Received-SPF: pass (google.com: domain of linux-kernel+bounces-215870-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <08ff168afc09fd108ec489a3c9360d4e704fa7dc.camel@xry111.site>
Subject: Re: [PATCH] LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
From: Xi Ruoyao <xry111@xry111.site>
To: Arnd Bergmann <arnd@arndb.de>, Huacai Chen <chenhuacai@kernel.org>
Cc: Huacai Chen <chenhuacai@loongson.cn>, loongarch@lists.linux.dev,
 Linux-Arch <linux-arch@vger.kernel.org>, Xuefeng Li
 <lixuefeng@loongson.cn>, guoren <guoren@kernel.org>, WANG Xuerui
 <kernel@xen0n.name>, Jiaxun Yang <jiaxun.yang@flygoat.com>,
 linux-kernel@vger.kernel.org,  loongson-kernel@lists.loongnix.cn,
 stable@vger.kernel.org
Date: Sat, 15 Jun 2024 20:12:43 +0800
In-Reply-To: <56ace686-d4b4-4b4c-a8a6-af06ec0d48f2@app.fastmail.com>
References: <20240511100157.2334539-1-chenhuacai@loongson.cn>
	 <f92e23be-3f3f-4bc6-8711-3bcf6beb7fa2@app.fastmail.com>
	 <CAAhV-H5kn2xPLqgop0iOyg-tc5kAYcuNo3cd+f3yCdkN=cJDug@mail.gmail.com>
	 <fcdeb993-37d6-42e0-8737-3be41413f03d@app.fastmail.com>
	 <CAAhV-H4s_utEOtFDwjPTqxnMWTVjWhmS7bEVRX+t8HK5QDA8Vg@mail.gmail.com>
	 <a21a0878-021e-4990-a59d-b10f204a018b@app.fastmail.com>
	 <CAAhV-H7OR5tkbjj-BPLStneXFr=1DUaFvvh8+a5Bk_jhCAP25Q@mail.gmail.com>
	 <cdef45d36d0e71da5f0534b3783b81c82405bda3.camel@xry111.site>
	 <CAAhV-H4R_HJAB0baqUgA8ucbwWNVN4sc9EV91zAk9Ch302_7zg@mail.gmail.com>
	 <56ace686-d4b4-4b4c-a8a6-af06ec0d48f2@app.fastmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.2 
Precedence: bulk
MIME-Version: 1.0

On Sat, 2024-06-15 at 13:47 +0200, Arnd Bergmann wrote:

/* snip */

> > > > We can only wait for the seccomp side to be fixed now? Or we can ge=
t
> > > > this patch upstream for LoongArch64 at the moment, and wait for
> > > > seccomp to fix RISCV32 (and LoongArch32) in future?
> > >=20
> > > I'm wondering why not just introduce a new syscall or extend statx wi=
th
> > > a new flag, as we've discussed many times.=C2=A0 They have their own
> > > disadvantages but better than this, IMO.
> > We should move things forward, in any way. :)
>=20
> Wouldn't it be sufficient to move the AT_EMPTY_PATH hack
> from vfs_fstatat() to vfs_statx() so we can make them
> behave the same way?
>=20
> As far as I can tell, the only difference between the two is
> that fstatat64() and similar already has added the check for
> zero-length strings in order to make using vfs_fstatat()
> fast and safe when called from glibc stat().

Do you mean https://git.kernel.org/torvalds/c/9013c51c630a?  It (only
partially) fix the performance issue but it won't help seccomp.  The
problem is you cannot check if the string is zero-length with seccomp.
Thus seccomp cannot audit fstatat properly as well.

In [Firefox] *all* fstatat (and statx) calls are trapped and *the signal
handler* audit this fstatat call.  If flags & AT_EMPTY_PATH and path is
zero-length, it calls fstat to do the job.  But on LoongArch there is no
way to "do the job" as the only stat-family call is statx.

[Firefox]:https://searchfox.org/mozilla-central/source/security/sandbox/lin=
ux/SandboxFilter.cpp#364

--=20
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University