lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 267/717] NFSv4.2: condition READDIRs mask for security label based on LSM state
    Date
    From: Olga Kornievskaia <kolga@netapp.com>

    [ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]

    Currently, the client will always ask for security_labels if the server
    returns that it supports that feature regardless of any LSM modules
    (such as Selinux) enforcing security policy. This adds performance
    penalty to the READDIR operation.

    Client adjusts superblock's support of the security_label based on
    the server's support but also current client's configuration of the
    LSM modules. Thus, prior to using the default bitmask in READDIR,
    this patch checks the server's capabilities and then instructs
    READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.

    v5: fixing silly mistakes of the rushed v4
    v4: simplifying logic
    v3: changing label's initialization per Ondrej's comment
    v2: dropping selinux hook and using the sb cap.

    Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
    Suggested-by: Scott Mayhew <smayhew@redhat.com>
    Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
    Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/nfs/nfs4proc.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
    index e89468678ae16..6858b4bb556d5 100644
    --- a/fs/nfs/nfs4proc.c
    +++ b/fs/nfs/nfs4proc.c
    @@ -4961,12 +4961,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
    u64 cookie, struct page **pages, unsigned int count, bool plus)
    {
    struct inode *dir = d_inode(dentry);
    + struct nfs_server *server = NFS_SERVER(dir);
    struct nfs4_readdir_arg args = {
    .fh = NFS_FH(dir),
    .pages = pages,
    .pgbase = 0,
    .count = count,
    - .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
    .plus = plus,
    };
    struct nfs4_readdir_res res;
    @@ -4981,9 +4981,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
    dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
    dentry,
    (unsigned long long)cookie);
    + if (!(server->caps & NFS_CAP_SECURITY_LABEL))
    + args.bitmask = server->attr_bitmask_nl;
    + else
    + args.bitmask = server->attr_bitmask;
    +
    nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
    res.pgbase = args.pgbase;
    - status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
    + status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
    + &res.seq_res, 0);
    if (status >= 0) {
    memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
    status += args.pgbase;
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 15:13    [W:3.712 / U:0.416 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site