linux-kernel - Re: [PATCH v2] security,fs,nfs,net: update security_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49730b18-605f-4194-8f93-86f832f4b8f8@swemel.ru>
Date: Fri, 6 Jun 2025 16:39:45 +0300
From: Konstantin Andreev <andreev@...mel.ru>
To: linux-security-module@...r.kernel.org
Cc: linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-fsdevel@...r.kernel.org, netdev@...r.kernel.org,
 selinux@...r.kernel.org, Stephen Smalley <stephen.smalley.work@...il.com>,
 Christian Brauner <brauner@...nel.org>,
 Casey Schaufler <casey@...aufler-ca.com>, Paul Moore <paul@...l-moore.com>
Subject: Re: [PATCH v2] security,fs,nfs,net: update
 security_inode_listsecurity() interface

Stephen Smalley, 28/04/2025:
> Update the security_inode_listsecurity() interface to allow
> use of the xattr_list_one() helper and update the hook
> implementations.
> 
> Link: https://lore.kernel.org/selinux/20250424152822.2719-1-stephen.smalley.work@gmail.com/

Sorry for being late to the party.

Your approach assumes that every fs-specific xattr lister
called like

| vfs_listxattr() {
|    if (inode->i_op->listxattr)
|        error = inode->i_op->listxattr(dentry, list, size)
|   ...

must call LSM to integrate LSM's xattr(s) into fs-specific list.
You did this for tmpfs:

| simple_xattr_list() {
|   security_inode_listsecurity()
|   // iterate real xatts list


Well, but what about other filesystems in the linux kernel?
Should all of them also modify their xattr listers?

To me, taking care of security xattrs is improper responsibility
for filesystem code.

May it be better to merge LSM xattrs
and fs-backed xattrs at the vfs level (vfs_listxattr)?

--
Konstantin Andreev