Received-SPF: pass (google.com: domain of linux-kernel+bounces-38190-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <765e8c790f8521556dc6ce577529f71820494b8a.camel@huaweicloud.com>
Subject: Re: [PATCH v3 0/5] Smack transmute fixes
From: Roberto Sassu <roberto.sassu@huaweicloud.com>
To: Casey Schaufler <casey@schaufler-ca.com>, paul@paul-moore.com, 
 jmorris@namei.org, serge@hallyn.com, Hugh Dickins <hughd@google.com>,
 Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, 
	Roberto Sassu <roberto.sassu@huawei.com>
Date: Thu, 25 Jan 2024 09:44:32 +0100
In-Reply-To: <53897379-0c7a-4da7-870c-1eb7e822a129@schaufler-ca.com>
References: <20231116090125.187209-1-roberto.sassu@huaweicloud.com>
	 <53897379-0c7a-4da7-870c-1eb7e822a129@schaufler-ca.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu2 
Precedence: bulk
MIME-Version: 1.0

On Wed, 2024-01-24 at 14:31 -0800, Casey Schaufler wrote:
> On 11/16/2023 1:01 AM, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> >=20
> > The first two patches are obvious fixes, the first restricts setting th=
e
> > SMACK64TRANSMUTE xattr only for directories, and the second makes it
> > possible to set SMACK64TRANSMUTE if the filesystem does not support xat=
trs
> > (e.g. ramfs).
> >=20
> > The remaining fixes are optional, and only required if we want filesyst=
ems
> > without xattr support behave like those with xattr support. Since we ha=
ve
> > the inode_setsecurity and inode_getsecurity hooks to make the first gro=
up
> > work, it seems useful to fix inode creation too (SELinux should be fine=
).
> >=20
> > The third patch is merely a code move out of the 'if (xattr)' condition=
.
> > The fourth updates the security field of the in-memory inode directly i=
n
> > smack_inode_init_security() and marks the inode as instantiated,
>=20
> I have taken patches 1-4 in smack-next. I'm still waiting on a convincing
> approval for patch 5.

Thanks Casey. I also hope to receive an Ack from the maintainers.

Roberto


> >  and the
> > fifth adds a security_inode_init_security() call in ramfs to initialize=
 the
> > security field of the in-memory inodes (needed to test transmuting
> > directories).
> >=20
> > Both the Smack (on xfs) and IMA test suite succeed with all patches
> > applied. Tests were not executed on v3 (trivial changes).
> >=20
> > By executing the tests in a ramfs, the results are:
> >=20
> > Without the patches:
> > 86 Passed, 9 Failed, 90% Success rate
> >=20
> > With the patches:
> > 93 Passed, 2 Failed, 97% Success rate
> >=20
> > The remaining two failures are:
> > 2151  ioctl(4, BTRFS_IOC_CLONE or FICLONE, 3) =3D -1 EOPNOTSUPP (Operat=
ion not supported)
> > 2152  lsetxattr("./targets/proc-attr-Snap", "security.SMACK64EXEC", "Po=
p", 3, 0) =3D -1 EOPNOTSUPP (Operation not supported)
> >=20
> > The first one is likely due ramfs lack of support for ioctl() while the
> > second could be fixed by handling SMACK64EXEC in smack_inode_setsecurit=
y().
> >=20
> > The patch set applies on top of lsm/dev, commit e246777e2a03 ("MAINTAIN=
ERS:
> > update the LSM entry").
> >=20
> > The ramfs patch potentially could be useful to correctly initialize the
> > label of new inodes in the initramfs, assuming that it will be fully
> > labeled with support for xattrs in the cpio image:
> >=20
> > https://lore.kernel.org/linux-integrity/20190523121803.21638-1-roberto.=
sassu@huawei.com/
> >=20
> > Ramfs inode labels will be set from xattrs with the inode_setsecurity h=
ook.
> >=20
> > Changelog
> >=20
> > v2:
> > - Replace return with goto in the ramfs patch, for better maintainabili=
ty
> >   (suggested by Andrew Morton)
> >=20
> > v1:
> > - Rebase on top of latest lsm/next
> > - Remove -EOPNOTSUPP check in patch 5 (cannot happen)
> >=20
> > Roberto Sassu (5):
> >   smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
> >   smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
> >   smack: Always determine inode labels in smack_inode_init_security()
> >   smack: Initialize the in-memory inode in smack_inode_init_security()
> >   ramfs: Initialize security of in-memory inodes
> >=20
> >  fs/ramfs/inode.c           | 32 ++++++++++++-
> >  security/smack/smack_lsm.c | 95 ++++++++++++++++++++++----------------
> >  2 files changed, 86 insertions(+), 41 deletions(-)
> >=20