security, overlayfs: Provide hook to correctly label newly created files

[deliverable/linux.git] / include / linux / lsm_hooks.h

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 57971229551b1ddbb0dc8c7100eea0461a2761b5..f2af2af131ac536ac6087d81dffc493bc4d49a82 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -151,6 +151,16 @@
  *     @name name of the last path component used to create file
  *     @ctx pointer to place the pointer to the resulting context in.
  *     @ctxlen point to place the length of the resulting context.
+ * @dentry_create_files_as:
+ *     Compute a context for a dentry as the inode is not yet available
+ *     and set that context in passed in creds so that new files are
+ *     created using that context. Context is calculated using the
+ *     passed in creds and not the creds of the caller.
+ *     @dentry dentry to use in calculating the context.
+ *     @mode mode used to determine resource type.
+ *     @name name of the last path component used to create file
+ *     @old creds which should be used for context calculation
+ *     @new creds to modify
  *
  *
  * Security hooks for inode operations.
@@ -1375,6 +1385,10 @@ union security_list_options {
        int (*dentry_init_security)(struct dentry *dentry, int mode,
                                        const struct qstr *name, void **ctx,
                                        u32 *ctxlen);
+       int (*dentry_create_files_as)(struct dentry *dentry, int mode,
+                                       struct qstr *name,
+                                       const struct cred *old,
+                                       struct cred *new);
 
 
 #ifdef CONFIG_SECURITY_PATH
@@ -1675,6 +1689,7 @@ struct security_hook_heads {
        struct list_head sb_clone_mnt_opts;
        struct list_head sb_parse_opts_str;
        struct list_head dentry_init_security;
+       struct list_head dentry_create_files_as;
 #ifdef CONFIG_SECURITY_PATH
        struct list_head path_unlink;
        struct list_head path_mkdir;