Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1638294

Re: [PATCH v4] Introduce v3 namespaced file capabilities

Show all headers | View raw

"Serge E. Hallyn" <serge@hallyn.com> writes:
> Changelog:
[snip]
>    May 8, 2017:
>       . fix leaking dentry refcount in cap_inode_getsecurity
>
[snip]
> +/*
> + * getsecurity: We are called for security.* before any attempt to read the
> + * xattr from the inode itself.
> + *
> + * This gives us a chance to read the on-disk value and convert it.  If we
> + * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
> + *
> + * Note we are not called by vfs_getxattr_alloc(), but that is only called
> + * by the integrity subsystem, which really wants the unconverted values -
> + * so that's good.
> + */
> +int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
> +			  bool alloc)
> +{
> +	int size, ret;
> +	kuid_t kroot;
> +	uid_t root, mappedroot;
> +	char *tmpbuf = NULL;
> +	struct vfs_cap_data *cap;
> +	struct vfs_ns_cap_data *nscap;
> +	struct dentry *dentry;
> +	struct user_namespace *fs_ns;
> +
> +	if (strcmp(name, "capability") != 0)
> +		return -EOPNOTSUPP;
> +
> +	dentry = d_find_alias(inode);
> +	if (!dentry)
> +		return -EINVAL;
> +
> +	size = sizeof(struct vfs_ns_cap_data);
> +	ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
> +				 &tmpbuf, size, GFP_NOFS);
> +	dput(dentry);

This looks like a good fix but ouch! That interface is wrong.

The dentry is needed because vfs_getxattr_alloc does:
	error = handler->get(handler, dentry, inode, name, NULL, 0);

Which is has no business taking a dentry as xattrs are inode concepts.

I have no issue with your patch but it looks like that handler issue
is going to need to be fixed with xattrs.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: 64fa03de33: BUG:Dentry_still_in_use "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-08 06:50 +0200
  Re: 64fa03de33: BUG:Dentry_still_in_use Masami Ichikawa <masami256@gmail.com> - 2017-05-08 13:50 +0200
    Re: 64fa03de33: BUG:Dentry_still_in_use "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-08 17:50 +0200
    [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-08 20:20 +0200
      Re: [PATCH v4] Introduce v3 namespaced file capabilities ebiederm@xmission.com (Eric W. Biederman) - 2017-05-09 19:10 +0200
        Re: [PATCH v4] Introduce v3 namespaced file capabilities "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-09 22:40 +0200
          Re: [PATCH v4] Introduce v3 namespaced file capabilities ebiederm@xmission.com (Eric W. Biederman) - 2017-05-10 00:40 +0200

csiph-web