diff options
Diffstat (limited to 'security/landlock/fs.c')
| -rw-r--r-- | security/landlock/fs.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/security/landlock/fs.c b/security/landlock/fs.c index f59db97333f3..50e02bdab089 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -1670,15 +1670,23 @@ static bool control_current_fowner(struct fown_struct *const fown) static void hook_file_set_fowner(struct file *file) { struct landlock_ruleset *prev_dom; - struct landlock_ruleset *new_dom = NULL; + struct landlock_cred_security fown_subject = {}; if (control_current_fowner(file_f_owner(file))) { - new_dom = landlock_get_current_domain(); - landlock_get_ruleset(new_dom); + static const struct access_masks signal_scope = { + .scope = LANDLOCK_SCOPE_SIGNAL, + }; + const struct landlock_cred_security *new_subject = + landlock_get_applicable_subject(current_cred(), + signal_scope, NULL); + if (new_subject) { + landlock_get_ruleset(new_subject->domain); + fown_subject = *new_subject; + } } - prev_dom = landlock_file(file)->fown_domain; - landlock_file(file)->fown_domain = new_dom; + prev_dom = landlock_file(file)->fown_subject.domain; + landlock_file(file)->fown_subject = fown_subject; /* May be called in an RCU read-side critical section. */ landlock_put_ruleset_deferred(prev_dom); @@ -1686,7 +1694,7 @@ static void hook_file_set_fowner(struct file *file) static void hook_file_free_security(struct file *file) { - landlock_put_ruleset_deferred(landlock_file(file)->fown_domain); + landlock_put_ruleset_deferred(landlock_file(file)->fown_subject.domain); } static struct security_hook_list landlock_hooks[] __ro_after_init = { |