Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1166276 > unrolled thread

Re: [PATCH 5/7] SELinux: Handle opening of a unioned file

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH 5/7] SELinux: Handle opening of a unioned file Stephen Smalley <sds@tycho.nsa.gov> - 2015-06-16 19:30 +0200
    Re: [PATCH 5/7] SELinux: Handle opening of a unioned file David Howells <dhowells@redhat.com> - 2015-06-16 23:40 +0200

#1166276 — Re: [PATCH 5/7] SELinux: Handle opening of a unioned file

On 06/16/2015 12:49 PM, David Howells wrote:
> Stephen Smalley <sds@tycho.nsa.gov> wrote:
> 
>> It looks like commit 415103f9932d45f7927f4b17e3a9a13834cdb9a1 changed
>> selinux_inode_init_security()'s handling of SECURITY_FS_USE_MNTPOINT,
>> and this change was never propagated to selinux_dentry_init_security().
>>  However, that commit also did not update
>> security/selinux/hooks.c:may_create()'s logic for computing the new file
>> label when checking CREATE permission, and therefore introduced a
>> potential inconsistency between the label used for the permission check
>> and the label assigned to the inode.
>>
>> That's why I suggested that we need a common helper for all three to
>> ensure consistency there.
> 
> I think a common helper is harder than it seems.  We need the parent dir in
> one of the cases the helper has to consider, but finding it is done in three
> different ways, depending on the caller:
> 
>  (1) dentry_init can just use ->d_parent as there's a lock held that prevents
>      it changing (I think).  This could use (2) instead, however.
> 
>  (2) file_open has to use dget_parent().
> 
>  (3) inode_init doesn't have any dentries, but rather has the object and
>      parent inodes.
> 
> If we don't mind file_open() always calling dget_parent(), then the common
> helper can take the dir inode.
> 
> Also, thinking ahead to the possibility of bringing unionmount into the kernel
> at some point: union non-dir dentries that are not yet copied up have no inode
> attached, but rather fall through to the underlying lower inode in the VFS.
> This, however, gives us nowhere to hang the inode label.  How expensive is the
> security_transition_sid() call?

Why are you talking about file_open()?  It is may_create() that has the
duplicated logic, which has the parent dir passed to it by its callers
(selinux_inode_create, selinux_inode_symlink, selinux_inode_mkdir,
selinux_mknod).  selinux_inode_init_security() also gets passed the
parent dir directly.  Only selinux_dentry_init_security() has to use
d_parent, which as you say is safe, so it can just pass the resulting
dir to the helper.

Until a process writes to the file, we just want to use the lower inode
label, right?  At the point a process writes to the file and a copy-up
is produced, we could perform a one-time computation, and then once the
upper inode is created, it should get set accordingly.  So I wouldn't
think we would need to call security_transition_sid() frequently.  If
so, we might want to do what was previously done in the userspace AVC in
libselinux, and start caching security_transition_sid() results in the
AVC itself and add an avc_transition_sid() interface (in the userspace
AVC, this is avc_compute_create()).

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1166425

Stephen Smalley <sds@tycho.nsa.gov> wrote:

> Why are you talking about file_open()?

Because that's the focus of the patch 5/7 that this comment chain is in
response to.  You said that it should have a common helper with the dentry and
inode init functions.

	Also, would be good to create a common helper for use here, by
	selinux_dentry_init_security(), selinux_inode_init_security(), and
	may_create().  Already some seeming potential for inconsistencies
	there.

Okay, I missed that you'd said may_create() too.  I further assumed that you
meant that selinux_file_open_union() should use the common helper too.

> Until a process writes to the file, we just want to use the lower inode
> label, right?

No.

There are two issues:

 (1) Non-fd accesses to an overlayfs file use the security label on the
     overlay inode, not the lower inode, even before copy up because they go
     through the inode ops of the overlayfs file first.

 (2) I'm told that we want the ability to have a different label on the upper
     file to that on the lower file.  This is trivial in overlayfs since you
     always have an overlay inode off which to hang the security label, but
     tricky with unionmount since you may only have a dentry.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web