Hi, On Mon, 2011-05-16 at 10:45 -0400, Mimi Zohar wrote: > After creating the initial LSM security extended attribute, call > evm_inode_post_init_security() to create the 'security.evm' > extended attribute. > > Signed-off-by: Mimi Zohar <[email protected]> > --- > fs/gfs2/inode.c | 28 +++++++++++++++++++--------- > 1 files changed, 19 insertions(+), 9 deletions(-) > [snip] > + struct xattr lsm_xattr; > + struct xattr evm_xattr; > > err = security_inode_init_security(&ip->i_inode, &dip->i_inode, qstr, > - &name, &value, &len); > + &lsm_xattr.name, &lsm_xattr.value, > + &lsm_xattr.value_len); > > if (err) { > if (err == -EOPNOTSUPP) > @@ -780,11 +781,20 @@ static int gfs2_security_init(struct gfs2_inode *dip, > struct gfs2_inode *ip, > return err; > } > > - err = __gfs2_xattr_set(&ip->i_inode, name, value, len, 0, > - GFS2_EATYPE_SECURITY); > - kfree(value); > - kfree(name); > - > + err = __gfs2_xattr_set(&ip->i_inode, lsm_xattr.name, lsm_xattr.value, > + lsm_xattr.value_len, 0, GFS2_EATYPE_SECURITY); > + if (err < 0) > + goto out; > + err = evm_inode_post_init_security(&ip->i_inode, &lsm_xattr, > + &evm_xattr); > + if (err) > + goto out; > + err = __gfs2_xattr_set(&ip->i_inode, evm_xattr.name, evm_xattr.value, > + evm_xattr.value_len, 0, GFS2_EATYPE_SECURITY); > + kfree(evm_xattr.value); > +out: > + kfree(lsm_xattr.name); > + kfree(lsm_xattr.value); > return err; > } >
Just wondering whether we could have a single call to the security subsystem which returns a vector of xattrs rather than having to call two different functions? Steve.
