Received-SPF: pass (google.com: domain of linux-kernel+bounces-128691-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Tue, 2 Apr 2024 22:00:35 +0100
From: Al Viro <viro@zeniv.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Roberto Sassu <roberto.sassu@huaweicloud.com>,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, linux-cifs@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Roberto Sassu <roberto.sassu@huawei.com>
Subject: Re: [GIT PULL] security changes for v6.9-rc3
Message-ID: <20240402210035.GI538574@ZenIV>
References: <20240402141145.2685631-1-roberto.sassu@huaweicloud.com>
 <CAHk-=wgepVMJCYj9s7J50_Tpb5BWq9buBoF0J5HAa1xjet6B8A@mail.gmail.com>
 <CAHk-=wjjx3oZ55Uyaw9N_kboHdiScLkXAu05CmPF_p_UhQ-tbw@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHk-=wjjx3oZ55Uyaw9N_kboHdiScLkXAu05CmPF_p_UhQ-tbw@mail.gmail.com>
Sender: Al Viro <viro@ftp.linux.org.uk>

On Tue, Apr 02, 2024 at 12:57:28PM -0700, Linus Torvalds wrote:

> So in other cases we do handle the NULL, but it does seem like the
> other cases actually do validaly want to deal with this (ie the
> fsnotify case will say "the directory that mknod was done in was
> changed" even if it doesn't know what the change is.
> 
> But for the security case, it really doesn't seem to make much sense
> to check a mknod() that you don't know the result of.
> 
> I do wonder if that "!inode" test might also be more specific with
> "d_unhashed(dentry)". But that would only make sense if we moved this
> test from security_path_post_mknod() into the caller itself, ie we
> could possibly do something like this instead (or in addition to):
> 
>   -     if (error)
>   -             goto out2;
>   -     security_path_post_mknod(idmap, dentry);
>   +     if (!error && !d_unhashed(dentry))
>   +             security_path_post_mknod(idmap, dentry);
> 
> which might also be sensible.
> 
> Al? Anybody?

Several things here:

	1) location of that hook is wrong.  It's really "how do we catch
file creation that does not come through open() - yes, you can use
mknod(2) for that".  It should've been after the call of vfs_create(),
not the entire switch.  LSM folks have a disturbing fondness of inserting
hooks in various places, but IMO this one has no business being where
they'd placed it.  Bikeshedding regarding the name/arguments/etc. for
that thing is, IMO, not interesting...

	2) the only ->mknod() instance in the tree that tries to leave
dentry unhashed negative on success is CIFS (and only one case in it).
From conversation with CIFS folks it's actually cheaper to instantiate
in that case as well - leaving instantiation to the next lookup will
cost several extra roundtrips for no good reason.

	3) documentation (in vfs.rst) is way too vague.  The actual
rules are
	* ->create() must instantiate on success
	* ->mkdir() is allowed to return unhashed negative on success and
it might be forced to do so in some cases.  If a caller of vfs_mkdir()
wants the damn thing positive, it should account for such possibility and do
a lookup.  Normal callers don't care; see e.g. nfsd and overlayfs for example
of those that do.
	* ->mknod() is interesting - historically it had been "may leave
unhashed negative", but e.g. unix_bind() expected that it won't do so;
the reason it didn't blow up for CIFS is that this case (SFU) of their mknod()
does not support FIFOs and sockets anyway.  Considering how few instances
try to make use of that option and how it doesn't actually save them
anything, I would prefer to declare that ->mknod() should act as ->create().
	* ->symlink() - not sure; there are instances that make use of that
option (coda and hostfs).  OTOH, the only callers of vfs_symlink() that
care either way are nfsd and overlayfs, and neither is usable with coda
or hostfs...  Could go either way, but we need to say it clearly in the
docs, whichever way we choose.