From: Stephen Smalley This patch removes the use of nameidata by selinux_inode_permission, as this appears to be unsafe in certain cases (e.g. path_walk call from rpc_lookup_parent), leading to an Oops if d_path is subsequently called by avc_audit on the (mnt,dentry) pair to generate a pathname for an audit message. The change does not affect the ability of SELinux to perform its permission check (which only requires the inode), only the set of information that is available for audit messages. We'll investigate better approaches for the SELinux audit generation in the future. 25-akpm/security/selinux/hooks.c | 4 ---- 1 files changed, 4 deletions(-) diff -puN security/selinux/hooks.c~selinux-nameidata-oops-fix security/selinux/hooks.c --- 25/security/selinux/hooks.c~selinux-nameidata-oops-fix Fri Dec 19 17:37:35 2003 +++ 25-akpm/security/selinux/hooks.c Fri Dec 19 17:37:35 2003 @@ -1738,10 +1738,6 @@ static int selinux_inode_permission(stru return 0; } - if (nd && nd->dentry) - return dentry_has_perm(current, nd->mnt, nd->dentry, - file_mask_to_av(inode->i_mode, mask)); - return inode_has_perm(current, inode, file_mask_to_av(inode->i_mode, mask), NULL, NULL); } _