From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756901Ab0GIOOI (ORCPT ); Fri, 9 Jul 2010 10:14:08 -0400 Received: from msux-gh1-uea02.nsa.gov ([63.239.65.40]:33588 "EHLO msux-gh1-uea02.nsa.gov" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752029Ab0GIOOG (ORCPT ); Fri, 9 Jul 2010 10:14:06 -0400 Subject: Re: [PATCH 06/10] NFSv4: Add label recommended attribute and NFSv4 flags From: "David P. Quigley" To: James Morris Cc: "J. Bruce Fields" , hch@infradead.org, viro@zeniv.linux.org.uk, casey@schaufler-ca.com, sds@tycho.nsa.gov, matthew.dodd@sparta.com, trond.myklebust@fys.uio.no, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-nfs@vger.kernel.org In-Reply-To: References: <1278513086-23964-1-git-send-email-dpquigl@tycho.nsa.gov> <1278513086-23964-7-git-send-email-dpquigl@tycho.nsa.gov> <20100707170058.GD28815@fieldses.org> <1278596363.2494.194.camel@moss-terrapins.epoch.ncsc.mil> Content-Type: text/plain Organization: National Security Agency Date: Fri, 09 Jul 2010 10:05:48 -0400 Message-Id: <1278684348.2494.223.camel@moss-terrapins.epoch.ncsc.mil> Mime-Version: 1.0 X-Mailer: Evolution 2.26.3 (2.26.3-1.fc11) Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2010-07-09 at 08:48 +1000, James Morris wrote: > On Thu, 8 Jul 2010, David P. Quigley wrote: > > > > The maximum security label size on Linux is: > > > > > > #define XATTR_SIZE_MAX 65536 > > > > > > Why arbitrarily limit this over the network? > > > > Because there is no easy way not to. The specification doesn't specify a > > limit to label size in the IETF draft. However there is no way to do > > allocation of the memory needed to store the label where we first get > > access to its size. We tried this before and it failed. When I asked > > trond about it he said doing memory allocation in the rpc context isn't > > allowed. > > In the NFSv3 code, the workaround I've been using is to always allocate > 64k, but the correct way of doing this apparently is to use the page > cache, as is used for ACLs and symlinks. > > > For the most part what would make this label size inadequate would be > > the MLS component. There are some cases where people want every other > > compartment or something crazy like that. In terms of a normal label > > though 4096 should be more than enough. > > Yes, but we should not unnecessarily limit the network protocol when > something is valid and possible in the local implementation (which is ~64k > under Linux). > > > Just to put this in perspective the string below is 4096 a's. > > A security label include just about anything, e.g. an x509 certificate, or > a base64 encoded image. > > In the Linux implementation, if we can store a local label up to 64k, then > we should try and ensure that it can be conveyed via NFS. > > > > - James If you want that to be the case you need to make your case to Trond about that. I've already had this conversation before and he seems to think that a page is sufficient. Bruce also has concerns about not wanting these labels to require a high order allocation. Under memory pressure finding 16 contiguous pages for each label might be a problem. Dave From mboxrd@z Thu Jan 1 00:00:00 1970 From: "David P. Quigley" Subject: Re: [PATCH 06/10] NFSv4: Add label recommended attribute and NFSv4 flags Date: Fri, 09 Jul 2010 10:05:48 -0400 Message-ID: <1278684348.2494.223.camel@moss-terrapins.epoch.ncsc.mil> References: <1278513086-23964-1-git-send-email-dpquigl@tycho.nsa.gov> <1278513086-23964-7-git-send-email-dpquigl@tycho.nsa.gov> <20100707170058.GD28815@fieldses.org> <1278596363.2494.194.camel@moss-terrapins.epoch.ncsc.mil> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Cc: "J. Bruce Fields" , hch-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org, viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org, casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org, sds-+05T5uksL2qpZYMLLGbcSA@public.gmane.org, matthew.dodd-DABiIiYg7OfQT0dZR+AlfA@public.gmane.org, trond.myklebust-41N18TsMXrtuMpJDpNschA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org, linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: James Morris Return-path: In-Reply-To: Sender: linux-nfs-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-fsdevel.vger.kernel.org On Fri, 2010-07-09 at 08:48 +1000, James Morris wrote: > On Thu, 8 Jul 2010, David P. Quigley wrote: > > > > The maximum security label size on Linux is: > > > > > > #define XATTR_SIZE_MAX 65536 > > > > > > Why arbitrarily limit this over the network? > > > > Because there is no easy way not to. The specification doesn't specify a > > limit to label size in the IETF draft. However there is no way to do > > allocation of the memory needed to store the label where we first get > > access to its size. We tried this before and it failed. When I asked > > trond about it he said doing memory allocation in the rpc context isn't > > allowed. > > In the NFSv3 code, the workaround I've been using is to always allocate > 64k, but the correct way of doing this apparently is to use the page > cache, as is used for ACLs and symlinks. > > > For the most part what would make this label size inadequate would be > > the MLS component. There are some cases where people want every other > > compartment or something crazy like that. In terms of a normal label > > though 4096 should be more than enough. > > Yes, but we should not unnecessarily limit the network protocol when > something is valid and possible in the local implementation (which is ~64k > under Linux). > > > Just to put this in perspective the string below is 4096 a's. > > A security label include just about anything, e.g. an x509 certificate, or > a base64 encoded image. > > In the Linux implementation, if we can store a local label up to 64k, then > we should try and ensure that it can be conveyed via NFS. > > > > - James If you want that to be the case you need to make your case to Trond about that. I've already had this conversation before and he seems to think that a page is sufficient. Bruce also has concerns about not wanting these labels to require a high order allocation. Under memory pressure finding 16 contiguous pages for each label might be a problem. Dave -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Subject: Re: [PATCH 06/10] NFSv4: Add label recommended attribute and NFSv4 flags From: "David P. Quigley" To: James Morris Cc: "J. Bruce Fields" , hch@infradead.org, viro@zeniv.linux.org.uk, casey@schaufler-ca.com, sds@tycho.nsa.gov, matthew.dodd@sparta.com, trond.myklebust@fys.uio.no, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-nfs@vger.kernel.org In-Reply-To: References: <1278513086-23964-1-git-send-email-dpquigl@tycho.nsa.gov> <1278513086-23964-7-git-send-email-dpquigl@tycho.nsa.gov> <20100707170058.GD28815@fieldses.org> <1278596363.2494.194.camel@moss-terrapins.epoch.ncsc.mil> Content-Type: text/plain Date: Fri, 09 Jul 2010 10:05:48 -0400 Message-Id: <1278684348.2494.223.camel@moss-terrapins.epoch.ncsc.mil> Mime-Version: 1.0 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On Fri, 2010-07-09 at 08:48 +1000, James Morris wrote: > On Thu, 8 Jul 2010, David P. Quigley wrote: > > > > The maximum security label size on Linux is: > > > > > > #define XATTR_SIZE_MAX 65536 > > > > > > Why arbitrarily limit this over the network? > > > > Because there is no easy way not to. The specification doesn't specify a > > limit to label size in the IETF draft. However there is no way to do > > allocation of the memory needed to store the label where we first get > > access to its size. We tried this before and it failed. When I asked > > trond about it he said doing memory allocation in the rpc context isn't > > allowed. > > In the NFSv3 code, the workaround I've been using is to always allocate > 64k, but the correct way of doing this apparently is to use the page > cache, as is used for ACLs and symlinks. > > > For the most part what would make this label size inadequate would be > > the MLS component. There are some cases where people want every other > > compartment or something crazy like that. In terms of a normal label > > though 4096 should be more than enough. > > Yes, but we should not unnecessarily limit the network protocol when > something is valid and possible in the local implementation (which is ~64k > under Linux). > > > Just to put this in perspective the string below is 4096 a's. > > A security label include just about anything, e.g. an x509 certificate, or > a base64 encoded image. > > In the Linux implementation, if we can store a local label up to 64k, then > we should try and ensure that it can be conveyed via NFS. > > > > - James If you want that to be the case you need to make your case to Trond about that. I've already had this conversation before and he seems to think that a page is sufficient. Bruce also has concerns about not wanting these labels to require a high order allocation. Under memory pressure finding 16 contiguous pages for each label might be a problem. Dave -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.