lkml.org 
[lkml]   [2023]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v7 2/6] ocfs2: Switch to security_inode_init_security()
    From
    Date
    On Tue, 2023-02-21 at 14:45 +0800, Joseph Qi wrote:
    > Hi,
    >
    > Sorry for the late reply.
    >
    > I don't have much background on this thread. It seems that we have to
    > check EOPNOTSUPP since ocfs2_init_security_get() may return EOPNOTSUPP
    > if it doesn't support extended attribute feature for backward
    > compatibility.

    Hi Joseph

    yes, I already reintroduced the check. Thanks for having a look.

    Roberto

    > Other looks good. So with above comments addressed, you can add:
    > Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    >
    > On 1/10/23 4:55 PM, Roberto Sassu wrote:
    > > On Thu, 2022-12-01 at 11:41 +0100, Roberto Sassu wrote:
    > > > From: Roberto Sassu <roberto.sassu@huawei.com>
    > > >
    > > > In preparation for removing security_old_inode_init_security(), switch to
    > > > security_inode_init_security().
    > > >
    > > > Extend the existing ocfs2_initxattrs() to take the
    > > > ocfs2_security_xattr_info structure from fs_info, and populate the
    > > > name/value/len triple with the first xattr provided by LSMs.
    > >
    > > Hi Mark, Joel, Joseph
    > >
    > > some time ago I sent this patch set to switch to the newer
    > > function security_inode_init_security(). Almost all the other parts of
    > > this patch set have been reviewed, and the patch set itself should be
    > > ready to be merged.
    > >
    > > I kindly ask if you could have a look at this patch and give your
    > > Reviewed-by, so that Paul could take the patch set.
    > >
    > > Thanks a lot!
    > >
    > > Roberto
    > >
    > > > As fs_info was not used before, ocfs2_initxattrs() can now handle the case
    > > > of replicating the behavior of security_old_inode_init_security(), i.e.
    > > > just obtaining the xattr, in addition to setting all xattrs provided by
    > > > LSMs.
    > > >
    > > > Supporting multiple xattrs is not currently supported where
    > > > security_old_inode_init_security() was called (mknod, symlink), as it
    > > > requires non-trivial changes that can be done at a later time. Like for
    > > > reiserfs, even if EVM is invoked, it will not provide an xattr (if it is
    > > > not the first to set it, its xattr will be discarded; if it is the first,
    > > > it does not have xattrs to calculate the HMAC on).
    > > >
    > > > Finally, modify the handling of the return value from
    > > > ocfs2_init_security_get(). As security_inode_init_security() does not
    > > > return -EOPNOTSUPP, remove this case and directly handle the error if the
    > > > return value is not zero.
    > > >
    > > > However, the previous case of receiving -EOPNOTSUPP should be still
    > > > taken into account, as security_inode_init_security() could return zero
    > > > without setting xattrs and ocfs2 would consider it as if the xattr was set.
    > > >
    > > > Instead, if security_inode_init_security() returned zero, look at the xattr
    > > > if it was set, and behave accordingly, i.e. set si->enable to zero to
    > > > notify to the functions following ocfs2_init_security_get() that the xattr
    > > > is not available (same as if security_old_inode_init_security() returned
    > > > -EOPNOTSUPP).
    > > >
    > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    > > > Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    > > > ---
    > > > fs/ocfs2/namei.c | 18 ++++++------------
    > > > fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
    > > > 2 files changed, 32 insertions(+), 16 deletions(-)
    > > >
    > > > diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
    > > > index 05f32989bad6..55fba81cd2d1 100644
    > > > --- a/fs/ocfs2/namei.c
    > > > +++ b/fs/ocfs2/namei.c
    > > > @@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
    > > > int want_meta = 0;
    > > > int xattr_credits = 0;
    > > > struct ocfs2_security_xattr_info si = {
    > > > + .name = NULL,
    > > > .enable = 1,
    > > > };
    > > > int did_quota_inode = 0;
    > > > @@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
    > > > /* get security xattr */
    > > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
    > > > if (status) {
    > > > - if (status == -EOPNOTSUPP)
    > > > - si.enable = 0;
    > > > - else {
    > > > - mlog_errno(status);
    > > > - goto leave;
    > > > - }
    > > > + mlog_errno(status);
    > > > + goto leave;
    > > > }
    > > >
    > > > /* calculate meta data/clusters for setting security and acl xattr */
    > > > @@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
    > > > int want_clusters = 0;
    > > > int xattr_credits = 0;
    > > > struct ocfs2_security_xattr_info si = {
    > > > + .name = NULL,
    > > > .enable = 1,
    > > > };
    > > > int did_quota = 0, did_quota_inode = 0;
    > > > @@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace *mnt_userns,
    > > > /* get security xattr */
    > > > status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
    > > > if (status) {
    > > > - if (status == -EOPNOTSUPP)
    > > > - si.enable = 0;
    > > > - else {
    > > > - mlog_errno(status);
    > > > - goto bail;
    > > > - }
    > > > + mlog_errno(status);
    > > > + goto bail;
    > > > }
    > > >
    > > > /* calculate meta data/clusters for setting security xattr */
    > > > diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
    > > > index 95d0611c5fc7..55699c573541 100644
    > > > --- a/fs/ocfs2/xattr.c
    > > > +++ b/fs/ocfs2/xattr.c
    > > > @@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct xattr_handler *handler,
    > > > static int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
    > > > void *fs_info)
    > > > {
    > > > + struct ocfs2_security_xattr_info *si = fs_info;
    > > > const struct xattr *xattr;
    > > > int err = 0;
    > > >
    > > > + if (si) {
    > > > + si->value = kmemdup(xattr_array->value, xattr_array->value_len,
    > > > + GFP_KERNEL);
    > > > + if (!si->value)
    > > > + return -ENOMEM;
    > > > +
    > > > + si->name = xattr_array->name;
    > > > + si->value_len = xattr_array->value_len;
    > > > + return 0;
    > > > + }
    > > > +
    > > > for (xattr = xattr_array; xattr->name != NULL; xattr++) {
    > > > err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
    > > > xattr->name, xattr->value,
    > > > @@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
    > > > const struct qstr *qstr,
    > > > struct ocfs2_security_xattr_info *si)
    > > > {
    > > > + int ret;
    > > > +
    > > > /* check whether ocfs2 support feature xattr */
    > > > if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
    > > > return -EOPNOTSUPP;
    > > > - if (si)
    > > > - return security_old_inode_init_security(inode, dir, qstr,
    > > > - &si->name, &si->value,
    > > > - &si->value_len);
    > > > + if (si) {
    > > > + ret = security_inode_init_security(inode, dir, qstr,
    > > > + &ocfs2_initxattrs, si);
    > > > + /*
    > > > + * security_inode_init_security() does not return -EOPNOTSUPP,
    > > > + * we have to check the xattr ourselves.
    > > > + */
    > > > + if (!ret && !si->name)
    > > > + si->enable = 0;
    > > > +
    > > > + return ret;
    > > > + }
    > > >
    > > > return security_inode_init_security(inode, dir, qstr,
    > > > &ocfs2_initxattrs, NULL);

    \
     
     \ /
      Last update: 2023-03-27 00:29    [W:4.948 / U:0.496 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site