linux-ext4 - Re: [PATCH 2/2] delay capable() check in ext4_has_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1224881281.6379.8.camel@mingming-laptop>
Date:	Fri, 24 Oct 2008 13:48:01 -0700
From:	Mingming Cao <cmm@...ibm.com>
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	ext4 development <linux-ext4@...r.kernel.org>,
	Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH 2/2] delay capable() check in ext4_has_free_blocks(


在 2008-10-24五的 15:27 -0500，Eric Sandeen写道：
> As reported by Eric Paris, the capable() check in ext4_has_free_blocks()
> sometimes causes SELinux denials.
> 
> We can rearrange the logic so that we only try to use the root-reserved
> blocks when necessary, and even then we can move the capable() test
> to last, to avoid the check most of the time.
> 
> Signed-off-by: Eric Sandeen <sandeen@...hat.com>

Reviewed-by: Mingming Cao <cmm@...ibm.com>
> --
> 
> Index: linux-2.6/fs/ext4/balloc.c
> ===================================================================
> --- linux-2.6.orig/fs/ext4/balloc.c	2008-10-24 14:43:11.103063953 -0500
> +++ linux-2.6/fs/ext4/balloc.c	2008-10-24 14:43:18.082063765 -0500
> @@ -596,23 +596,19 @@ void ext4_free_blocks(handle_t *handle, 
>   *
>   * Check if filesystem has free blocks available for allocation.
>   * Return the number of blocks avaible for allocation for this request
> - * On success, return nblocks
> + * On success, return 1, on failure, return 0.
>   */
>  int ext4_has_free_blocks(struct ext4_sb_info *sbi,
>  						s64 nblocks)
>  {
> -	s64 free_blocks, dirty_blocks;
> -	s64 root_blocks = 0;
> +	s64 free_blocks, dirty_blocks, root_blocks;
>  	struct percpu_counter *fbc = &sbi->s_freeblocks_counter;
>  	struct percpu_counter *dbc = &sbi->s_dirtyblocks_counter;
> 
>  	free_blocks  = percpu_counter_read_positive(fbc);
>  	dirty_blocks = percpu_counter_read_positive(dbc);
> +	root_blocks = ext4_r_blocks_count(sbi->s_es);
> 
> -	if (!capable(CAP_SYS_RESOURCE) &&
> -		sbi->s_resuid != current->fsuid &&
> -		(sbi->s_resgid == 0 || !in_group_p(sbi->s_resgid)))
> -		root_blocks = ext4_r_blocks_count(sbi->s_es);
> 
>  	if (free_blocks - (nblocks + root_blocks + dirty_blocks) <
>  						EXT4_FREEBLOCKS_WATERMARK) {
> @@ -625,13 +621,20 @@ int ext4_has_free_blocks(struct ext4_sb_
>  		}
>  	}
>  	/* Check whether we have space after
> -	 * accounting for current dirty blocks
> +	 * accounting for current dirty blocks & root reserved blocks.
>  	 */
> -	if (free_blocks < ((root_blocks + nblocks) + dirty_blocks))
> -		/* we don't have free space */
> -		return 0;
> +	if (free_blocks >= ((root_blocks + nblocks) + dirty_blocks))
> +		return 1;
> 
> -	return 1;
> +	/* Hm, nope.  Are (enough) root reserved blocks available? */
> +	if (sbi->s_resuid == current->fsuid ||
> +	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
> +	    capable(CAP_SYS_RESOURCE)) {
> +		if (free_blocks >= (nblocks + dirty_blocks))
> +			return 1;
> +	}
> +
> +	return 0;
>  }
> 
>  int ext4_claim_free_blocks(struct ext4_sb_info *sbi,
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html