linux-kernel - Re: [PATCH v4] Introduce v3 namespaced file capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170509203736.GB14900@mail.hallyn.com>
Date:   Tue, 9 May 2017 15:37:36 -0500
From:   "Serge E. Hallyn" <serge@...lyn.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     "Serge E. Hallyn" <serge@...lyn.com>,
        Masami Ichikawa <masami256@...il.com>,
        containers@...ts.linux-foundation.org, lkp@...org,
        xiaolong.ye@...el.com, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] Introduce v3 namespaced file capabilities

Quoting Eric W. Biederman (ebiederm@...ssion.com):
> "Serge E. Hallyn" <serge@...lyn.com> writes:
> > Changelog:
> [snip]
> >    May 8, 2017:
> >       . fix leaking dentry refcount in cap_inode_getsecurity
> >
> [snip]
> > +/*
> > + * getsecurity: We are called for security.* before any attempt to read the
> > + * xattr from the inode itself.
> > + *
> > + * This gives us a chance to read the on-disk value and convert it.  If we
> > + * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
> > + *
> > + * Note we are not called by vfs_getxattr_alloc(), but that is only called
> > + * by the integrity subsystem, which really wants the unconverted values -
> > + * so that's good.
> > + */
> > +int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
> > +			  bool alloc)
> > +{
> > +	int size, ret;
> > +	kuid_t kroot;
> > +	uid_t root, mappedroot;
> > +	char *tmpbuf = NULL;
> > +	struct vfs_cap_data *cap;
> > +	struct vfs_ns_cap_data *nscap;
> > +	struct dentry *dentry;
> > +	struct user_namespace *fs_ns;
> > +
> > +	if (strcmp(name, "capability") != 0)
> > +		return -EOPNOTSUPP;
> > +
> > +	dentry = d_find_alias(inode);
> > +	if (!dentry)
> > +		return -EINVAL;
> > +
> > +	size = sizeof(struct vfs_ns_cap_data);
> > +	ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
> > +				 &tmpbuf, size, GFP_NOFS);
> > +	dput(dentry);
> 
> This looks like a good fix but ouch! That interface is wrong.
> 
> The dentry is needed because vfs_getxattr_alloc does:
> 	error = handler->get(handler, dentry, inode, name, NULL, 0);
> 
> Which is has no business taking a dentry as xattrs are inode concepts.
> 
> I have no issue with your patch but it looks like that handler issue
> is going to need to be fixed with xattrs.

True, it's a bit clunky.

Any reason not to just have the current vfs_getxattr_alloc() become a
lightweight wrapper calling inode_getxattr_alloc(dentry->d_inode)?