From: Paul Moore <paul@paul-moore.com>
To: Vivek Goyal <vgoyal@redhat.com>,
Amir Goldstein <amir73il@gmail.com>,
Miklos Szeredi <miklos@szeredi.hu>,
David Anderson <dvander@google.com>
Cc: Mark Salyzyn <salyzyn@android.com>,
Jonathan Corbet <corbet@lwn.net>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Randy Dunlap <rdunlap@infradead.org>,
Stephen Smalley <sds@tycho.nsa.gov>,
John Stultz <john.stultz@linaro.org>,
linux-doc@vger.kernel.org,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
overlayfs <linux-unionfs@vger.kernel.org>,
LSM List <linux-security-module@vger.kernel.org>,
kernel-team <kernel-team@android.com>,
selinux@vger.kernel.org, paulmoore@microsoft.com,
luca.boccassi@microsoft.com
Subject: Re: [PATCH v19 0/4] overlayfs override_creds=off & nested get xattr fix
Date: Thu, 10 Mar 2022 17:11:05 -0500 [thread overview]
Message-ID: <CAHC9VhQkLSBGQ-F5Oi9p3G6L7Bf_jQMWAxug_G4bSOJ0_cYXxQ@mail.gmail.com> (raw)
In-Reply-To: <CAHC9VhRer7UWdZyizWO4VuxrgQDnLCOyj8LO7P6T5BGjd=s9zQ@mail.gmail.com>
On Wed, Mar 9, 2022 at 4:13 PM Paul Moore <paul@paul-moore.com> wrote:
> On Tue, Mar 1, 2022 at 12:05 AM David Anderson <dvander@google.com> wrote:
> > On Mon, Feb 28, 2022 at 5:09 PM Paul Moore <paul@paul-moore.com> wrote:
...
> >> This patchset may not have been The Answer, but surely there is
> >> something we can do to support this use-case.
> >
> > Yup exactly, and we still need patches 3 & 4 to deal with this. My current plan is to try and rework our sepolicy (we have some ideas on how it could be made compatible with how overlayfs works). If that doesn't pan out we'll revisit these patches and think harder about how to deal with the coherency issues.
>
> Can you elaborate a bit more on the coherency issues? Is this the dir
> cache issue that is alluded to in the patchset? Anything else that
> has come up on review?
>
> Before I start looking at the dir cache in any detail, did you have
> any thoughts on how to resolve the problems that have arisen?
David, Vivek, Amir, Miklos, or anyone for that matter, can you please
go into more detail on the cache issues? I *think* I may have found a
potential solution for an issue that could arise when the credential
override is not in place, but I'm not certain it's the only issue :)
There is motivation on our part to try and get the
"override_creds=off" portion of the patchset working and suitable for
upstreaming, but I need some help in making sure I understand all the
objections/problems.
--
paul-moore.com
next prev parent reply other threads:[~2022-03-10 22:11 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-17 1:58 [PATCH v19 0/4] overlayfs override_creds=off & nested get xattr fix David Anderson
2021-11-17 1:58 ` [PATCH v19 1/4] Add flags option to get xattr method paired to __vfs_getxattr David Anderson
2021-11-17 16:13 ` kernel test robot
2022-03-25 11:02 ` Luca Weiss
2022-03-25 14:44 ` Paul Moore
2021-11-17 1:58 ` [PATCH v19 2/4] overlayfs: handle XATTR_NOSECURITY flag for get xattr method David Anderson
2021-11-17 1:58 ` [PATCH v19 3/4] overlayfs: override_creds=off option bypass creator_cred David Anderson
2021-11-17 1:58 ` [PATCH v19 4/4] overlayfs: inode_owner_or_capable called during execv David Anderson
2021-11-17 2:18 ` [PATCH v19 0/4] overlayfs override_creds=off & nested get xattr fix Casey Schaufler
2021-11-18 7:59 ` David Anderson
2021-11-17 7:36 ` Amir Goldstein
2021-11-18 9:53 ` David Anderson
2021-11-18 10:20 ` Amir Goldstein
2021-11-18 20:15 ` David Anderson
2021-11-18 20:32 ` Amir Goldstein
2021-12-03 15:37 ` Vivek Goyal
2021-12-03 16:04 ` Paul Moore
2021-12-03 16:31 ` Amir Goldstein
2021-12-03 18:34 ` Vivek Goyal
2022-03-01 1:09 ` Paul Moore
[not found] ` <CA+FmFJA-r+JgMqObNCvE_X+L6jxWtDrczM9Jh0L38Fq-6mnbbA@mail.gmail.com>
2022-03-09 21:13 ` Paul Moore
2022-03-10 22:11 ` Paul Moore [this message]
2022-03-11 4:09 ` Amir Goldstein
2022-03-11 14:01 ` Vivek Goyal
2022-03-11 20:52 ` Paul Moore
2023-03-22 7:28 ` Johannes Segitz
2023-03-22 12:48 ` Amir Goldstein
2023-03-22 14:07 ` Paul Moore
2023-03-22 14:05 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhQkLSBGQ-F5Oi9p3G6L7Bf_jQMWAxug_G4bSOJ0_cYXxQ@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=amir73il@gmail.com \
--cc=corbet@lwn.net \
--cc=dvander@google.com \
--cc=ebiederm@xmission.com \
--cc=john.stultz@linaro.org \
--cc=kernel-team@android.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=luca.boccassi@microsoft.com \
--cc=miklos@szeredi.hu \
--cc=paulmoore@microsoft.com \
--cc=rdunlap@infradead.org \
--cc=salyzyn@android.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).