linux-kernel - Re: [RFC PATCH ghak100 V1 1/2] audit: avoid fcaps on MNT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJfpegt8H-8-PJyJbGe9zQB1DxBQLoMA0QRhc-gAH=mw6YKhVw@mail.gmail.com>
Date:   Tue, 20 Nov 2018 09:17:15 +0100
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Richard Guy Briggs <rgb@...hat.com>
Cc:     linux-fsdevel@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>,
        linux-kernel@...r.kernel.org, linux-audit@...hat.com,
        Paul Moore <paul@...l-moore.com>,
        Eric Paris <eparis@...hat.com>, sgrubb@...hat.com
Subject: Re: [RFC PATCH ghak100 V1 1/2] audit: avoid fcaps on MNT_FORCE

On Mon, Nov 19, 2018 at 11:59 PM Richard Guy Briggs <rgb@...hat.com> wrote:

> The simple answer is that the audit PATH record format expects the four
> cap_f* fields to be there and a best effort is being attempted to fill
> in that information in an expected way with meaningful values.  Perhaps
> better to accept that it is unreasonable to expect any fcaps on any
> umount operation and simply ignore those fields in the PATH record for
> umount syscall events.

When there's a mount there are in fact two objects belonging to the
exact same path, each having completely independent metadata:  the
mount point and the root of the mount.  For example:

stat /mnt
umount /mnt
stat /mnt

The first stat will show the root of the mount, the second one will
show the mount point.
Which one is the relevant for audit?

Not saying audit should be doing getxattr on any of them, just trying
to see more clearly.

Thanks,
Miklos