From: "Schaufler, Casey" <casey.schaufler@intel.com> To: Vivek Goyal <vgoyal@redhat.com>, "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk> Cc: "virtio-fs@redhat.com" <virtio-fs@redhat.com>, "dwalsh@redhat.com" <dwalsh@redhat.com>, "dgilbert@redhat.com" <dgilbert@redhat.com>, "berrange@redhat.com" <berrange@redhat.com>, "casey@schaufler-ca.com" <casey@schaufler-ca.com>, linux-security-module <linux-security-module@vger.kernel.org>, "selinux@vger.kernel.org" <selinux@vger.kernel.org> Subject: RE: [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Date: Fri, 25 Jun 2021 21:49:51 +0000 [thread overview] Message-ID: <BN0PR11MB57275823CE05DED7BC755460FD069@BN0PR11MB5727.namprd11.prod.outlook.com> (raw) In-Reply-To: <20210625191229.1752531-1-vgoyal@redhat.com> > -----Original Message----- > From: Vivek Goyal <vgoyal@redhat.com> > Sent: Friday, June 25, 2021 12:12 PM > To: linux-fsdevel@vger.kernel.org; linux-kernel@vger.kernel.org; > viro@zeniv.linux.org.uk > Cc: virtio-fs@redhat.com; dwalsh@redhat.com; dgilbert@redhat.com; > berrange@redhat.com; vgoyal@redhat.com Please include Linux Security Module list <linux-security-module@vger.kernel.org> and selinux@vger.kernel.org on this topic. > Subject: [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if > caller has CAP_SYS_RESOURCE > > Hi, > > In virtiofs, actual file server is virtiosd daemon running on host. > There we have a mode where xattrs can be remapped to something else. > For example security.selinux can be remapped to > user.virtiofsd.securit.selinux on the host. This would seem to provide mechanism whereby a user can violate SELinux policy quite easily. > > This remapping is useful when SELinux is enabled in guest and virtiofs > as being used as rootfs. Guest and host SELinux policy might not match > and host policy might deny security.selinux xattr setting by guest > onto host. Or host might have SELinux disabled and in that case to > be able to set security.selinux xattr, virtiofsd will need to have > CAP_SYS_ADMIN (which we are trying to avoid). Being able to remap > guest security.selinux (or other xattrs) on host to something else > is also better from security point of view. Can you please provide some rationale for this assertion? I have been working with security xattrs longer than anyone and have trouble accepting the statement. > But when we try this, we noticed that SELinux relabeling in guest > is failing on some symlinks. When I debugged a little more, I > came to know that "user.*" xattrs are not allowed on symlinks > or special files. > > "man xattr" seems to suggest that primary reason to disallow is > that arbitrary users can set unlimited amount of "user.*" xattrs > on these files and bypass quota check. > > If that's the primary reason, I am wondering is it possible to relax > the restrictions if caller has CAP_SYS_RESOURCE. This capability > allows caller to bypass quota checks. So it should not be > a problem atleast from quota perpective. > > That will allow me to give CAP_SYS_RESOURCE to virtiofs deamon > and remap xattrs arbitrarily. On a Smack system you should require CAP_MAC_ADMIN to remap security. xattrs. I sounds like you're in serious danger of running afoul of LSM attribute policy on a reasonable general level. > > Thanks > Vivek > > Vivek Goyal (1): > xattr: Allow user.* xattr on symlink/special files with > CAP_SYS_RESOURCE > > fs/xattr.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > -- > 2.25.4
WARNING: multiple messages have this Message-ID (diff)
From: "Schaufler, Casey" <casey.schaufler@intel.com> To: Vivek Goyal <vgoyal@redhat.com>, "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk> Cc: "berrange@redhat.com" <berrange@redhat.com>, "selinux@vger.kernel.org" <selinux@vger.kernel.org>, "virtio-fs@redhat.com" <virtio-fs@redhat.com>, linux-security-module <linux-security-module@vger.kernel.org>, "casey@schaufler-ca.com" <casey@schaufler-ca.com> Subject: Re: [Virtio-fs] [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Date: Fri, 25 Jun 2021 21:49:51 +0000 [thread overview] Message-ID: <BN0PR11MB57275823CE05DED7BC755460FD069@BN0PR11MB5727.namprd11.prod.outlook.com> (raw) In-Reply-To: <20210625191229.1752531-1-vgoyal@redhat.com> > -----Original Message----- > From: Vivek Goyal <vgoyal@redhat.com> > Sent: Friday, June 25, 2021 12:12 PM > To: linux-fsdevel@vger.kernel.org; linux-kernel@vger.kernel.org; > viro@zeniv.linux.org.uk > Cc: virtio-fs@redhat.com; dwalsh@redhat.com; dgilbert@redhat.com; > berrange@redhat.com; vgoyal@redhat.com Please include Linux Security Module list <linux-security-module@vger.kernel.org> and selinux@vger.kernel.org on this topic. > Subject: [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if > caller has CAP_SYS_RESOURCE > > Hi, > > In virtiofs, actual file server is virtiosd daemon running on host. > There we have a mode where xattrs can be remapped to something else. > For example security.selinux can be remapped to > user.virtiofsd.securit.selinux on the host. This would seem to provide mechanism whereby a user can violate SELinux policy quite easily. > > This remapping is useful when SELinux is enabled in guest and virtiofs > as being used as rootfs. Guest and host SELinux policy might not match > and host policy might deny security.selinux xattr setting by guest > onto host. Or host might have SELinux disabled and in that case to > be able to set security.selinux xattr, virtiofsd will need to have > CAP_SYS_ADMIN (which we are trying to avoid). Being able to remap > guest security.selinux (or other xattrs) on host to something else > is also better from security point of view. Can you please provide some rationale for this assertion? I have been working with security xattrs longer than anyone and have trouble accepting the statement. > But when we try this, we noticed that SELinux relabeling in guest > is failing on some symlinks. When I debugged a little more, I > came to know that "user.*" xattrs are not allowed on symlinks > or special files. > > "man xattr" seems to suggest that primary reason to disallow is > that arbitrary users can set unlimited amount of "user.*" xattrs > on these files and bypass quota check. > > If that's the primary reason, I am wondering is it possible to relax > the restrictions if caller has CAP_SYS_RESOURCE. This capability > allows caller to bypass quota checks. So it should not be > a problem atleast from quota perpective. > > That will allow me to give CAP_SYS_RESOURCE to virtiofs deamon > and remap xattrs arbitrarily. On a Smack system you should require CAP_MAC_ADMIN to remap security. xattrs. I sounds like you're in serious danger of running afoul of LSM attribute policy on a reasonable general level. > > Thanks > Vivek > > Vivek Goyal (1): > xattr: Allow user.* xattr on symlink/special files with > CAP_SYS_RESOURCE > > fs/xattr.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > -- > 2.25.4
next prev parent reply other threads:[~2021-06-25 21:50 UTC|newest] Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-06-25 19:12 [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Vivek Goyal 2021-06-25 19:12 ` [Virtio-fs] " Vivek Goyal 2021-06-25 19:12 ` [PATCH 1/1] xattr: Allow user.* xattr on symlink/special files with CAP_SYS_RESOURCE Vivek Goyal 2021-06-25 19:12 ` [Virtio-fs] " Vivek Goyal 2021-06-28 12:33 ` Christian Brauner 2021-06-28 12:33 ` [Virtio-fs] " Christian Brauner 2021-06-28 15:00 ` Vivek Goyal 2021-06-28 15:00 ` [Virtio-fs] " Vivek Goyal 2021-06-29 3:13 ` [xattr] 8d8cd767b6: ltp.setxattr02.fail kernel test robot 2021-06-29 3:13 ` [Virtio-fs] " kernel test robot 2021-06-29 3:13 ` kernel test robot 2021-06-29 3:13 ` [LTP] " kernel test robot 2021-06-29 12:59 ` Vivek Goyal 2021-06-29 12:59 ` [Virtio-fs] " Vivek Goyal 2021-06-29 12:59 ` Vivek Goyal 2021-06-29 12:59 ` [LTP] " Vivek Goyal 2021-06-25 21:49 ` Schaufler, Casey [this message] 2021-06-25 21:49 ` [Virtio-fs] [RFC PATCH 0/1] xattr: Allow user.* xattr on symlink/special files if caller has CAP_SYS_RESOURCE Schaufler, Casey 2021-06-28 11:58 ` Dr. David Alan Gilbert 2021-06-28 11:58 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-28 13:17 ` Vivek Goyal 2021-06-28 13:17 ` [Virtio-fs] " Vivek Goyal 2021-06-28 13:36 ` Daniel Walsh 2021-06-28 13:36 ` [Virtio-fs] " Daniel Walsh 2021-06-28 16:04 ` Casey Schaufler 2021-06-28 16:04 ` [Virtio-fs] " Casey Schaufler 2021-06-28 16:28 ` Dr. David Alan Gilbert 2021-06-28 16:28 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-28 17:41 ` Casey Schaufler 2021-06-28 17:41 ` [Virtio-fs] " Casey Schaufler 2021-06-29 9:00 ` Dr. David Alan Gilbert 2021-06-29 9:00 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-29 14:38 ` Casey Schaufler 2021-06-29 14:38 ` [Virtio-fs] " Casey Schaufler 2021-06-29 15:20 ` Vivek Goyal 2021-06-29 15:20 ` [Virtio-fs] " Vivek Goyal 2021-06-29 16:13 ` Casey Schaufler 2021-06-29 16:13 ` [Virtio-fs] " Casey Schaufler 2021-06-29 16:35 ` Dr. David Alan Gilbert 2021-06-29 16:35 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-29 16:51 ` Casey Schaufler 2021-06-29 16:51 ` [Virtio-fs] " Casey Schaufler 2021-06-29 17:35 ` Vivek Goyal 2021-06-29 17:35 ` [Virtio-fs] " Vivek Goyal 2021-06-29 20:28 ` Daniel Walsh 2021-06-29 20:28 ` [Virtio-fs] " Daniel Walsh 2021-06-30 4:12 ` Theodore Ts'o 2021-06-30 4:12 ` [Virtio-fs] " Theodore Ts'o 2021-06-30 8:07 ` Dr. David Alan Gilbert 2021-06-30 8:07 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-30 14:47 ` Theodore Ts'o 2021-06-30 14:47 ` [Virtio-fs] " Theodore Ts'o 2021-06-30 15:01 ` Dr. David Alan Gilbert 2021-06-30 15:01 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-06-30 19:59 ` Theodore Ts'o 2021-06-30 19:59 ` [Virtio-fs] " Theodore Ts'o 2021-06-30 20:32 ` Vivek Goyal 2021-06-30 20:32 ` [Virtio-fs] " Vivek Goyal 2021-07-01 8:48 ` Dr. David Alan Gilbert 2021-07-01 8:48 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-07-01 12:21 ` Vivek Goyal 2021-07-01 12:21 ` [Virtio-fs] " Vivek Goyal 2021-07-01 13:10 ` Vivek Goyal 2021-07-01 13:10 ` [Virtio-fs] " Vivek Goyal 2021-07-01 16:58 ` Casey Schaufler 2021-07-01 16:58 ` [Virtio-fs] " Casey Schaufler 2021-06-30 16:09 ` Vivek Goyal 2021-06-30 16:09 ` [Virtio-fs] " Vivek Goyal 2021-06-30 14:27 ` Vivek Goyal 2021-06-30 14:27 ` [Virtio-fs] " Vivek Goyal 2021-06-29 16:25 ` Theodore Ts'o 2021-06-29 16:25 ` [Virtio-fs] " Theodore Ts'o 2021-06-28 17:22 ` Vivek Goyal 2021-06-28 17:22 ` [Virtio-fs] " Vivek Goyal 2021-06-28 18:55 ` Daniel Walsh 2021-06-28 18:55 ` [Virtio-fs] " Daniel Walsh
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=BN0PR11MB57275823CE05DED7BC755460FD069@BN0PR11MB5727.namprd11.prod.outlook.com \ --to=casey.schaufler@intel.com \ --cc=berrange@redhat.com \ --cc=casey@schaufler-ca.com \ --cc=dgilbert@redhat.com \ --cc=dwalsh@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=selinux@vger.kernel.org \ --cc=vgoyal@redhat.com \ --cc=viro@zeniv.linux.org.uk \ --cc=virtio-fs@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.