From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967530Ab2EPNxN (ORCPT ); Wed, 16 May 2012 09:53:13 -0400 Received: from e36.co.us.ibm.com ([32.97.110.154]:34082 "EHLO e36.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S967073Ab2EPNxL (ORCPT ); Wed, 16 May 2012 09:53:11 -0400 Message-ID: <1337176336.3522.5.camel@falcor> Subject: Re: [PATCH] vfs: fix IMA lockdep circular locking dependency From: Mimi Zohar To: Eric Paris Cc: James Morris , Linus Torvalds , Al Viro , Mimi Zohar , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 16 May 2012 09:52:16 -0400 In-Reply-To: <1337175731.2492.4.camel@localhost> References: <1336963631-3541-1-git-send-email-zohar@us.ibm.com> <1337112446.20904.50.camel@falcor> <20120516004251.GO22082@ZenIV.linux.org.uk> <1337175731.2492.4.camel@localhost> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.3 (3.2.3-3.fc16) Content-Transfer-Encoding: 7bit Mime-Version: 1.0 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12051613-7606-0000-0000-00000063DF37 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2012-05-16 at 09:42 -0400, Eric Paris wrote: > On Wed, 2012-05-16 at 21:37 +1000, James Morris wrote: > > On Tue, 15 May 2012, Linus Torvalds wrote: > > > > > Hmm? > > > > diff --git a/security/capability.c b/security/capability.c > > index 5bb21b1c448c..9a19c6a54e12 100644 > > --- a/security/capability.c > > +++ b/security/capability.c > > @@ -949,7 +949,6 @@ void __init security_fixup_ops(struct > > security_operations *ops) > > set_to_cap_if_null(ops, file_alloc_security); > > set_to_cap_if_null(ops, file_free_security); > > set_to_cap_if_null(ops, file_ioctl); > > - set_to_cap_if_null(ops, file_mmap); > > set_to_cap_if_null(ops, file_mprotect); > > set_to_cap_if_null(ops, file_lock); > > set_to_cap_if_null(ops, file_fcntl); > > > > > > Do we need to add addr_map to the fixup ops? > > No. His patch works just fine without it. If you look he uses: > > + if (security_ops->mmap_file) { > > Which means since we didn't set an explicit .mmap_file, even with no > other LSM loaded we would be fine. > > At the moment I'd rather stick with our usual notation of forcing > capabilities to define every option even if all it does it return 0. If > Linus thinks it's a good idea to do > if (security_ops->function) > security_ops->funtion(args); > In the security server we should do that cleanup separately... > > -Eric James was pointing out that security_fixup_ops was not set for mmap_addr, not mmap_file(), which should be initialized by security_fixup_ops(). Mimi