tree 26ff1dddb3c8727118b24819e83b4b7c500ff595
parent 0da939b0058742ad2d8580b7db6b966d0fc72252
author Eric Paris <eparis@redhat.com> 1225314406 -0400
committer James Morris <jmorris@namei.org> 1225378852 +1100

SELinux: check open perms in dentry_open not inode_permission

Some operations, like searching a directory path or connecting a unix domain
socket, make explicit calls into inode_permission.  Our choices are to
either try to come up with a signature for all of the explicit calls to
inode_permission and do not check open on those, or to move the open checks to
dentry_open where we know this is always an open operation.  This patch moves
the checks to dentry_open.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>