linux-kernel - Re: [RFC] revoke(2) and generic handling of things like remove_proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20130411232913.GC4068@ZenIV.linux.org.uk>
Date:	Fri, 12 Apr 2013 00:29:13 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Rik van Riel <riel@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alexey Dobriyan <adobriyan@...il.com>,
	Takashi Iwai <tiwai@...e.de>
Subject: Re: [RFC] revoke(2) and generic handling of things like
 remove_proc_entry()

On Thu, Apr 11, 2013 at 01:48:26PM -0700, Eric W. Biederman wrote:

> Last time I was looking at this I was noticing that there is a lock
> (mmap_sem?) that is held over every ->vm_op->foo() call.  If that is
> true today it should be possible to just grab that lock and change
> vm_ops.  That makes for a very cheap and easy implementation, except for
> the covolutions needed for taking the lock.

3-rd party down_write(&mm->mmap_sem) is a Bloody Bad Idea(tm).  VM locking is
complicated enough as it is and making it cope with such things would make it
even more convoluted.

> If we can do add useful support at the fs and mm layers without
> affecting performance I am all for it.  I remember that tends to make
> things easier.  As an alternative let me suggest what I had intended to
> do if/when I ever got back to working on revoke.
> 
> Make a library like libfs that can be used for files that want to
> implement revoke support.
> 
> In that library implement what can be implemented reliably and correctly
> and error on the sophisticated cases we can't support.
> 
> With the semantics and the basic users figured out move what bits we can
> into the vfs or the mm subsystem to make things easier.
> 
> With a library at the very least we have one implementation that we can
> debug and work with instead of a different implementation of revoke for
> each different kind of file.

Yecchh...  revoke() as a syscall or revoke as something that happens when
kernel decides that file has gone away?  The latter includes
procfs/debugfs/sysfs at the very least.  Do we want to require all of those
to use that library?  I would rather try to avoid a need for wrappers, TBH...

You have a very good point re ->close() - the locking conditions for it are
such that making revoke do it is extremely inconvenient.  IMO it means that
mmap should check for attempts to set ->vm_op on vma with non-NULL
->vm_file->f_revoke and fail if it runs into such.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/