[PATCH 15/19] smack: smack_inode_setsecurity(): skip checks for SMACK64TRANSMUTE

Konstantin Andreev andreev at swemel.ru
Thu Jul 24 13:09:48 UTC 2025


Like smack_inode_post_setxattr(), smack_inode_setsecurity()
is called after smack_inode_setxattr()
for the SMACK64TRANSMUTE xattr:

    fs/xattr.c:

    ...
    ` __vfs_setxattr_locked
      ` security_inode_setxattr
      ` __vfs_setxattr_noperm
        |
        ` security_inode_post_setxattr
        |    ^
        |     }- one of them is called
        |    v
        ` security_inode_setsecurity

Like smack_inode_post_setxattr(), smack_inode_setsecurity()
does not need to check
the applicability of the SMACK64TRANSMUTE or its value,
as they have already been checked by smack_inode_setxattr()

Signed-off-by: Konstantin Andreev <andreev at swemel.ru>
---
 security/smack/smack_lsm.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 113371887b4d..5175dfb3d448 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3002,10 +3002,6 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
 		return -EINVAL;
 
 	if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
-		if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE ||
-		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
-			return -EINVAL;
-
 		nsp->smk_flags |= SMK_INODE_TRANSMUTE;
 		return 0;
 	}
-- 
2.43.0




More information about the Linux-security-module-archive mailing list