linux-kernel - Re: [PULL] Smack: Restore the smackfsdef mount option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <10710.1559070135@warthog.procyon.org.uk>
Date:   Tue, 28 May 2019 20:02:15 +0100
From:   David Howells <dhowells@...hat.com>
To:     Casey Schaufler <casey@...aufler-ca.com>
Cc:     dhowells@...hat.com, James Morris <jmorris@...ei.org>,
        Linux Security Module list 
        <linux-security-module@...r.kernel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PULL] Smack: Restore the smackfsdef mount option

Casey Schaufler <casey@...aufler-ca.com> wrote:

> James, this is a repair for a regression introduced in 5.1.
> It should be pulled for 5.2 and added to 5.1.
> 
> The following changes since commit 619ae03e922b65a1a5d4269ceae1e9e13a058d6b:
> 
>   Smack: Fix kbuild reported build error (2019-04-30 14:13:32 -0700)
> 
> are available in the git repository at:
> 
>   https://github.com/cschaufler/next-smack.git smack-for-5.2-b
> 
> for you to fetch changes up to a5765ce797070d046dc53ccceeb0ed304cb918eb:
> 
>   Smack: Restore the smackfsdef mount option (2019-05-28 10:22:04 -0700)

Can you hold this for the moment, please?

Note that there appears to be another problem by inspection of the code.  I
think that smack_sb_eat_lsm_opts() strips the "smack" prefix off of the
options, whereas smack_fs_context_parse_param() does not.

This means that there's no need to do this:

	 static const struct fs_parameter_spec smack_param_specs[] = {
	+	fsparam_string("fsdef",		Opt_fsdefault),
		fsparam_string("fsdefault",	Opt_fsdefault),
		fsparam_string("fsfloor",	Opt_fsfloor),
		fsparam_string("fshat",		Opt_fshat),

but that all the option names in that table *do* need prefixing with "smack".

The way you enter the LSM is going to depend on whether
generic_parse_monolithic() is called.  You're only going to enter this way if
mount(2) is the syscall of entry and the filesystem doesn't override the
->parse_monolithic() option (none in the upstream kernel).

David