Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Steve Grubb <sgrubb@redhat.com>
To:     Richard Guy Briggs <rgb@redhat.com>
Cc:     Miklos Szeredi <miklos@szeredi.hu>, linux-kernel@vger.kernel.org,
        linux-audit@redhat.com, Al Viro <viro@zeniv.linux.org.uk>,
        linux-fsdevel@vger.kernel.org, Eric Paris <eparis@redhat.com>,
        Paul Moore <paul@paul-moore.com>
Subject: Re: [RFC PATCH ghak100 V1 1/2] audit: avoid fcaps on MNT_FORCE
Date:   Tue, 20 Nov 2018 12:31:30 -0500
Message-ID: <17943076.6Ld0qRUFEn@x2>
Organization: Red Hat
In-Reply-To: <20181120154820.4s6jflcnyu4ha5qn@madcap2.tricolour.ca>
References: <cover.1542149969.git.rgb@redhat.com> <CAJfpegt8H-8-PJyJbGe9zQB1DxBQLoMA0QRhc-gAH=mw6YKhVw@mail.gmail.com> <20181120154820.4s6jflcnyu4ha5qn@madcap2.tricolour.ca>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tuesday, November 20, 2018 10:48:20 AM EST Richard Guy Briggs wrote:
> On 2018-11-20 09:17, Miklos Szeredi wrote:
> > On Mon, Nov 19, 2018 at 11:59 PM Richard Guy Briggs <rgb@redhat.com> 
wrote:
> > > The simple answer is that the audit PATH record format expects the four
> > > cap_f* fields to be there and a best effort is being attempted to fill
> > > in that information in an expected way with meaningful values.  Perhaps
> > > better to accept that it is unreasonable to expect any fcaps on any
> > > umount operation and simply ignore those fields in the PATH record for
> > > umount syscall events.
> > 
> > When there's a mount there are in fact two objects belonging to the
> > exact same path, each having completely independent metadata:  the
> > mount point and the root of the mount.  For example:
> > 
> > stat /mnt
> > umount /mnt
> > stat /mnt
> > 
> > The first stat will show the root of the mount, the second one will
> > show the mount point.
> > Which one is the relevant for audit?
> 
> It would be the root of the mount, the one that is visible to processes
> in that mount namespace.
> 
> Obviously, once that mount has been unmounted, it would be the mount
> point (no longer in use as such at that point) that is of interest.
> 
> On mounting, I'm guessing both would be of interest if the fcaps changed
> for that process-visible path in that mount namespace, so this provides
> an additional operation that would need recording aside from the case
> of a simple attribute change.

fcaps are on files. Mountpoints are directories. Would fcaps changes be 
possible?

-Steve


> > Not saying audit should be doing getxattr on any of them, just trying
> > to see more clearly.
> > 
> > Thanks,
> > Miklos
> 
> - RGB
> 
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635