linux-kernel - Re: [RFC] fs: add userspace critical mounts event support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20161005173835.GC3296@wotan.suse.de>
Date:   Wed, 5 Oct 2016 19:38:35 +0200
From:   "Luis R. Rodriguez" <mcgrof@...nel.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Dmitry Torokhov <dmitry.torokhov@...il.com>,
        "Herbert, Marc" <marc.herbert@...el.com>,
        "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
        Jacek Anaszewski <j.anaszewski@...sung.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Christian Lamparter <chunkeey@...glemail.com>,
        Julia Lawall <Julia.Lawall@...6.fr>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>,
        Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        Andy Lutomirski <luto@...capital.net>,
        Richard Purdie <rpurdie@...ys.net>,
        Wu Fengguang <fengguang.wu@...el.com>,
        Johannes Berg <johannes@...solutions.net>,
        Michal Marek <mmarek@...e.com>,
        Hauke Mehrtens <hauke@...ke-m.de>,
        Mark Brown <broonie@...nel.org>, Jiri Slaby <jslaby@...e.com>,
        Ming Lei <ming.lei@...onical.com>,
        Daniel Vetter <daniel.vetter@...ll.ch>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Felix Fietkau <nbd@....name>, Roman Pen <r.peniaev@...il.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Vikram Mulukutla <markivx@...eaurora.org>,
        Stephen Boyd <stephen.boyd@...aro.org>,
        Takashi Iwai <tiwai@...e.de>, Jeff Mahoney <jeffm@...e.com>,
        Hariprasad S <hariprasad@...lsio.com>,
        Benjamin Poirier <bpoirier@...e.de>,
        Josh Triplett <josh@...htriplett.org>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [RFC] fs: add userspace critical mounts event support

On Tue, Oct 04, 2016 at 05:32:22PM -0700, Linus Torvalds wrote:
> On Tue, Oct 4, 2016 at 5:24 PM, Luis R. Rodriguez <mcgrof@...nel.org> wrote:
> >
> > Note that the races are beyond firmware, so all
> > kernel_read_file_from_path() users, as such re-using such old /sys/
> > interafeces for firmware will not suffice to cover all ground now for
> > the same race for other possible users.
> 
> Blah blah blah.
> 
> The reason I've hated this whole discussion is that it's full of
> "let's re-architect everything", and then it has these horribly warty
> interfaces.

To be clear, kernel_read_file_from_path() was an agreed upon strategy
about 1 year ago at the Linux Security summit as we found different
kernel implementations for the same exact task, reading files from
the filesystem -- my point here was simply that acknowledging that the
race on early init and driver's init / probe for firmware is implicating
that the race is *also* possible for the other kernel-read-from-fs points.
Its not clear to me what your grudge here is other than the proposal
for a solution in this patch is not what we want.

> It's classic second-system syndrome.
> 
> Just do *one* thing, and do it well. Don't change anything else. Don't
> force existign drivers to use new interfaces. Don't over-architect,
> and don't do stupid interfaces.

If there is a race for the other users and we want to avoid wrapping
a solution for it to the other callers without doing any vetting for
correctness then so be it, but to disregard completely seems error-prone.
I accept that thinking about such other users may complicate a solution
for firmware and if you prefer we just separate the race solution for
both that's fine.

> If user-space mounts a new filesystem (or just unpacks files from a
> tar-file that has firmware images in it, for chissake), that is not
> some magical "critical mount event". The whole concept is just stupid.
> Is it a "mount event" when the user downloads a new firmware image
> from the internet?
> 
> HELL NO.

We've gotten passed that the original implementation proposed is not what we
want, let's move on.

> But what is equally stupid is to then dismiss simple models because
> some totally unrelated "beyond firmware" issue.

I have not heard back from the other stakeholders using
kernel_read_file_from_path() and possible races for them. You seem to suggest
to ignore those possible theoretical races in the name of a simple solution for
firmware. Fine.

> Anything that is "beyond firmware" shouldn't even be discussed, for
> chrissake! It has nothing what-so-ever to do with firmware loading. If
> there ends up being some common helper functions, and shared code,
> that *still* doesn't make it so.

My point was to raise the flag of the possible races on the other call sites
where we read files directly from the kernel, that's all, if we agree we really
don't care for that fine.

> Basic rules of thumb:
> 
>  (a) don't over-design
> 
>  (b) don't have stupid illogical interfaces
> 
>  (c) don't conflate different issues just because you think they may
> have shared code.
> 
>  (4) be consistent. Don't make up new interfaces, and most certainly
> do *NOT* dismiss something just because it's what we have done before.
> 
> That's it.

OK..

  Luis