Re: [PATCH] lsm: simplify security_inode_copy_up_xattr()

[Casey Schaufler <casey@schaufler-ca.com>]

On 7/29/2025 2:09 AM, Tianjia Zhang wrote:
> The implementation of function security_inode_copy_up_xattr can be
> simplified to directly call call_int_hook().
>
> Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
> ---
>  security/security.c | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
>
> diff --git a/security/security.c b/security/security.c
> index 596d41818577..a5c2e5a8009f 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -2774,13 +2774,7 @@ EXPORT_SYMBOL(security_inode_copy_up);
>   */
>  int security_inode_copy_up_xattr(struct dentry *src, const char *name)
>  {
> -	int rc;
> -
> -	rc = call_int_hook(inode_copy_up_xattr, src, name);
> -	if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
> -		return rc;
> -
> -	return LSM_RET_DEFAULT(inode_copy_up_xattr);
> +	return call_int_hook(inode_copy_up_xattr, src, name);

Both the existing code and the proposed change are incorrect.
If two LSMs supply the hook, and the first does not recognize
the attribute, the second, which might recognize the attribute,
will not be called. As SELinux and EVM both supply this hook
there may be a real problem here.

>  }
>  EXPORT_SYMBOL(security_inode_copy_up_xattr);
>