linux-kernel - Re: [PATCH v4] Introduce v3 namespaced file capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87mvalu0nc.fsf@xmission.com>
Date:   Tue, 09 May 2017 17:27:03 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     "Serge E. Hallyn" <serge@...lyn.com>
Cc:     Masami Ichikawa <masami256@...il.com>,
        containers@...ts.linux-foundation.org, lkp@...org,
        xiaolong.ye@...el.com, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] Introduce v3 namespaced file capabilities

"Serge E. Hallyn" <serge@...lyn.com> writes:

> Quoting Eric W. Biederman (ebiederm@...ssion.com):
>> "Serge E. Hallyn" <serge@...lyn.com> writes:
>> > Changelog:
>> [snip]
>> >    May 8, 2017:
>> >       . fix leaking dentry refcount in cap_inode_getsecurity
>> >
>> [snip]
>> > +/*
>> > + * getsecurity: We are called for security.* before any attempt to read the
>> > + * xattr from the inode itself.
>> > + *
>> > + * This gives us a chance to read the on-disk value and convert it.  If we
>> > + * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
>> > + *
>> > + * Note we are not called by vfs_getxattr_alloc(), but that is only called
>> > + * by the integrity subsystem, which really wants the unconverted values -
>> > + * so that's good.
>> > + */
>> > +int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
>> > +			  bool alloc)
>> > +{
>> > +	int size, ret;
>> > +	kuid_t kroot;
>> > +	uid_t root, mappedroot;
>> > +	char *tmpbuf = NULL;
>> > +	struct vfs_cap_data *cap;
>> > +	struct vfs_ns_cap_data *nscap;
>> > +	struct dentry *dentry;
>> > +	struct user_namespace *fs_ns;
>> > +
>> > +	if (strcmp(name, "capability") != 0)
>> > +		return -EOPNOTSUPP;
>> > +
>> > +	dentry = d_find_alias(inode);
>> > +	if (!dentry)
>> > +		return -EINVAL;
>> > +
>> > +	size = sizeof(struct vfs_ns_cap_data);
>> > +	ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
>> > +				 &tmpbuf, size, GFP_NOFS);
>> > +	dput(dentry);
>> 
>> This looks like a good fix but ouch! That interface is wrong.
>> 
>> The dentry is needed because vfs_getxattr_alloc does:
>> 	error = handler->get(handler, dentry, inode, name, NULL, 0);
>> 
>> Which is has no business taking a dentry as xattrs are inode concepts.
>> 
>> I have no issue with your patch but it looks like that handler issue
>> is going to need to be fixed with xattrs.
>
> True, it's a bit clunky.
>
> Any reason not to just have the current vfs_getxattr_alloc() become a
> lightweight wrapper calling inode_getxattr_alloc(dentry->d_inode)?

My deep issue is that handler is functions like posix_acl_xattr_get.
And all of those functions that vfs_getxattr_alloc calls should not
take a dentry.

So I feel like I have just spotted the tip of an iceberg that needs
sorting out.

Eric