linux-kernel - Re: [PATCH bpf-next 2/4] landlock: Use path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPhsuW6W+HR8BOVTCbM+AVYCEzuoSR21RWUpaEE0xvOpv8Zbog@mail.gmail.com>
Date: Mon, 2 Jun 2025 17:10:21 -0700
From: Song Liu <song@...nel.org>
To: Tingmao Wang <m@...wtm.org>
Cc: Mickaël Salaün <mic@...ikod.net>, 
	linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, 
	bpf@...r.kernel.org, linux-kernel@...r.kernel.org, kernel-team@...a.com, 
	andrii@...nel.org, eddyz87@...il.com, ast@...nel.org, daniel@...earbox.net, 
	martin.lau@...ux.dev, viro@...iv.linux.org.uk, brauner@...nel.org, 
	jack@...e.cz, kpsingh@...nel.org, mattbobrowski@...gle.com, 
	amir73il@...il.com, repnop@...gle.com, jlayton@...nel.org, 
	josef@...icpanda.com, gnoack@...gle.com
Subject: Re: [PATCH bpf-next 2/4] landlock: Use path_parent()

On Mon, Jun 2, 2025 at 6:36 AM Song Liu <song@...nel.org> wrote:
>
> On Sat, May 31, 2025 at 6:51 AM Tingmao Wang <m@...wtm.org> wrote:
> [...]
> > I'm not sure if the original behavior was intentional, but since this
> > technically counts as a functional changes, just pointing this out.
>
> Thanks for pointing it out! I think it is possible to keep current
> behavior. Or we can change the behavior and state that clearly
> in the commit log. Mickaël, WDYT?
>
> >
> > Also I'm slightly worried about the performance overhead of doing
> > path_connected for every hop in the iteration (but ultimately it's
> > Mickaël's call).  At least for Landlock, I think if we want to block all
>
> Maybe we need a flag to path_parent (or path_walk_parent) so
> that we only check for path_connected when necessary.

More thoughts on path_connected(). I think it makes sense for
path_parent (or path_walk_parent) to continue walking
with path_connected() == false. This is because for most security
use cases, it makes sense for umounted bind mount to fall back
to the permissions of the original mount OTOH, it also makes sense
for follow_dotdot to reject this access at path lookup time. If the
user of path_walk_parent decided to stop walking at disconnected
path, another check can be added at the caller side.

If there are no objections, I will remove the path_connected check
from path_walk_parent().

Thanks,
Song