Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1458354 > unrolled thread

Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Paul Moore <paul@paul-moore.com> - 2016-08-09 03:20 +0200
    Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Daniel J Walsh <dwalsh@redhat.com> - 2016-08-10 21:00 +0200
      Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Daniel J Walsh <dwalsh@redhat.com> - 2016-08-11 14:40 +0200
      Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Paul Moore <paul@paul-moore.com> - 2016-08-11 14:40 +0200
        Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Daniel J Walsh <dwalsh@redhat.com> - 2016-08-11 16:10 +0200
    Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Paul Moore <paul@paul-moore.com> - 2016-08-10 21:30 +0200
    Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support Miklos Szeredi <miklos@szeredi.hu> - 2016-08-10 23:40 +0200

#1458354 — Re: [RFC PATCH 0/9][V3] Overlayfs SELinux Support

On Thu, Jul 21, 2016 at 5:16 PM, Paul Moore <paul@paul-moore.com> wrote:
> On Wed, Jul 13, 2016 at 10:44 AM, Vivek Goyal <vgoyal@redhat.com> wrote:
>> Hi All,
>>
>> Please find attached the V3 of patches. Changes since V2 are as follows.
>>
>> - Fixed the build issue with CONFIG_SECURITY=n.
>>
>> - Dan Walsh was writing more tests for selinux-testsuite and noted couple
>>   of issues. I have fixed those issues and added two more patches in series.
>>
>>   1. We are resetting MAY_WRITE check for lower inode assuming file will
>>      be coiped up. But this is not true for special_file() as these files
>>      are not copied up. So checks should not be reset in case of special
>>      file.
>>
>>   2. We are resetting MAY_WRITE check for lower inode assuming file will
>>      be copied up. But this also should mean that mounter has permission
>>      to MAY_READ lower file for copy up to succeed. So add MAY_READ
>>      check while resetting MAY_WRITE.
>>
>> Original description of patches follows.
>>
>> Following are RFC patches to support SELinux with overlayfs. I started
>> with David Howells's latest posting on this topic and started modifying
>> patches. These patches apply on top of overlayfs-next branch of miklos
>> vfs git tree.
>>
>> git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs.git overlayfs-next
>>
>> These patches can be pulled from my branch too.
>>
>> https://github.com/rhvgoyal/linux/commits/overlayfs-selinux-mounter-next
>>
>> Thanks to Dan Walsh, Stephen Smalley and Miklos Szeredi for numerous
>> conversation and ideas in helping figuring out what one reasonable
>> implementation might look like.
>>
>> Dan Walsh has been writing tests for selinux overlayfs in selinux-testsuite.
>> These patches pass those tests now
>>
>> https://github.com/rhatdan/selinux-testsuite/commits/master
>>
>> Posting these patches for review and comments.
>>
>> These patches introduce 3 new security hooks.
>>
>> - security_inode_copy_up(), is called when a file is copied up. This hook
>>   prepares a new set of cred which is used for copy up operation. And
>>   new set of creds are prepared so that ->create_sid can be set appropriately
>>   and newly created file is labeled properly.
>>
>>   When a file is copied up, label of lower file is retained except for the
>>   case of context= mount where new file gets the label from context= option.
>>
>> - security_inode_copy_up_xattr(), is called when xattrs of a file are
>>   being copied up. Before this we already called security_inode_copy_up()
>>   and created new file and copied up data. That means file already got
>>   labeled properly and there is no need to take SELINUX xattr of lower
>>   file and overwrite the upper file xattr. So this hook is used to avoid
>>   copying up of SELINUX xattr.
>>
>> - dentry_create_files_as(), is called when a new file is about to be created.
>>   This hook determines what the label of the file should be if task had
>>   created that file in upper/ and sets create_sid accordingly in the passed
>>   in creds.
>>
>>   Normal transition rules don't work for the case of context mounts as
>>   underlying file system is not aware of context option which only overlay
>>   layer is aware of. For non-context mounts, creation can happen in work/
>>   dir first and then file might be renamed into upper/, and it might get
>>   label based on work/ dir. So this hooks helps avoiding all these issues.
>>
>>   When a new file is created in upper/, it gets its label based on transition
>>   rules. For the case of context mount, it gets the label from context=
>>   option.
>>
>> Any feedback is welcome.
>
> Hi Vivek,
>
> These patches look fine to me, thanks for all your hard work and to
> everyone who helped review and provide feedback.  I have tagged these
> patches for merging into the SELinux next branch after this merge
> window.

Okay, I just merged these patches into selinux#next.  With the
exception of some changes to restore the mode argument to
ovl_create_or_link() and to fix some whitespace damage the patches
were merged cleanly.

-- 
paul moore
www.paul-moore.com

[toc] | [next] | [standalone]

#1459544

On 08/10/2016 08:32 AM, Paul Moore wrote:
> On Wed, Aug 10, 2016 at 5:11 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
>> On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
>>> Okay, I just merged these patches into selinux#next.  With the
>>> exception of some changes to restore the mode argument to
>>> ovl_create_or_link() and to fix some whitespace damage the patches
>>> were merged cleanly.
>> Don't need to add the back the mode argument, just use stat->mode.
> Thanks for the pointer (I'm on vacation at the moment and trying to do
> this quickly).  Since it was a merge issue, and the branch hasn't been
> pulled by Linus, I didn't bother with a new patch, I simply updated
> the existing patch from Vivek and re-pushed to selinux#next.  If you
> see anything else, please let me know.
>
> For Fedora folks, I'm currently rebuilding the COPR
> pcmoore/kernel-secnext kernel packages with this update; assuming
> there are no problems with the COPR infrastructure the kernel should
> be ready in a couple of hours.
>
> * https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext
>
Cool once there is a kernel with ovlerlay fs/selinux support I will run
it on my laptop and attempt
the selinux test suite, if everything goes well I will start running
docker on overlay with selinux enforcing mode.

[toc] | [prev] | [next] | [standalone]

#1460471

On 08/11/2016 08:36 AM, Paul Moore wrote:
> On Wed, Aug 10, 2016 at 8:52 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>> On 08/10/2016 08:32 AM, Paul Moore wrote:
>>> On Wed, Aug 10, 2016 at 5:11 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
>>>> On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
>>>>> Okay, I just merged these patches into selinux#next.  With the
>>>>> exception of some changes to restore the mode argument to
>>>>> ovl_create_or_link() and to fix some whitespace damage the patches
>>>>> were merged cleanly.
>>>> Don't need to add the back the mode argument, just use stat->mode.
>>> Thanks for the pointer (I'm on vacation at the moment and trying to do
>>> this quickly).  Since it was a merge issue, and the branch hasn't been
>>> pulled by Linus, I didn't bother with a new patch, I simply updated
>>> the existing patch from Vivek and re-pushed to selinux#next.  If you
>>> see anything else, please let me know.
>>>
>>> For Fedora folks, I'm currently rebuilding the COPR
>>> pcmoore/kernel-secnext kernel packages with this update; assuming
>>> there are no problems with the COPR infrastructure the kernel should
>>> be ready in a couple of hours.
>>>
>>> * https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext
>>>
>> Cool once there is a kernel with ovlerlay fs/selinux support I will run
>> it on my laptop and attempt
>> the selinux test suite, if everything goes well I will start running
>> docker on overlay with selinux enforcing mode.
> Okay, the build finished and passes the base SELinux/audit regressions
> tests (I didn't test the SELinux/overlayfs integration yet);
> kernel-4.8.0-0.rc1.git1.1.1.secnext.fc26 or greater will have the
> SELinux/overlayfs patches included.  The link above has instructions
> on enabling the COPR repo on your system.
>
Awesome,  I will try this out in Rawhide now.

[toc] | [prev] | [next] | [standalone]

#1460474

On Wed, Aug 10, 2016 at 8:52 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
> On 08/10/2016 08:32 AM, Paul Moore wrote:
>> On Wed, Aug 10, 2016 at 5:11 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
>>> On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
>>>> Okay, I just merged these patches into selinux#next.  With the
>>>> exception of some changes to restore the mode argument to
>>>> ovl_create_or_link() and to fix some whitespace damage the patches
>>>> were merged cleanly.
>>> Don't need to add the back the mode argument, just use stat->mode.
>> Thanks for the pointer (I'm on vacation at the moment and trying to do
>> this quickly).  Since it was a merge issue, and the branch hasn't been
>> pulled by Linus, I didn't bother with a new patch, I simply updated
>> the existing patch from Vivek and re-pushed to selinux#next.  If you
>> see anything else, please let me know.
>>
>> For Fedora folks, I'm currently rebuilding the COPR
>> pcmoore/kernel-secnext kernel packages with this update; assuming
>> there are no problems with the COPR infrastructure the kernel should
>> be ready in a couple of hours.
>>
>> * https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext
>>
> Cool once there is a kernel with ovlerlay fs/selinux support I will run
> it on my laptop and attempt
> the selinux test suite, if everything goes well I will start running
> docker on overlay with selinux enforcing mode.

Okay, the build finished and passes the base SELinux/audit regressions
tests (I didn't test the SELinux/overlayfs integration yet);
kernel-4.8.0-0.rc1.git1.1.1.secnext.fc26 or greater will have the
SELinux/overlayfs patches included.  The link above has instructions
on enabling the COPR repo on your system.

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [next] | [standalone]

#1460556

On 08/11/2016 08:36 AM, Paul Moore wrote:
> On Wed, Aug 10, 2016 at 8:52 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>> On 08/10/2016 08:32 AM, Paul Moore wrote:
>>> On Wed, Aug 10, 2016 at 5:11 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
>>>> On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
>>>>> Okay, I just merged these patches into selinux#next.  With the
>>>>> exception of some changes to restore the mode argument to
>>>>> ovl_create_or_link() and to fix some whitespace damage the patches
>>>>> were merged cleanly.
>>>> Don't need to add the back the mode argument, just use stat->mode.
>>> Thanks for the pointer (I'm on vacation at the moment and trying to do
>>> this quickly).  Since it was a merge issue, and the branch hasn't been
>>> pulled by Linus, I didn't bother with a new patch, I simply updated
>>> the existing patch from Vivek and re-pushed to selinux#next.  If you
>>> see anything else, please let me know.
>>>
>>> For Fedora folks, I'm currently rebuilding the COPR
>>> pcmoore/kernel-secnext kernel packages with this update; assuming
>>> there are no problems with the COPR infrastructure the kernel should
>>> be ready in a couple of hours.
>>>
>>> * https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext
>>>
>> Cool once there is a kernel with ovlerlay fs/selinux support I will run
>> it on my laptop and attempt
>> the selinux test suite, if everything goes well I will start running
>> docker on overlay with selinux enforcing mode.
> Okay, the build finished and passes the base SELinux/audit regressions
> tests (I didn't test the SELinux/overlayfs integration yet);
> kernel-4.8.0-0.rc1.git1.1.1.secnext.fc26 or greater will have the
> SELinux/overlayfs patches included.  The link above has instructions
> on enabling the COPR repo on your system.
>
Looks great.  Passes the test suite, and I have a patched version of docker
now running with overlay backend.

[toc] | [prev] | [next] | [standalone]

#1459651

On Wed, Aug 10, 2016 at 5:11 AM, Miklos Szeredi <miklos@szeredi.hu> wrote:
> On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
>> Okay, I just merged these patches into selinux#next.  With the
>> exception of some changes to restore the mode argument to
>> ovl_create_or_link() and to fix some whitespace damage the patches
>> were merged cleanly.
>
> Don't need to add the back the mode argument, just use stat->mode.

Thanks for the pointer (I'm on vacation at the moment and trying to do
this quickly).  Since it was a merge issue, and the branch hasn't been
pulled by Linus, I didn't bother with a new patch, I simply updated
the existing patch from Vivek and re-pushed to selinux#next.  If you
see anything else, please let me know.

For Fedora folks, I'm currently rebuilding the COPR
pcmoore/kernel-secnext kernel packages with this update; assuming
there are no problems with the COPR infrastructure the kernel should
be ready in a couple of hours.

* https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [next] | [standalone]

#1460014

On Tue, Aug 9, 2016 at 3:19 AM, Paul Moore <paul@paul-moore.com> wrote:
> On Thu, Jul 21, 2016 at 5:16 PM, Paul Moore <paul@paul-moore.com> wrote:
>> On Wed, Jul 13, 2016 at 10:44 AM, Vivek Goyal <vgoyal@redhat.com> wrote:
>>> Hi All,
>>>
>>> Please find attached the V3 of patches. Changes since V2 are as follows.
>>>
>>> - Fixed the build issue with CONFIG_SECURITY=n.
>>>
>>> - Dan Walsh was writing more tests for selinux-testsuite and noted couple
>>>   of issues. I have fixed those issues and added two more patches in series.
>>>
>>>   1. We are resetting MAY_WRITE check for lower inode assuming file will
>>>      be coiped up. But this is not true for special_file() as these files
>>>      are not copied up. So checks should not be reset in case of special
>>>      file.
>>>
>>>   2. We are resetting MAY_WRITE check for lower inode assuming file will
>>>      be copied up. But this also should mean that mounter has permission
>>>      to MAY_READ lower file for copy up to succeed. So add MAY_READ
>>>      check while resetting MAY_WRITE.
>>>
>>> Original description of patches follows.
>>>
>>> Following are RFC patches to support SELinux with overlayfs. I started
>>> with David Howells's latest posting on this topic and started modifying
>>> patches. These patches apply on top of overlayfs-next branch of miklos
>>> vfs git tree.
>>>
>>> git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs.git overlayfs-next
>>>
>>> These patches can be pulled from my branch too.
>>>
>>> https://github.com/rhvgoyal/linux/commits/overlayfs-selinux-mounter-next
>>>
>>> Thanks to Dan Walsh, Stephen Smalley and Miklos Szeredi for numerous
>>> conversation and ideas in helping figuring out what one reasonable
>>> implementation might look like.
>>>
>>> Dan Walsh has been writing tests for selinux overlayfs in selinux-testsuite.
>>> These patches pass those tests now
>>>
>>> https://github.com/rhatdan/selinux-testsuite/commits/master
>>>
>>> Posting these patches for review and comments.
>>>
>>> These patches introduce 3 new security hooks.
>>>
>>> - security_inode_copy_up(), is called when a file is copied up. This hook
>>>   prepares a new set of cred which is used for copy up operation. And
>>>   new set of creds are prepared so that ->create_sid can be set appropriately
>>>   and newly created file is labeled properly.
>>>
>>>   When a file is copied up, label of lower file is retained except for the
>>>   case of context= mount where new file gets the label from context= option.
>>>
>>> - security_inode_copy_up_xattr(), is called when xattrs of a file are
>>>   being copied up. Before this we already called security_inode_copy_up()
>>>   and created new file and copied up data. That means file already got
>>>   labeled properly and there is no need to take SELINUX xattr of lower
>>>   file and overwrite the upper file xattr. So this hook is used to avoid
>>>   copying up of SELINUX xattr.
>>>
>>> - dentry_create_files_as(), is called when a new file is about to be created.
>>>   This hook determines what the label of the file should be if task had
>>>   created that file in upper/ and sets create_sid accordingly in the passed
>>>   in creds.
>>>
>>>   Normal transition rules don't work for the case of context mounts as
>>>   underlying file system is not aware of context option which only overlay
>>>   layer is aware of. For non-context mounts, creation can happen in work/
>>>   dir first and then file might be renamed into upper/, and it might get
>>>   label based on work/ dir. So this hooks helps avoiding all these issues.
>>>
>>>   When a new file is created in upper/, it gets its label based on transition
>>>   rules. For the case of context mount, it gets the label from context=
>>>   option.
>>>
>>> Any feedback is welcome.
>>
>> Hi Vivek,
>>
>> These patches look fine to me, thanks for all your hard work and to
>> everyone who helped review and provide feedback.  I have tagged these
>> patches for merging into the SELinux next branch after this merge
>> window.
>
> Okay, I just merged these patches into selinux#next.  With the
> exception of some changes to restore the mode argument to
> ovl_create_or_link() and to fix some whitespace damage the patches
> were merged cleanly.

Don't need to add the back the mode argument, just use stat->mode.

Thanks,
Miklos

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web