linux-kernel - Re: linux-next: manual merge of the selinux tree with the vfs tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181129235130.GI2217@ZenIV.linux.org.uk>
Date:   Thu, 29 Nov 2018 23:51:30 +0000
From:   Al Viro <viro@...iv.linux.org.uk>
To:     Paul Moore <paul@...l-moore.com>
Cc:     omosnace@...hat.com, sfr@...b.auug.org.au,
        linux-next@...r.kernel.org, linux-kernel@...r.kernel.org,
        dhowells@...hat.com, selinux@...r.kernel.org,
        linux-fsdevel@...r.kernel.org
Subject: Re: linux-next: manual merge of the selinux tree with the vfs tree

On Thu, Nov 29, 2018 at 05:23:24PM -0500, Paul Moore wrote:

> > OK, I will verify that the SELinux submount fix rebased on top of
> > vfs/work.mount in the way I suggested above passes the same testing
> > (seliinux-testsuite + NFS crossmnt reproducer). I am now building two
> > kernels (vfs/work.mount with and without the fix) to test. Let me know
> > if there is anything more to do.
> 
> Thanks.
> 
> The big thing is just making sure that we don't regress on the fix in
> selinux/next if/when David's mount rework hits Linus' tree.

FWIW, the whole thing is getting massaged/reordered/etc. and I would
like some input from you guys at some point - assuming that I recover
the ability to talk about LSM without obscenities...

Question: what *should* happen if we try to cross into a submount and find
that the thing on the other side is already mounted elsewhere, with incompatible
LSM options?  Ditto for referrals, with an extra twist - what if we are given
3 alternatives, the first two already mounted elsewhere with incompatible
options, the third one not mounted anywhere yet?

Incidentally, should smack have ->sb_clone_mnt_opts()?