Commit 30524472 authored by Al Viro's avatar Al Viro

[PATCH] take noexec checks to very few callers that care

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent e56b6a5d
......@@ -118,6 +118,10 @@ asmlinkage long sys_uselib(const char __user * library)
if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
goto exit;
error = -EACCES;
if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
goto exit;
error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);
if (error)
goto exit;
......@@ -668,6 +672,9 @@ struct file *open_exec(const char *name)
if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
goto out_path_put;
if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
goto out_path_put;
err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);
if (err)
goto out_path_put;
......
......@@ -252,15 +252,6 @@ int permission(struct inode *inode, int mask, struct nameidata *nd)
return -EACCES;
}
if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
/*
* MAY_EXEC on regular files is denied if the fs is mounted
* with the "noexec" flag.
*/
if (mnt && (mnt->mnt_flags & MNT_NOEXEC))
return -EACCES;
}
/* Ordinary permission routines do not understand MAY_APPEND. */
if (inode->i_op && inode->i_op->permission) {
retval = inode->i_op->permission(inode, mask);
......
......@@ -461,6 +461,16 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
if (res)
goto out;
if ((mode & MAY_EXEC) && S_ISREG(nd.path.dentry->d_inode->i_mode)) {
/*
* MAY_EXEC on regular files is denied if the fs is mounted
* with the "noexec" flag.
*/
res = -EACCES;
if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
goto out_path_release;
}
res = vfs_permission(&nd, mode | MAY_ACCESS);
/* SuS v2 requires we report a read only fs too */
if(res || !(mode & S_IWOTH) ||
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment