux/dcache.h`, `linux/err.h`.
- Detected declarations: `function release_inode`, `function do_vfs_ioctl`, `function is_masked_device_ioctl_compat`, `function landlock_append_fs_rule`, `function find_rule`, `function mountable`, `function may_refer`, `function rights`, `function test_no_more_access`, `function is_layer_masks_allowed`.
- Atlas domain: Core OS / Security And Isolation.
- Implementation status: source implementation candidate.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.