[PATCH v3 2/2] proc: ensure security hook is called after exec

[Stephen Brennan]

Smack needs its security_task_to_inode() hook to be called when a task
execs a new executable. Store the self_exec_id of the task and call the
hook via pid_update_inode() whenever the exec_id changes.

Signed-off-by: Stephen Brennan <stephen.s.bren...@oracle.com>
---

As discussed on the v2 of the patch, this should allow Smack to receive a
security_task_to_inode() call only when the uid/gid changes, or when the task
execs a new binary. I have verified that this doesn't change the performance of
the patch set, and that we do fall out of RCU walk on tasks which have recently
exec'd.

 fs/proc/base.c     | 4 +++-
 fs/proc/internal.h | 5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4b246e9bd5df..ad59e92e8433 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1917,6 +1917,7 @@ struct inode *proc_pid_make_inode(struct super_block * sb,
        }
 
        task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid);
+       ei->exec_id = task->self_exec_id;
        security_task_to_inode(task, inode);
 
 out:
@@ -1965,6 +1966,7 @@ void pid_update_inode(struct task_struct *task, struct 
inode *inode)
        task_dump_owner(task, inode->i_mode, &inode->i_uid, &inode->i_gid);
 
        inode->i_mode &= ~(S_ISUID | S_ISGID);
+       PROC_I(inode)->exec_id = task->self_exec_id;
        security_task_to_inode(task, inode);
 }
 
@@ -1979,7 +1981,7 @@ static bool pid_inode_needs_update(struct task_struct 
*task, struct inode *inode
        task_dump_owner(task, inode->i_mode, &uid, &gid);
        if (!uid_eq(uid, inode->i_uid) || !gid_eq(gid, inode->i_gid))
                return true;
-       return false;
+       return task->self_exec_id != PROC_I(inode)->exec_id;
 }
 
 /*
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index f60b379dcdc7..1df9b039dfc3 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -92,7 +92,10 @@ union proc_op {
 
 struct proc_inode {
        struct pid *pid;
-       unsigned int fd;
+       union {
+               unsigned int fd;
+               u32 exec_id;
+       };
        union proc_op op;
        struct proc_dir_entry *pde;
        struct ctl_table_header *sysctl;
-- 
2.25.1