From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Krisztian Litkey <kli@iki.fi>, Al Viro <viro@zeniv.linux.org.uk>,
linux-unionfs@vger.kernel.org,
Krisztian Litkey <krisztian.litkey@intel.com>,
linux-security-module <linux-security-module@vger.kernel.org>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3 1/1] ovl: setxattr: don't deadlock when called from ima_fix_xattr.
Date: Mon, 30 May 2016 22:29:18 -0400 [thread overview]
Message-ID: <201605310229.u4V2SXlD046121@mx0a-001b2d01.pphosted.com> (raw)
In-Reply-To: <20160530141015.GC5758@veci.piliscsaba.szeredi.hu>
On Mon, 2016-05-30 at 16:10 +0200, Miklos Szeredi wrote:
> On Fri, May 20, 2016 at 11:53:18PM +0300, Krisztian Litkey wrote:
> > On Fri, May 20, 2016 at 8:00 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> > > We deferred __fput() back in 2012 in order for IMA to safely take the
> > > i_mutex and write security.ima. Writing the security.ima xattr now
> > > triggers overlayfs to write the xattr, but overlayfs doesn't
> > > differentiate between callers - as a result of userspace or as described
> > > here in __fput(). All calls to ovl_setxattr() should call vfs_sexattr,
> > > except the one triggered by __fput(). Refer to the original lockdep
> > > report -
> > > http://thread.gmane.org/gmane.linux.file-systems.union/640
>
> Looks like more fallout from 4bacc9c9234c ("overlayfs: Make f_path always point
> to the overlay and f_inode to the underlay").
>
> Not sure what we want here. Doing everything on the underlying dentry/inode
> would be trivial (see attached patch).
>
> Question is, can we get setxattr() on file opened for O_RDONLY? If so, then
> that could fail on overlayfs (lower layer is read-only).
Normally only after a file has been modified is the xattr written.
However in "fix" mode, the xattr would be written for files opened
read-only (eg. bprm, mmap execute).
Mimi
next prev parent reply other threads:[~2016-05-31 2:29 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-15 18:52 [PATCH 1/1] ovl: setxattr: avoid deadlock when writing IMA xattrs Mimi Zohar
2016-05-15 20:07 ` [PATCH v2 1/1] ovl: setxattr: avoid deadlock when setting IMA xattr Krisztian Litkey
[not found] ` <201605161420.u4GEKLHk009316@d03av05.boulder.ibm.com>
2016-05-16 15:13 ` Krisztian Litkey
2016-05-16 20:22 ` Krisztian Litkey
2016-05-18 22:45 ` Mimi Zohar
2016-05-20 6:28 ` [PATCH v3 1/1] ovl: setxattr: don't deadlock when called from ima_fix_xattr Krisztian Litkey
2016-05-20 14:21 ` Mimi Zohar
2016-05-20 16:29 ` Al Viro
2016-05-20 17:00 ` Mimi Zohar
2016-05-20 20:53 ` Krisztian Litkey
2016-05-30 14:10 ` Miklos Szeredi
2016-05-30 16:50 ` Al Viro
2016-05-31 2:15 ` Mimi Zohar
2016-05-31 2:15 ` Mimi Zohar
2016-05-31 2:15 ` Mimi Zohar
2016-05-31 2:15 ` Mimi Zohar
2016-05-31 2:29 ` Mimi Zohar [this message]
2016-05-31 2:29 ` Mimi Zohar
2016-05-31 2:29 ` Mimi Zohar
2016-05-31 2:29 ` Mimi Zohar
2016-05-20 15:18 ` Andy Whitcroft
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201605310229.u4V2SXlD046121@mx0a-001b2d01.pphosted.com \
--to=zohar@linux.vnet.ibm.com \
--cc=kli@iki.fi \
--cc=krisztian.litkey@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.