lkml.org 
[lkml]   [2022]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v13 01/26] securityfs: rework dentry creation
    Date
    From: Christian Brauner <brauner@kernel.org>

    When securityfs creates a new file or directory via
    securityfs_create_dentry() it will take an additional reference on the
    newly created dentry after it has attached the new inode to the new
    dentry and added it to the hashqueues.
    If we contrast this with debugfs, which has the same underlying logic as
    securityfs, it uses a similar pairing as securityfs. Where securityfs
    has the securityfs_create_dentry() and securityfs_remove() pairing,
    debugfs has the __debugfs_create_file() and debugfs_remove() pairing.

    In contrast to securityfs, debugfs doesn't take an additional reference
    on the newly created dentry in __debugfs_create_file() which would need
    to be put in debugfs_remove().

    The additional dget() isn't a problem per se. In the current
    implementation of securityfs each created dentry pins the filesystem via
    securityfs_create_dentry() until it is removed. Since it is virtually
    guaranteed that there is at least one user of securityfs that has created
    dentries the initial securityfs mount cannot go away until all dentries
    have been removed.

    Since most of the users of the initial securityfs mount don't go away
    until the system is shutdown the initial securityfs won't go away when
    unmounted. Instead a mount will usually surface the same superblock as
    before. The additional dget() doesn't matter in this scenario since it
    is required that all dentries have been cleaned up by the respective
    users before the superblock can be destroyed, i.e. superblock shutdown
    is tied to the lifetime of the associated dentries.

    However, in order to support ima namespaces we need to extend securityfs
    to support being mounted outside of the initial user namespace. For
    namespaced users the pinning logic doesn't make sense. Whereas in the
    initial namespace the securityfs instance and the associated data
    structures of its users can't go away for reason explained earlier users
    of non-initial securityfs instances do go away when the last users of
    the namespace are gone.

    So for those users we neither want to duplicate the pinning logic nor
    make the global securityfs instance display different information based
    on the namespace. Both options would be really messy and hacky.

    Instead we will simply give each namespace its own securityfs instance
    similar to how each ipc namespace has its own mqueue instance and all
    entries in there are cleaned up on umount or when the last user of the
    associated namespace is gone.

    This means that the superblock's lifetime isn't tied to the dentries.
    Instead the last umount, without any fds kept open, will trigger a clean
    shutdown. But now the additional dget() gets in the way. Instead of
    being able to rely on the generic superblock shutdown logic we would
    need to drop the additional dentry reference during superblock shutdown
    for all associated users. That would force the use of a generic
    coordination mechanism for current and future users of securityfs which
    is unnecessary. Simply remove the additional dget() in
    securityfs_dentry_create().

    In securityfs_remove() we will call dget() to take an additional
    reference on the dentry about to be removed. After simple_unlink() or
    simple_rmdir() have dropped the dentry refcount we can call d_delete()
    which will either turn the dentry into negative dentry if our earlier
    dget() is the only reference to the dentry, i.e. it has no other users,
    or remove it from the hashqueues in case there are additional users.

    All of these changes should not have any effect on the userspace
    semantics of the initial securityfs mount.

    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Cc: John Johansen <john.johansen@canonical.com>
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Cc: Micah Morton <mortonm@chromium.org>
    Cc: Kentaro Takeda <takedakn@nttdata.co.jp>
    Cc: James Morris <jmorris@namei.org>
    Cc: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Reviewed-by: Serge Hallyn <serge@hallyn.com>

    ---
    v13:
    - Slight improvements in 1st paragraph of commit message
    ---
    security/inode.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/security/inode.c b/security/inode.c
    index 6c326939750d..13e6780c4444 100644
    --- a/security/inode.c
    +++ b/security/inode.c
    @@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode,
    inode->i_fop = fops;
    }
    d_instantiate(dentry, inode);
    - dget(dentry);
    inode_unlock(dir);
    return dentry;

    @@ -302,10 +301,12 @@ void securityfs_remove(struct dentry *dentry)
    dir = d_inode(dentry->d_parent);
    inode_lock(dir);
    if (simple_positive(dentry)) {
    + dget(dentry);
    if (d_is_dir(dentry))
    simple_rmdir(dir, dentry);
    else
    simple_unlink(dir, dentry);
    + d_delete(dentry);
    dput(dentry);
    }
    inode_unlock(dir);
    --
    2.36.1
    \
     
     \ /
      Last update: 2022-07-07 16:50    [W:2.436 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site