From: Roberto Sassu <[email protected]>
One of the challenges that must be tackled to move IMA and EVM to the LSM
infrastructure is to ensure that EVM is capable to correctly handle
multiple stacked LSMs providing an xattr at file creation. At the moment,
there are few issues that would prevent a correct integration. This patch
set aims at solving them.
From the LSM infrastructure side, the LSM stacking feature added the
possibility of registering multiple implementations of the security hooks,
that are called sequentially whenever someone calls the corresponding
security hook. However, security_inode_init_security() is currently limited
to support one xattr provided by LSM and one by EVM. It is ready to support
multiple xattrs, as it can call the initxattrs() callback provided by
filesystems. security_old_inode_init_security() can only support one xattr
due to its API.
In addition, using the call_int_hook() macro causes some issues. According
to the documentation in include/linux/lsm_hooks.h, it is a legitimate case
that an LSM returns -EOPNOTSUPP when it does not want to provide an xattr.
However, the loop defined in the macro would stop calling subsequent LSMs
if that happens. In the case of security_old_inode_init_security(), using
the macro would also cause a memory leak due to replacing the *value
pointer, if multiple LSMs provide an xattr.
From EVM side, the first operation to be done is to change the definition
of evm_inode_init_security() to be compatible with the security hook
definition. Unfortunately, the current definition does not provide enough
information for EVM, as it must have visibility of all xattrs provided by
LSMs to correctly calculate the HMAC. This patch set changes the security
hook definition by replacing the name, value and len triple with the xattr
array allocated by security_inode_init_security().
Secondly, given that the place where EVM can fill an xattr is not provided
anymore with the changed definition, EVM must know how many elements are in
the xattr array. EVM can rely on the fact that the xattr array must be
terminated with an element with name field set to NULL. If EVM is moved to
the LSM infrastructure, the infrastructure will provide additional
information.
Casey suggested to use the reservation mechanism currently implemented for
other security blobs, for xattrs. In this way,
security_inode_init_security() can know after LSM initialization how many
slots for xattrs should be allocated, and LSMs know the offset in the
array from where they can start writing xattrs.
One of the problem was that LSMs can decide at run-time, although they
reserved a slot, to not use it (for example because they were not
initialized). Given that the initxattrs() method implemented by filesystems
expect that the array elements are contiguous, they would miss the slots
after the one not being initialized. security_check_compact_filled_xattrs()
has been introduced to overcome this problem and also to check the
correctness of the xattrs provided by the LSMs.
Filesystems calling security_inode_init_security() are already able to set
multiple xattrs. Those which were using security_old_inode_init_security(),
ocfs2 and reiserfs, were converted to using security_inode_init_security()
and security_old_inode_init_security() was removed. However, they are still
limited to setting only one xattr despite more are available, as their code
is not ready to set multiple xattrs at inode creation time. Support for it
can be added by those filesystems later.
This patch set has been tested by introducing several instances of a
TestLSM (some providing an xattr, some not, one with a wrong implementation
to see how the LSM infrastructure handles it, one providing multiple xattrs
and another providing an xattr but in a disabled state). The patch is not
included in this set but it is available here:
https://github.com/robertosassu/linux/commit/e13a03236df0c399dccb73df5fe4cfceb4bb1d89
The test, added to ima-evm-utils, is available here:
https://github.com/robertosassu/ima-evm-utils/blob/evm-multiple-lsms-v5-devel-v3/tests/evm_multiple_lsms.test
The test takes a UML kernel built by Github Actions and launches it several
times, each time with a different combination of LSMs and filesystems (ext4,
reiserfs, ocfs2). After boot, it first checks that there is an xattr for each
LSM providing it (for reiserfs and ocfs2 just the first LSM), and then (for
ext4) calculates the HMAC in user space and compares it with the HMAC
calculated by EVM in kernel space.
A test report can be obtained here:
https://github.com/robertosassu/ima-evm-utils/actions/runs/3525619568/jobs/5912560168
The patch set has been tested with both the SElinux and Smack test suites.
Below, there is the summary of the test results:
SELinux Test Suite result (without patches):
Files=73, Tests=1346, 225 wallclock secs ( 0.43 usr 0.23 sys + 6.11 cusr 58.70 csys = 65.47 CPU)
Result: FAIL
Failed 4/73 test programs. 13/1346 subtests failed.
SELinux Test Suite result (with patches):
Files=73, Tests=1346, 225 wallclock secs ( 0.44 usr 0.22 sys + 6.15 cusr 59.94 csys = 66.75 CPU)
Result: FAIL
Failed 4/73 test programs. 13/1346 subtests failed.
Smack Test Suite result (without patches):
95 Passed, 0 Failed, 100% Success rate
Smack Test Suite result (with patches):
95 Passed, 0 Failed, 100% Success rate
The patch set has also been successfully tested with a WIP branch where
IMA/EVM have been moved to the LSM infrastructure. It is available here:
https://github.com/robertosassu/linux/commits/ima-evm-lsms-v1-devel-v9-test
This is the patch that moves EVM to the LSM infrastructure:
https://github.com/robertosassu/linux/commit/a1e0682ef75cc8087327e6f446f586c02dd87c60
The only trivial changes, after this patch set, would be to allocate one
element less in the xattr array (because EVM will reserve its own xattr),
and to simply remove the call to evm_inode_init_security().
The test report when IMA and EVM are moved to the LSM infrastructure is
available here:
https://github.com/robertosassu/ima-evm-utils/actions/runs/3525750217/jobs/5912853636
Changelog
v4:
- Remove patch to call reiserfs_security_free(), already queued
- Switch ocfs2 and reiserfs to security_inode_init_security() (suggested by
Mimi)
- Remove security_old_inode_init_security() (suggested by Paul)
- Rename security_check_compact_xattrs() to
security_check_compact_filled_xattrs() and add function description
(suggested by Mimi)
- Rename checked_xattrs parameter of security_check_compact_filled_xattrs()
to num_filled_xattrs (suggested by Mimi)
- Rename cur_xattrs variable in security_inode_init_security() to
num_filled_xattrs (suggested by Mimi)
v3:
- Don't free the xattr name in reiserfs_security_free()
- Don't include fs_data parameter in inode_init_security hook
- Don't change evm_inode_init_security(), as it will be removed if EVM is
stacked
- Fix inode_init_security hook documentation
- Drop lsm_find_xattr_slot(), use simple xattr reservation mechanism and
introduce security_check_compact_xattrs() to compact the xattr array
- Don't allocate xattr array if LSMs didn't reserve any xattr
- Return zero if initxattrs() is not provided to
security_inode_init_security(), -EOPNOTSUPP if value is not provided to
security_old_inode_init_security()
- Request LSMs to fill xattrs if only value (not the triple) is provided to
security_old_inode_init_security(), to avoid unnecessary memory
allocation
v2:
- rewrite selinux_old_inode_init_security() to use
security_inode_init_security()
- add lbs_xattr field to lsm_blob_sizes structure, to give the ability to
LSMs to reserve slots in the xattr array (suggested by Casey)
- add new parameter base_slot to inode_init_security hook definition
v1:
- add calls to reiserfs_security_free() and initialize sec->value to NULL
(suggested by Tetsuo and Mimi)
- change definition of inode_init_security hook, replace the name, value
and len triple with the xattr array (suggested by Casey)
- introduce lsm_find_xattr_slot() helper for LSMs to find an unused slot in
the passed xattr array
Roberto Sassu (6):
reiserfs: Switch to security_inode_init_security()
ocfs2: Switch to security_inode_init_security()
security: Remove security_old_inode_init_security()
security: Allow all LSMs to provide xattrs for inode_init_security
hook
evm: Align evm_inode_init_security() definition with LSM
infrastructure
evm: Support multiple LSMs providing an xattr
fs/ocfs2/namei.c | 18 ++---
fs/ocfs2/xattr.c | 30 +++++++-
fs/reiserfs/xattr_security.c | 23 ++++--
include/linux/evm.h | 12 +--
include/linux/lsm_hook_defs.h | 3 +-
include/linux/lsm_hooks.h | 17 ++--
include/linux/security.h | 12 ---
security/integrity/evm/evm.h | 2 +
security/integrity/evm/evm_crypto.c | 9 ++-
security/integrity/evm/evm_main.c | 28 +++++--
security/security.c | 115 +++++++++++++++++++++-------
security/selinux/hooks.c | 19 +++--
security/smack/smack_lsm.c | 26 ++++---
13 files changed, 213 insertions(+), 101 deletions(-)
--
2.25.1
From: Roberto Sassu <[email protected]>
As the remaining two users reiserfs and ocfs2 switched to
security_inode_init_security(), security_old_inode_init_security() can be
now removed.
Out-of-tree kernel modules should switch to security_inode_init_security()
too.
Signed-off-by: Roberto Sassu <[email protected]>
---
include/linux/security.h | 12 ------------
security/security.c | 11 -----------
2 files changed, 23 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index ca1b7109c0db..c682fc96ed61 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -336,9 +336,6 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
int security_inode_init_security_anon(struct inode *inode,
const struct qstr *name,
const struct inode *context_inode);
-int security_old_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len);
int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
int security_inode_link(struct dentry *old_dentry, struct inode *dir,
struct dentry *new_dentry);
@@ -771,15 +768,6 @@ static inline int security_inode_init_security_anon(struct inode *inode,
return 0;
}
-static inline int security_old_inode_init_security(struct inode *inode,
- struct inode *dir,
- const struct qstr *qstr,
- const char **name,
- void **value, size_t *len)
-{
- return -EOPNOTSUPP;
-}
-
static inline int security_inode_create(struct inode *dir,
struct dentry *dentry,
umode_t mode)
diff --git a/security/security.c b/security/security.c
index 79d82cb6e469..e2857446fd32 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1132,17 +1132,6 @@ int security_inode_init_security_anon(struct inode *inode,
context_inode);
}
-int security_old_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len)
-{
- if (unlikely(IS_PRIVATE(inode)))
- return -EOPNOTSUPP;
- return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir,
- qstr, name, value, len);
-}
-EXPORT_SYMBOL(security_old_inode_init_security);
-
#ifdef CONFIG_SECURITY_PATH
int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
unsigned int dev)
--
2.25.1
From: Roberto Sassu <[email protected]>
Currently, evm_inode_init_security() processes a single LSM xattr from
the array passed by security_inode_init_security(), and calculates the
HMAC on it and other inode metadata.
Given that initxattrs() callbacks, called by
security_inode_init_security(), expect that this array is terminated when
the xattr name is set to NULL, reuse the same assumption to scan all xattrs
and to calculate the HMAC on all of them.
Signed-off-by: Roberto Sassu <[email protected]>
---
security/integrity/evm/evm.h | 2 ++
security/integrity/evm/evm_crypto.c | 9 ++++++++-
security/integrity/evm/evm_main.c | 16 +++++++++++-----
3 files changed, 21 insertions(+), 6 deletions(-)
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f8b8c5004fc7..f799d72a59fa 100644
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -46,6 +46,8 @@ struct evm_digest {
char digest[IMA_MAX_DIGEST_SIZE];
} __packed;
+int evm_protected_xattr(const char *req_xattr_name);
+
int evm_init_key(void);
int evm_update_evmxattr(struct dentry *dentry,
const char *req_xattr_name,
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 708de9656bbd..68f99faac316 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -389,6 +389,7 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
char *hmac_val)
{
struct shash_desc *desc;
+ const struct xattr *xattr;
desc = init_desc(EVM_XATTR_HMAC, HASH_ALGO_SHA1);
if (IS_ERR(desc)) {
@@ -396,7 +397,13 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
return PTR_ERR(desc);
}
- crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len);
+ for (xattr = lsm_xattr; xattr->name != NULL; xattr++) {
+ if (!evm_protected_xattr(xattr->name))
+ continue;
+
+ crypto_shash_update(desc, xattr->value, xattr->value_len);
+ }
+
hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val);
kfree(desc);
return 0;
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 0a312cafb7de..1cf6871a0019 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -305,7 +305,7 @@ static int evm_protected_xattr_common(const char *req_xattr_name,
return found;
}
-static int evm_protected_xattr(const char *req_xattr_name)
+int evm_protected_xattr(const char *req_xattr_name)
{
return evm_protected_xattr_common(req_xattr_name, false);
}
@@ -851,14 +851,20 @@ int evm_inode_init_security(struct inode *inode, struct inode *dir,
{
struct evm_xattr *xattr_data;
struct xattr *xattr, *evm_xattr;
+ bool evm_protected_xattrs = false;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
- !evm_protected_xattr(xattrs->name))
+ if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs)
return -EOPNOTSUPP;
- for (xattr = xattrs; xattr->value != NULL; xattr++)
- ;
+ for (xattr = xattrs; xattr->value != NULL; xattr++) {
+ if (evm_protected_xattr(xattr->name))
+ evm_protected_xattrs = true;
+ }
+
+ /* EVM xattr not needed. */
+ if (!evm_protected_xattrs)
+ return -EOPNOTSUPP;
evm_xattr = xattr;
--
2.25.1
From: Roberto Sassu <[email protected]>
In preparation for removing security_old_inode_init_security(), switch to
security_inode_init_security().
Extend the existing ocfs2_initxattrs() to take the
ocfs2_security_xattr_info structure from fs_info, and populate the
name/value/len triple with the first xattr provided by LSMs. Supporting
multiple xattrs is not currently supported, as it requires non-trivial
changes that can be done at a later time.
As fs_info was not used before, ocfs2_initxattrs() can now handle the case
of replicating the behavior of security_old_inode_init_security(), i.e.
just obtaining the xattr, in addition to setting all xattrs provided by
LSMs.
Finally, modify the handling of the return value from
ocfs2_init_security_get(). As security_inode_init_security() does not
return -EOPNOTSUPP, remove this case and directly handle the error if the
return value is not zero.
However, the previous case of receiving -EOPNOTSUPP should be still
taken into account, as security_inode_init_security() could return zero
without setting xattrs and ocfs2 would consider it as if the xattr was set.
Instead, if security_inode_init_security() returned zero, look at the xattr
if it was set, and behave accordingly, i.e. set si->enable to zero to
notify to the functions following ocfs2_init_security_get() that the xattr
is not available (same as if security_old_inode_init_security() returned
-EOPNOTSUPP).
Signed-off-by: Roberto Sassu <[email protected]>
---
fs/ocfs2/namei.c | 18 ++++++------------
fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
2 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 05f32989bad6..55fba81cd2d1 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
int want_meta = 0;
int xattr_credits = 0;
struct ocfs2_security_xattr_info si = {
+ .name = NULL,
.enable = 1,
};
int did_quota_inode = 0;
@@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
/* get security xattr */
status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
if (status) {
- if (status == -EOPNOTSUPP)
- si.enable = 0;
- else {
- mlog_errno(status);
- goto leave;
- }
+ mlog_errno(status);
+ goto leave;
}
/* calculate meta data/clusters for setting security and acl xattr */
@@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
int want_clusters = 0;
int xattr_credits = 0;
struct ocfs2_security_xattr_info si = {
+ .name = NULL,
.enable = 1,
};
int did_quota = 0, did_quota_inode = 0;
@@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
/* get security xattr */
status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
if (status) {
- if (status == -EOPNOTSUPP)
- si.enable = 0;
- else {
- mlog_errno(status);
- goto bail;
- }
+ mlog_errno(status);
+ goto bail;
}
/* calculate meta data/clusters for setting security xattr */
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 95d0611c5fc7..55699c573541 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
void *fs_info)
{
+ struct ocfs2_security_xattr_info *si = fs_info;
const struct xattr *xattr;
int err = 0;
+ if (si) {
+ si->value = kmemdup(xattr_array->value, xattr_array->value_len,
+ GFP_KERNEL);
+ if (!si->value)
+ return -ENOMEM;
+
+ si->name = xattr_array->name;
+ si->value_len = xattr_array->value_len;
+ return 0;
+ }
+
for (xattr = xattr_array; xattr->name != NULL; xattr++) {
err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
xattr->name, xattr->value,
@@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
const struct qstr *qstr,
struct ocfs2_security_xattr_info *si)
{
+ int ret;
+
/* check whether ocfs2 support feature xattr */
if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
return -EOPNOTSUPP;
- if (si)
- return security_old_inode_init_security(inode, dir, qstr,
- &si->name, &si->value,
- &si->value_len);
+ if (si) {
+ ret = security_inode_init_security(inode, dir, qstr,
+ &ocfs2_initxattrs, si);
+ /*
+ * security_inode_init_security() does not return -EOPNOTSUPP,
+ * we have to check the xattr ourselves.
+ */
+ if (!ret && !si->name)
+ si->enable = 0;
+
+ return ret;
+ }
return security_inode_init_security(inode, dir, qstr,
&ocfs2_initxattrs, NULL);
--
2.25.1
Hi Roberto,
On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <[email protected]>
>
> One of the challenges that must be tackled to move IMA and EVM to the LSM
> infrastructure is to ensure that EVM is capable to correctly handle
> multiple stacked LSMs providing an xattr at file creation. At the moment,
> there are few issues that would prevent a correct integration. This patch
> set aims at solving them.
Let's take a step back and understand the purpose of this patch set.
Regardless of whether IMA and EVM are moved to the "LSM
infrastructure", EVM needs to support per LSM xattrs. A side affect is
the removal of the security_old_inode_init_security hook. This patch
set cover letter and patch descriptions should be limited to EVM
support for per LSM (multiple) xattrs. The motivation, concerns, and
problems of making IMA and EVM LSMs will be documented in the patch set
that actual makes them LSMs. Please remove all references to "move IMA
and EVM to the LSM infrastructure".
When EVM was upstreamed, there were filesystem limitations on the
number and size of the extended attributes. In addition there were
performance concerns, which resulted in staging the LSM, IMA and EVM
xattrs, before calling initxattrs to write them at the same time. With
this patch set, not only are per LSM xattrs supported, but multiple per
LSM xattrs are supported as well. Have the size limitation concerns
been addressed by the different filesystems? If not, then at minimum
this patch set needs to at least mention it and the possible
ramifications.
--
thanks,
Mimi
On Wed, 2022-11-23 at 07:28 -0500, Mimi Zohar wrote:
> Hi Roberto,
>
> On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <[email protected]>
> >
> > One of the challenges that must be tackled to move IMA and EVM to the LSM
> > infrastructure is to ensure that EVM is capable to correctly handle
> > multiple stacked LSMs providing an xattr at file creation. At the moment,
> > there are few issues that would prevent a correct integration. This patch
> > set aims at solving them.
>
> Let's take a step back and understand the purpose of this patch set.
> Regardless of whether IMA and EVM are moved to the "LSM
> infrastructure", EVM needs to support per LSM xattrs. A side affect is
> the removal of the security_old_inode_init_security hook. This patch
> set cover letter and patch descriptions should be limited to EVM
> support for per LSM (multiple) xattrs. The motivation, concerns, and
> problems of making IMA and EVM LSMs will be documented in the patch set
> that actual makes them LSMs. Please remove all references to "move IMA
> and EVM to the LSM infrastructure".
Hi Mimi
ok, will do.
> When EVM was upstreamed, there were filesystem limitations on the
> number and size of the extended attributes. In addition there were
> performance concerns, which resulted in staging the LSM, IMA and EVM
> xattrs, before calling initxattrs to write them at the same time. With
> this patch set, not only are per LSM xattrs supported, but multiple per
> LSM xattrs are supported as well. Have the size limitation concerns
> been addressed by the different filesystems? If not, then at minimum
> this patch set needs to at least mention it and the possible
> ramifications.
With your patch, 9d8f13ba3f483 ("security: new
security_inode_init_security API adds function callback") you made it
possible to set multiple xattrs at inode creation time.
This patch set pushes further to the limits, as there could be more
xattrs to be added to the inode. I will mention that.
If there are too many xattrs, I guess the only solution would be to use
less LSMs, or a different filesystem. The per filesystem limit could be
increased separately case by case.
Thanks
Roberto
On Wed, 2022-11-23 at 13:44 +0100, Roberto Sassu wrote:
> On Wed, 2022-11-23 at 07:28 -0500, Mimi Zohar wrote:
> > Hi Roberto,
> >
> > On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> > > From: Roberto Sassu <[email protected]>
> > >
> > > One of the challenges that must be tackled to move IMA and EVM to the LSM
> > > infrastructure is to ensure that EVM is capable to correctly handle
> > > multiple stacked LSMs providing an xattr at file creation. At the moment,
> > > there are few issues that would prevent a correct integration. This patch
> > > set aims at solving them.
> >
> > Let's take a step back and understand the purpose of this patch set.
> > Regardless of whether IMA and EVM are moved to the "LSM
> > infrastructure", EVM needs to support per LSM xattrs. A side affect is
> > the removal of the security_old_inode_init_security hook. This patch
> > set cover letter and patch descriptions should be limited to EVM
> > support for per LSM (multiple) xattrs. The motivation, concerns, and
> > problems of making IMA and EVM LSMs will be documented in the patch set
> > that actual makes them LSMs. Please remove all references to "move IMA
> > and EVM to the LSM infrastructure".
>
> Hi Mimi
>
> ok, will do.
>
> > When EVM was upstreamed, there were filesystem limitations on the
> > number and size of the extended attributes. In addition there were
> > performance concerns, which resulted in staging the LSM, IMA and EVM
> > xattrs, before calling initxattrs to write them at the same time. With
> > this patch set, not only are per LSM xattrs supported, but multiple per
> > LSM xattrs are supported as well. Have the size limitation concerns
> > been addressed by the different filesystems? If not, then at minimum
> > this patch set needs to at least mention it and the possible
> > ramifications.
>
> With your patch, 9d8f13ba3f483 ("security: new
> security_inode_init_security API adds function callback") you made it
> possible to set multiple xattrs at inode creation time.
True, and even then there were concerns.
> This patch set pushes further to the limits, as there could be more
> xattrs to be added to the inode. I will mention that.
Thanks
> If there are too many xattrs, I guess the only solution would be to use
> less LSMs, or a different filesystem. The per filesystem limit could be
> increased separately case by case.
Agreed, but unless it is documented somewhere, nobody but us will know
there is a potential problem. At least document it here in the cover
letter, which we'll include in the merge message.
FYI, the xattr.7 man page contains a section "Filesystem differences".
--
thanks,
Mimi
On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <[email protected]>
>
> In preparation for removing security_old_inode_init_security(), switch to
> security_inode_init_security().
>
> Extend the existing ocfs2_initxattrs() to take the
> ocfs2_security_xattr_info structure from fs_info, and populate the
> name/value/len triple with the first xattr provided by LSMs. Supporting
> multiple xattrs is not currently supported, as it requires non-trivial
> changes that can be done at a later time.
ocfs2 already defines ocfs2_init_security_get() as a wrapper around
calling either security_old_inode_init_security() or
security_inode_init_security(). Based on "si" one or the other hook is
called. ocfs2_initxattrs is already defined.
struct ocfs2_security_xattr_info si = {
.name = NULL,
.enable = 1,
};
The main difference between calling security_old_inode_init_security or
security_inode_init_security() is whether or not security.evm is
calculated and written.
Perhaps it is time to remove the call to
security_old_inode_init_security() in ocfs2_init_security_get(). We
need to hear back from the ocfs2 community. Mark? Joel?
As noted previously this change affects mknod and symlinks.
Mimi
>
> As fs_info was not used before, ocfs2_initxattrs() can now handle the case
> of replicating the behavior of security_old_inode_init_security(), i.e.
> just obtaining the xattr, in addition to setting all xattrs provided by
> LSMs.
>
> Finally, modify the handling of the return value from
> ocfs2_init_security_get(). As security_inode_init_security() does not
> return -EOPNOTSUPP, remove this case and directly handle the error if the
> return value is not zero.
>
> However, the previous case of receiving -EOPNOTSUPP should be still
> taken into account, as security_inode_init_security() could return zero
> without setting xattrs and ocfs2 would consider it as if the xattr was set.
>
> Instead, if security_inode_init_security() returned zero, look at the xattr
> if it was set, and behave accordingly, i.e. set si->enable to zero to
> notify to the functions following ocfs2_init_security_get() that the xattr
> is not available (same as if security_old_inode_init_security() returned
> -EOPNOTSUPP).
>
> Signed-off-by: Roberto Sassu <[email protected]>
> ---
> fs/ocfs2/namei.c | 18 ++++++------------
> fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
> 2 files changed, 32 insertions(+), 16 deletions(-)
>
> diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
> index 05f32989bad6..55fba81cd2d1 100644
> --- a/fs/ocfs2/namei.c
> +++ b/fs/ocfs2/namei.c
> @@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> int want_meta = 0;
> int xattr_credits = 0;
> struct ocfs2_security_xattr_info si = {
> + .name = NULL,
> .enable = 1,
> };
> int did_quota_inode = 0;
> @@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> /* get security xattr */
> status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> if (status) {
> - if (status == -EOPNOTSUPP)
> - si.enable = 0;
> - else {
> - mlog_errno(status);
> - goto leave;
> - }
> + mlog_errno(status);
> + goto leave;
> }
>
> /* calculate meta data/clusters for setting security and acl xattr */
> @@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> int want_clusters = 0;
> int xattr_credits = 0;
> struct ocfs2_security_xattr_info si = {
> + .name = NULL,
> .enable = 1,
> };
> int did_quota = 0, did_quota_inode = 0;
> @@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> /* get security xattr */
> status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> if (status) {
> - if (status == -EOPNOTSUPP)
> - si.enable = 0;
> - else {
> - mlog_errno(status);
> - goto bail;
> - }
> + mlog_errno(status);
> + goto bail;
> }
>
> /* calculate meta data/clusters for setting security xattr */
> diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
> index 95d0611c5fc7..55699c573541 100644
> --- a/fs/ocfs2/xattr.c
> +++ b/fs/ocfs2/xattr.c
> @@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
> static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
> void *fs_info)
> {
> + struct ocfs2_security_xattr_info *si = fs_info;
> const struct xattr *xattr;
> int err = 0;
>
> + if (si) {
> + si->value = kmemdup(xattr_array->value, xattr_array->value_len,
> + GFP_KERNEL);
> + if (!si->value)
> + return -ENOMEM;
> +
> + si->name = xattr_array->name;
> + si->value_len = xattr_array->value_len;
> + return 0;
> + }
> +
> for (xattr = xattr_array; xattr->name != NULL; xattr++) {
> err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
> xattr->name, xattr->value,
> @@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
> const struct qstr *qstr,
> struct ocfs2_security_xattr_info *si)
> {
> + int ret;
> +
> /* check whether ocfs2 support feature xattr */
> if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
> return -EOPNOTSUPP;
> - if (si)
> - return security_old_inode_init_security(inode, dir, qstr,
> - &si->name, &si->value,
> - &si->value_len);
> + if (si) {
> + ret = security_inode_init_security(inode, dir, qstr,
> + &ocfs2_initxattrs, si);
> + /*
> + * security_inode_init_security() does not return -EOPNOTSUPP,
> + * we have to check the xattr ourselves.
> + */
> + if (!ret && !si->name)
> + si->enable = 0;
> +
> + return ret;
> + }
>
> return security_inode_init_security(inode, dir, qstr,
> &ocfs2_initxattrs, NULL);
On Wed, 2022-11-23 at 12:46 -0500, Mimi Zohar wrote:
> On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <[email protected]>
> >
> > In preparation for removing security_old_inode_init_security(), switch to
> > security_inode_init_security().
> >
> > Extend the existing ocfs2_initxattrs() to take the
> > ocfs2_security_xattr_info structure from fs_info, and populate the
> > name/value/len triple with the first xattr provided by LSMs. Supporting
> > multiple xattrs is not currently supported, as it requires non-trivial
> > changes that can be done at a later time.
>
> ocfs2 already defines ocfs2_init_security_get() as a wrapper around
> calling either security_old_inode_init_security() or
> security_inode_init_security(). Based on "si" one or the other hook is
> called. ocfs2_initxattrs is already defined.
>
> struct ocfs2_security_xattr_info si = {
> .name = NULL,
> .enable = 1,
> };
>
> The main difference between calling security_old_inode_init_security or
> security_inode_init_security() is whether or not security.evm is
> calculated and written.
Uhm, it seems unfortunately more complicated.
Calling security_old_inode_init_security() allows filesystems to get
the xattr, do some calculations (e.g. for reservation) and then write
the xattr.
The initxattrs() callback to be passed to
security_inode_init_security() is meant to let filesystems provide a
filesystem-specific way of writing the xattrs, just after LSMs provided
them. This seems incompatible with the old behavior, as a filesystem
might need to do the calculations in the middle before writing the
xattrs.
The initxattrs() callback, when security_old_inode_init_security() was
used, is just a way of emulating the old behavior, i.e. returning the
xattr to the caller.
It should be possible, I guess, to handle more xattrs but if the code
was designed to handle one, it would be better if the filesystem
maintainers add support for it.
Thanks
Roberto
> Perhaps it is time to remove the call to
> security_old_inode_init_security() in ocfs2_init_security_get(). We
> need to hear back from the ocfs2 community. Mark? Joel?
>
> As noted previously this change affects mknod and symlinks.
>
> Mimi
>
> > As fs_info was not used before, ocfs2_initxattrs() can now handle the case
> > of replicating the behavior of security_old_inode_init_security(), i.e.
> > just obtaining the xattr, in addition to setting all xattrs provided by
> > LSMs.
> >
> > Finally, modify the handling of the return value from
> > ocfs2_init_security_get(). As security_inode_init_security() does not
> > return -EOPNOTSUPP, remove this case and directly handle the error if the
> > return value is not zero.
> >
> > However, the previous case of receiving -EOPNOTSUPP should be still
> > taken into account, as security_inode_init_security() could return zero
> > without setting xattrs and ocfs2 would consider it as if the xattr was set.
> >
> > Instead, if security_inode_init_security() returned zero, look at the xattr
> > if it was set, and behave accordingly, i.e. set si->enable to zero to
> > notify to the functions following ocfs2_init_security_get() that the xattr
> > is not available (same as if security_old_inode_init_security() returned
> > -EOPNOTSUPP).
> >
> > Signed-off-by: Roberto Sassu <[email protected]>
> > ---
> > fs/ocfs2/namei.c | 18 ++++++------------
> > fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
> > 2 files changed, 32 insertions(+), 16 deletions(-)
> >
> > diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
> > index 05f32989bad6..55fba81cd2d1 100644
> > --- a/fs/ocfs2/namei.c
> > +++ b/fs/ocfs2/namei.c
> > @@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > int want_meta = 0;
> > int xattr_credits = 0;
> > struct ocfs2_security_xattr_info si = {
> > + .name = NULL,
> > .enable = 1,
> > };
> > int did_quota_inode = 0;
> > @@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > /* get security xattr */
> > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > if (status) {
> > - if (status == -EOPNOTSUPP)
> > - si.enable = 0;
> > - else {
> > - mlog_errno(status);
> > - goto leave;
> > - }
> > + mlog_errno(status);
> > + goto leave;
> > }
> >
> > /* calculate meta data/clusters for setting security and acl xattr */
> > @@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > int want_clusters = 0;
> > int xattr_credits = 0;
> > struct ocfs2_security_xattr_info si = {
> > + .name = NULL,
> > .enable = 1,
> > };
> > int did_quota = 0, did_quota_inode = 0;
> > @@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > /* get security xattr */
> > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > if (status) {
> > - if (status == -EOPNOTSUPP)
> > - si.enable = 0;
> > - else {
> > - mlog_errno(status);
> > - goto bail;
> > - }
> > + mlog_errno(status);
> > + goto bail;
> > }
> >
> > /* calculate meta data/clusters for setting security xattr */
> > diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
> > index 95d0611c5fc7..55699c573541 100644
> > --- a/fs/ocfs2/xattr.c
> > +++ b/fs/ocfs2/xattr.c
> > @@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
> > static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
> > void *fs_info)
> > {
> > + struct ocfs2_security_xattr_info *si = fs_info;
> > const struct xattr *xattr;
> > int err = 0;
> >
> > + if (si) {
> > + si->value = kmemdup(xattr_array->value, xattr_array->value_len,
> > + GFP_KERNEL);
> > + if (!si->value)
> > + return -ENOMEM;
> > +
> > + si->name = xattr_array->name;
> > + si->value_len = xattr_array->value_len;
> > + return 0;
> > + }
> > +
> > for (xattr = xattr_array; xattr->name != NULL; xattr++) {
> > err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
> > xattr->name, xattr->value,
> > @@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
> > const struct qstr *qstr,
> > struct ocfs2_security_xattr_info *si)
> > {
> > + int ret;
> > +
> > /* check whether ocfs2 support feature xattr */
> > if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
> > return -EOPNOTSUPP;
> > - if (si)
> > - return security_old_inode_init_security(inode, dir, qstr,
> > - &si->name, &si->value,
> > - &si->value_len);
> > + if (si) {
> > + ret = security_inode_init_security(inode, dir, qstr,
> > + &ocfs2_initxattrs, si);
> > + /*
> > + * security_inode_init_security() does not return -EOPNOTSUPP,
> > + * we have to check the xattr ourselves.
> > + */
> > + if (!ret && !si->name)
> > + si->enable = 0;
> > +
> > + return ret;
> > + }
> >
> > return security_inode_init_security(inode, dir, qstr,
> > &ocfs2_initxattrs, NULL);
On Thu, 2022-11-24 at 09:11 +0100, Roberto Sassu wrote:
> On Wed, 2022-11-23 at 12:46 -0500, Mimi Zohar wrote:
> > On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> > > From: Roberto Sassu <[email protected]>
> > >
> > > In preparation for removing security_old_inode_init_security(), switch to
> > > security_inode_init_security().
> > >
> > > Extend the existing ocfs2_initxattrs() to take the
> > > ocfs2_security_xattr_info structure from fs_info, and populate the
> > > name/value/len triple with the first xattr provided by LSMs. Supporting
> > > multiple xattrs is not currently supported, as it requires non-trivial
> > > changes that can be done at a later time.
> >
> > ocfs2 already defines ocfs2_init_security_get() as a wrapper around
> > calling either security_old_inode_init_security() or
> > security_inode_init_security(). Based on "si" one or the other hook is
> > called. ocfs2_initxattrs is already defined.
> >
> > struct ocfs2_security_xattr_info si = {
> > .name = NULL,
> > .enable = 1,
> > };
> >
> > The main difference between calling security_old_inode_init_security or
> > security_inode_init_security() is whether or not security.evm is
> > calculated and written.
>
> Uhm, it seems unfortunately more complicated.
>
> Calling security_old_inode_init_security() allows filesystems to get
> the xattr, do some calculations (e.g. for reservation) and then write
> the xattr.
>
> The initxattrs() callback to be passed to
> security_inode_init_security() is meant to let filesystems provide a
> filesystem-specific way of writing the xattrs, just after LSMs provided
> them. This seems incompatible with the old behavior, as a filesystem
> might need to do the calculations in the middle before writing the
> xattrs.
>
> The initxattrs() callback, when security_old_inode_init_security() was
> used, is just a way of emulating the old behavior, i.e. returning the
> xattr to the caller.
>
> It should be possible, I guess, to handle more xattrs but if the code
> was designed to handle one, it would be better if the filesystem
> maintainers add support for it.
Hi Mark, Joel, Joseph,
Commit 9d8f13ba3f48 ("security: new security_inode_init_security API
adds function callback") introduced security_old_inode_init_security()
to support reiserfs and ocfs2 a long time ago. It was suppose to be a
temporary fix until they moved to the new
security_inode_init_security() hook. ocsf2 partially migrated to
security_inode_init_security(), but not completely.
security_old_inode_init_security() is finally going away. Instead of
migrating the remaining old usage to the new
security_inode_init_security() properly, this patch simulates the
existing usage.
Can we get some Reviewed-by, Tested-by tags or comments?
thanks,
Mimi
>
> > Perhaps it is time to remove the call to
> > security_old_inode_init_security() in ocfs2_init_security_get(). We
> > need to hear back from the ocfs2 community. Mark? Joel?
> >
> > As noted previously this change affects mknod and symlinks.
> >
> >
> > > As fs_info was not used before, ocfs2_initxattrs() can now handle the case
> > > of replicating the behavior of security_old_inode_init_security(), i.e.
> > > just obtaining the xattr, in addition to setting all xattrs provided by
> > > LSMs.
> > >
> > > Finally, modify the handling of the return value from
> > > ocfs2_init_security_get(). As security_inode_init_security() does not
> > > return -EOPNOTSUPP, remove this case and directly handle the error if the
> > > return value is not zero.
> > >
> > > However, the previous case of receiving -EOPNOTSUPP should be still
> > > taken into account, as security_inode_init_security() could return zero
> > > without setting xattrs and ocfs2 would consider it as if the xattr was set.
> > >
> > > Instead, if security_inode_init_security() returned zero, look at the xattr
> > > if it was set, and behave accordingly, i.e. set si->enable to zero to
> > > notify to the functions following ocfs2_init_security_get() that the xattr
> > > is not available (same as if security_old_inode_init_security() returned
> > > -EOPNOTSUPP).
> > >
> > > Signed-off-by: Roberto Sassu <[email protected]>
> > > ---
> > > fs/ocfs2/namei.c | 18 ++++++------------
> > > fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
> > > 2 files changed, 32 insertions(+), 16 deletions(-)
> > >
> > > diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
> > > index 05f32989bad6..55fba81cd2d1 100644
> > > --- a/fs/ocfs2/namei.c
> > > +++ b/fs/ocfs2/namei.c
> > > @@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > > int want_meta = 0;
> > > int xattr_credits = 0;
> > > struct ocfs2_security_xattr_info si = {
> > > + .name = NULL,
> > > .enable = 1,
> > > };
> > > int did_quota_inode = 0;
> > > @@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > > /* get security xattr */
> > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > > if (status) {
> > > - if (status == -EOPNOTSUPP)
> > > - si.enable = 0;
> > > - else {
> > > - mlog_errno(status);
> > > - goto leave;
> > > - }
> > > + mlog_errno(status);
> > > + goto leave;
> > > }
> > >
> > > /* calculate meta data/clusters for setting security and acl xattr */
> > > @@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > > int want_clusters = 0;
> > > int xattr_credits = 0;
> > > struct ocfs2_security_xattr_info si = {
> > > + .name = NULL,
> > > .enable = 1,
> > > };
> > > int did_quota = 0, did_quota_inode = 0;
> > > @@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > > /* get security xattr */
> > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > > if (status) {
> > > - if (status == -EOPNOTSUPP)
> > > - si.enable = 0;
> > > - else {
> > > - mlog_errno(status);
> > > - goto bail;
> > > - }
> > > + mlog_errno(status);
> > > + goto bail;
> > > }
> > >
> > > /* calculate meta data/clusters for setting security xattr */
> > > diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
> > > index 95d0611c5fc7..55699c573541 100644
> > > --- a/fs/ocfs2/xattr.c
> > > +++ b/fs/ocfs2/xattr.c
> > > @@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
> > > static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
> > > void *fs_info)
> > > {
> > > + struct ocfs2_security_xattr_info *si = fs_info;
> > > const struct xattr *xattr;
> > > int err = 0;
> > >
> > > + if (si) {
> > > + si->value = kmemdup(xattr_array->value, xattr_array->value_len,
> > > + GFP_KERNEL);
> > > + if (!si->value)
> > > + return -ENOMEM;
> > > +
> > > + si->name = xattr_array->name;
> > > + si->value_len = xattr_array->value_len;
> > > + return 0;
> > > + }
> > > +
> > > for (xattr = xattr_array; xattr->name != NULL; xattr++) {
> > > err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
> > > xattr->name, xattr->value,
> > > @@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
> > > const struct qstr *qstr,
> > > struct ocfs2_security_xattr_info *si)
> > > {
> > > + int ret;
> > > +
> > > /* check whether ocfs2 support feature xattr */
> > > if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
> > > return -EOPNOTSUPP;
> > > - if (si)
> > > - return security_old_inode_init_security(inode, dir, qstr,
> > > - &si->name, &si->value,
> > > - &si->value_len);
> > > + if (si) {
> > > + ret = security_inode_init_security(inode, dir, qstr,
> > > + &ocfs2_initxattrs, si);
> > > + /*
> > > + * security_inode_init_security() does not return -EOPNOTSUPP,
> > > + * we have to check the xattr ourselves.
> > > + */
> > > + if (!ret && !si->name)
> > > + si->enable = 0;
> > > +
> > > + return ret;
> > > + }
> > >
> > > return security_inode_init_security(inode, dir, qstr,
> > > &ocfs2_initxattrs, NULL);
>
On Tue, 2022-11-29 at 08:14 -0500, Mimi Zohar wrote:
> On Thu, 2022-11-24 at 09:11 +0100, Roberto Sassu wrote:
> > On Wed, 2022-11-23 at 12:46 -0500, Mimi Zohar wrote:
> > > On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:
> > > > From: Roberto Sassu <[email protected]>
> > > >
> > > > In preparation for removing security_old_inode_init_security(), switch to
> > > > security_inode_init_security().
> > > >
> > > > Extend the existing ocfs2_initxattrs() to take the
> > > > ocfs2_security_xattr_info structure from fs_info, and populate the
> > > > name/value/len triple with the first xattr provided by LSMs. Supporting
> > > > multiple xattrs is not currently supported, as it requires non-trivial
> > > > changes that can be done at a later time.
> > >
> > > ocfs2 already defines ocfs2_init_security_get() as a wrapper around
> > > calling either security_old_inode_init_security() or
> > > security_inode_init_security(). Based on "si" one or the other hook is
> > > called. ocfs2_initxattrs is already defined.
> > >
> > > struct ocfs2_security_xattr_info si = {
> > > .name = NULL,
> > > .enable = 1,
> > > };
> > >
> > > The main difference between calling security_old_inode_init_security or
> > > security_inode_init_security() is whether or not security.evm is
> > > calculated and written.
> >
> > Uhm, it seems unfortunately more complicated.
> >
> > Calling security_old_inode_init_security() allows filesystems to get
> > the xattr, do some calculations (e.g. for reservation) and then write
> > the xattr.
> >
> > The initxattrs() callback to be passed to
> > security_inode_init_security() is meant to let filesystems provide a
> > filesystem-specific way of writing the xattrs, just after LSMs provided
> > them. This seems incompatible with the old behavior, as a filesystem
> > might need to do the calculations in the middle before writing the
> > xattrs.
> >
> > The initxattrs() callback, when security_old_inode_init_security() was
> > used, is just a way of emulating the old behavior, i.e. returning the
> > xattr to the caller.
> >
> > It should be possible, I guess, to handle more xattrs but if the code
> > was designed to handle one, it would be better if the filesystem
> > maintainers add support for it.
>
> Hi Mark, Joel, Joseph,
>
> Commit 9d8f13ba3f48 ("security: new security_inode_init_security API
> adds function callback") introduced security_old_inode_init_security()
> to support reiserfs and ocfs2 a long time ago. It was suppose to be a
> temporary fix until they moved to the new
> security_inode_init_security() hook. ocsf2 partially migrated to
> security_inode_init_security(), but not completely.
>
> security_old_inode_init_security() is finally going away. Instead of
> migrating the remaining old usage to the new
> security_inode_init_security() properly, this patch simulates the
> existing usage.
>
> Can we get some Reviewed-by, Tested-by tags or comments?
Ping.
Thanks
Roberto
> thanks,
>
> Mimi
>
> > > Perhaps it is time to remove the call to
> > > security_old_inode_init_security() in ocfs2_init_security_get(). We
> > > need to hear back from the ocfs2 community. Mark? Joel?
> > >
> > > As noted previously this change affects mknod and symlinks.
> > >
> > >
> > > > As fs_info was not used before, ocfs2_initxattrs() can now handle the case
> > > > of replicating the behavior of security_old_inode_init_security(), i.e.
> > > > just obtaining the xattr, in addition to setting all xattrs provided by
> > > > LSMs.
> > > >
> > > > Finally, modify the handling of the return value from
> > > > ocfs2_init_security_get(). As security_inode_init_security() does not
> > > > return -EOPNOTSUPP, remove this case and directly handle the error if the
> > > > return value is not zero.
> > > >
> > > > However, the previous case of receiving -EOPNOTSUPP should be still
> > > > taken into account, as security_inode_init_security() could return zero
> > > > without setting xattrs and ocfs2 would consider it as if the xattr was set.
> > > >
> > > > Instead, if security_inode_init_security() returned zero, look at the xattr
> > > > if it was set, and behave accordingly, i.e. set si->enable to zero to
> > > > notify to the functions following ocfs2_init_security_get() that the xattr
> > > > is not available (same as if security_old_inode_init_security() returned
> > > > -EOPNOTSUPP).
> > > >
> > > > Signed-off-by: Roberto Sassu <[email protected]>
> > > > ---
> > > > fs/ocfs2/namei.c | 18 ++++++------------
> > > > fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
> > > > 2 files changed, 32 insertions(+), 16 deletions(-)
> > > >
> > > > diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
> > > > index 05f32989bad6..55fba81cd2d1 100644
> > > > --- a/fs/ocfs2/namei.c
> > > > +++ b/fs/ocfs2/namei.c
> > > > @@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > > > int want_meta = 0;
> > > > int xattr_credits = 0;
> > > > struct ocfs2_security_xattr_info si = {
> > > > + .name = NULL,
> > > > .enable = 1,
> > > > };
> > > > int did_quota_inode = 0;
> > > > @@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
> > > > /* get security xattr */
> > > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > > > if (status) {
> > > > - if (status == -EOPNOTSUPP)
> > > > - si.enable = 0;
> > > > - else {
> > > > - mlog_errno(status);
> > > > - goto leave;
> > > > - }
> > > > + mlog_errno(status);
> > > > + goto leave;
> > > > }
> > > >
> > > > /* calculate meta data/clusters for setting security and acl xattr */
> > > > @@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > > > int want_clusters = 0;
> > > > int xattr_credits = 0;
> > > > struct ocfs2_security_xattr_info si = {
> > > > + .name = NULL,
> > > > .enable = 1,
> > > > };
> > > > int did_quota = 0, did_quota_inode = 0;
> > > > @@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
> > > > /* get security xattr */
> > > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
> > > > if (status) {
> > > > - if (status == -EOPNOTSUPP)
> > > > - si.enable = 0;
> > > > - else {
> > > > - mlog_errno(status);
> > > > - goto bail;
> > > > - }
> > > > + mlog_errno(status);
> > > > + goto bail;
> > > > }
> > > >
> > > > /* calculate meta data/clusters for setting security xattr */
> > > > diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
> > > > index 95d0611c5fc7..55699c573541 100644
> > > > --- a/fs/ocfs2/xattr.c
> > > > +++ b/fs/ocfs2/xattr.c
> > > > @@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
> > > > static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
> > > > void *fs_info)
> > > > {
> > > > + struct ocfs2_security_xattr_info *si = fs_info;
> > > > const struct xattr *xattr;
> > > > int err = 0;
> > > >
> > > > + if (si) {
> > > > + si->value = kmemdup(xattr_array->value, xattr_array->value_len,
> > > > + GFP_KERNEL);
> > > > + if (!si->value)
> > > > + return -ENOMEM;
> > > > +
> > > > + si->name = xattr_array->name;
> > > > + si->value_len = xattr_array->value_len;
> > > > + return 0;
> > > > + }
> > > > +
> > > > for (xattr = xattr_array; xattr->name != NULL; xattr++) {
> > > > err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
> > > > xattr->name, xattr->value,
> > > > @@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
> > > > const struct qstr *qstr,
> > > > struct ocfs2_security_xattr_info *si)
> > > > {
> > > > + int ret;
> > > > +
> > > > /* check whether ocfs2 support feature xattr */
> > > > if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
> > > > return -EOPNOTSUPP;
> > > > - if (si)
> > > > - return security_old_inode_init_security(inode, dir, qstr,
> > > > - &si->name, &si->value,
> > > > - &si->value_len);
> > > > + if (si) {
> > > > + ret = security_inode_init_security(inode, dir, qstr,
> > > > + &ocfs2_initxattrs, si);
> > > > + /*
> > > > + * security_inode_init_security() does not return -EOPNOTSUPP,
> > > > + * we have to check the xattr ourselves.
> > > > + */
> > > > + if (!ret && !si->name)
> > > > + si->enable = 0;
> > > > +
> > > > + return ret;
> > > > + }
> > > >
> > > > return security_inode_init_security(inode, dir, qstr,
> > > > &ocfs2_initxattrs, NULL);