bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
@ 2023-03-29 13:04 Roberto Sassu
  2023-03-29 13:04 ` [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write() Roberto Sassu
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Roberto Sassu @ 2023-03-29 13:04 UTC (permalink / raw)
  To: zohar, dmitry.kasatkin, paul, jmorris, serge,
	stephen.smalley.work, eparis, casey
  Cc: reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

From: Roberto Sassu <roberto.sassu@huawei.com>

One of the major goals of LSM stacking is to run multiple LSMs side by side
without interfering with each other. The ultimate decision will depend on
individual LSM decision.

Several changes need to be made to the LSM infrastructure to be able to
support that. This patch set tackles one of them: gives to each LSM the
ability to specify one or multiple xattrs to be set at inode creation
time and, at the same time, gives to EVM the ability to access all those
xattrs and calculate the HMAC on them.

The first problem that this patch set addresses is to make the
inode_init_security hook definition suitable to use with EVM which, unlike
other LSMs, needs to have visibility of all xattrs and not only the one
that the LSM infrastructure passes to the LSM to be set.

The solution is to replace in the inode_init_security definition the
name/value/len parameters with the beginning of the array containing all
xattrs set by LSMs. Due to security_old_inode_init_security() API
limitation of setting only one xattr, it has been dropped and the remaining
users, ocfs2 and reiserfs, switch to security_inode_init_security().
However, due to the complexity of the changes required to fully exploit the
ability of security_inode_init_security() to set multiple xattrs, those
users can still set only one xattr (the first set in the xattr array) where
previously they called security_old_inode_init_security().

Furthermore, while EVM is invoked unlike before, its xattr will not be set
as it would not be the first set in the xattr array, or if it is the first,
there would not be protected xattrs to calculate the HMAC on.

Reiserfs, regardless of the switch had anyway another problem: it was
setting xattrs without the security prefix in the xattr name. That has been
solved too, by writing the full xattr name in a temporary buffer, before
passing it to the function which actually writes the xattr.

The second problem this patch set addresses is the limitation of the
call_int_hook() of stopping the loop when the return value from a hook
implementation is not zero. Unfortunately, for the inode_init_security hook
it is a legitimate case to return -EOPNOTSUPP, but this would not
necessarily mean that there is an error to report to the LSM infrastructure
but just that an LSM does not will to set an xattr. Other LSMs should be
still consulted as well.

The solution for this specific case is to replace the call_int_hook() with
the loop itself, so that -EOPNOTSUPP can be ignored. In addition, the
default return value of inode_init_security had also to be changed to
-EOPNOTSUPP, so that the whole security_inode_init_security() does not fail
due to BPF LSM returning zero and not providing an xattr.

Next, this patch set removes the limitation of creating only two xattrs,
one by an active LSM and another by EVM. This patch set extends the
reservation mechanism of the LSM infrastructure, to allow each LSM to
request one or multiple xattrs. While this could potentially lead to
reaching the filesystem limits of number/size of the xattrs, it seems not
an issue that need to be solved by the LSM infrastructure but by the
filesystems themselves. Currently, if the limit is reached, the only
workaround would be to use fewer LSMs.

The reservation mechanism concept would have made it very easy for LSMs to
position themselves correctly in the xattr array, as the LSM infrastructure
at initialization time changes the number of xattrs requested by each LSM
with an offset.

However, this opens for the possibility of having gaps in the xattr array,
due to the fact that an LSM can request xattr slots to the LSM
infrastructure but not fill them (if it was loaded but not initialized).

Instead, the decision was to add an additional parameter to the
inode_init_security_hook, the number of filled slots in the xattr array,
which each LSM is expected to update for each xattr it provides. In this
way, the next LSM starts to fill after the last filled slot, regardless of
whether previous LSMs were initialized or not. SELinux, Smack and EVM have
been updated to use this new mechanism.

Finally, this patch set modifies the evm_inode_init_security() definition
to be compatible with the inode_init_security hook definition and adds
support for scanning the whole xattr array and for calculating the HMAC
on all xattrs provided by LSMs.

This patch set has been tested by introducing several instances of a
TestLSM (some providing an xattr, some not, one with a wrong implementation
to see how the LSM infrastructure handles it, one providing multiple xattrs
and another providing an xattr but in a disabled state). The patch is not
included in this set but it is available here:

https://github.com/robertosassu/linux/commit/8fba3224e3f7698114ae721fb8e899d322cc1f4c

The test, added to ima-evm-utils, is available here:

https://github.com/robertosassu/ima-evm-utils/blob/evm-multiple-lsms-v9-devel-v2/tests/evm_multiple_lsms.test

The test takes a UML kernel built by Github Actions and launches it several
times, each time with a different combination of LSMs and filesystems (ext4,
reiserfs, ocfs2). After boot, it first checks that there is an xattr for each
LSM providing it (for reiserfs and ocfs2 just the first LSM), and then (for
ext4) calculates the HMAC in user space and compares it with the HMAC
calculated by EVM in kernel space.

A test report can be obtained here:

https://github.com/robertosassu/ima-evm-utils/actions/runs/4553749294/jobs/8030902168

The patch set has been tested with both the SElinux and Smack test suites.
Below, there is the summary of the test results:

SELinux Test Suite result (without patches):
All tests successful.
Files=76, Tests=1357, 229 wallclock secs ( 0.45 usr  0.12 sys + 12.76 cusr 16.03 csys = 29.36 CPU)
Result: PASS

SELinux Test Suite result (with patches):
All tests successful.
Files=76, Tests=1357, 231 wallclock secs ( 0.48 usr  0.11 sys + 12.44 cusr 16.21 csys = 29.24 CPU)
Result: PASS

Smack Test Suite result (without patches):
95 Passed, 0 Failed, 100% Success rate

Smack Test Suite result (with patches):
95 Passed, 0 Failed, 100% Success rate

Changelog

v8:
- Add a new reiserfs patch to write the full xattr name
- Add num_filled_xattrs parameter to inode_init_security hook (suggested by
  Paul) and evm_inode_init_security()
- Change default return value of inode_init_security hook to -EOPNOTSUPP
- Rename lbs_xattr field of lsm_blob_sizes to lbs_xattr_count
- Introduce lsm_find_xattr_slot() helper
- Rename lsm_xattr parameter of evm_init_hmac() to xattrs
- Retrieve the EVM xattr slot with lsm_find_xattr_slot() and double check
  with the xattr array terminator
- Remove security_check_compact_filled_xattrs() (suggested by Paul)
- Update security_inode_init_security() documentation
- Ensure that inode_init_security hook incremented the number of filled
  slots if it returned zero
- Ensure that xattr name and value are non-NULL in the filled slots
- Add the xattr name assignment after the xattr value one (suggested by
  Paul)
- Drop patches 1 - 3 (already in lsm/next)

v7:
- Add a patch dependency comment in patch 1 (suggested by Mimi)
- Restore check of -EOPNOTSUPP status in ocfs2_mknod() and ocfs2_symlink()
  (reported by Mimi)
- Add explanation in evm_inode_init_security() why walking through the
  xattrs array is safe (suggested by Mimi)
- Document the lbs_xattr field of struct lsm_blob_sizes (suggested by
  Casey)
- Move documentation changes of the inode_init_security hook to security.c,
  after LSM documentation reorganization by Paul
- Use attributes in plural form in the description of the xattrs parameter
  of smack_inode_init_security()
- Check xattr name instead of xattr value in evm_inode_init_security(),
  for consistency with evm_init_hmac(); equivalent, since
  security_check_compact_filled_xattrs() rejects xattrs with xattr name
  NULL and value not NULL, and viceversa

v6:
- Add a comment in Smack to introduce its xattrs (suggested by Casey)
- Document the overloaded meaning of -EOPNOTSUPP in
  security_inode_init_security() (suggested by Mimi)

v5:
- Modify the cover letter to explain that the goal of this patch set is
  supporting multiple per LSM xattrs in EVM, and not moving IMA and EVM to
  the LSM infrastructure (suggested by Mimi)
- Remove references in the patches description about moving IMA and EVM
  to the LSM infrastructure (suggested by Mimi)
- Explain that the additional EVM invocation due to the switch to
  security_inode_init_security() will not cause the EVM xattr to be added
  (suggested by Mimi)

v4:
- Remove patch to call reiserfs_security_free(), already queued
- Switch ocfs2 and reiserfs to security_inode_init_security() (suggested by
  Mimi)
- Remove security_old_inode_init_security() (suggested by Paul)
- Rename security_check_compact_xattrs() to
  security_check_compact_filled_xattrs() and add function description
  (suggested by Mimi)
- Rename checked_xattrs parameter of security_check_compact_filled_xattrs()
  to num_filled_xattrs (suggested by Mimi)
- Rename cur_xattrs variable in security_inode_init_security() to
  num_filled_xattrs (suggested by Mimi)

v3:
- Don't free the xattr name in reiserfs_security_free()
- Don't include fs_data parameter in inode_init_security hook
- Don't change evm_inode_init_security(), as it will be removed if EVM is
  stacked
- Fix inode_init_security hook documentation
- Drop lsm_find_xattr_slot(), use simple xattr reservation mechanism and
  introduce security_check_compact_xattrs() to compact the xattr array
- Don't allocate xattr array if LSMs didn't reserve any xattr
- Return zero if initxattrs() is not provided to
  security_inode_init_security(), -EOPNOTSUPP if value is not provided to
  security_old_inode_init_security()
- Request LSMs to fill xattrs if only value (not the triple) is provided to
  security_old_inode_init_security(), to avoid unnecessary memory
  allocation

v2:
- rewrite selinux_old_inode_init_security() to use
  security_inode_init_security()
- add lbs_xattr field to lsm_blob_sizes structure, to give the ability to
  LSMs to reserve slots in the xattr array (suggested by Casey)
- add new parameter base_slot to inode_init_security hook definition

v1:
- add calls to reiserfs_security_free() and initialize sec->value to NULL
  (suggested by Tetsuo and Mimi)
- change definition of inode_init_security hook, replace the name, value
  and len triple with the xattr array (suggested by Casey)
- introduce lsm_find_xattr_slot() helper for LSMs to find an unused slot in
  the passed xattr array

Roberto Sassu (4):
  reiserfs: Add security prefix to xattr name in
    reiserfs_security_write()
  security: Allow all LSMs to provide xattrs for inode_init_security
    hook
  evm: Align evm_inode_init_security() definition with LSM
    infrastructure
  evm: Support multiple LSMs providing an xattr

 fs/reiserfs/xattr_security.c        |  8 ++-
 include/linux/evm.h                 | 14 +++--
 include/linux/lsm_hook_defs.h       |  6 +-
 include/linux/lsm_hooks.h           | 14 +++++
 security/integrity/evm/evm.h        |  4 +-
 security/integrity/evm/evm_crypto.c | 11 +++-
 security/integrity/evm/evm_main.c   | 41 ++++++++++---
 security/security.c                 | 94 ++++++++++++++++++++++-------
 security/selinux/hooks.c            | 18 +++---
 security/smack/smack_lsm.c          | 33 ++++++----
 10 files changed, 179 insertions(+), 64 deletions(-)

-- 
2.25.1


^ permalink raw reply	[flat|nested] 14+ messages in thread

* [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write()
  2023-03-29 13:04 [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
@ 2023-03-29 13:04 ` Roberto Sassu
  2023-03-30 21:15   ` Paul Moore
  2023-03-29 13:04 ` [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 14+ messages in thread
From: Roberto Sassu @ 2023-03-29 13:04 UTC (permalink / raw)
  To: zohar, dmitry.kasatkin, paul, jmorris, serge,
	stephen.smalley.work, eparis, casey
  Cc: reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu, stable

From: Roberto Sassu <roberto.sassu@huawei.com>

Reiserfs sets a security xattr at inode creation time in two stages: first,
it calls reiserfs_security_init() to obtain the xattr from active LSMs;
then, it calls reiserfs_security_write() to actually write that xattr.

Unfortunately, it seems there is a wrong expectation that LSMs provide the
full xattr name in the form 'security.<suffix>'. However, LSMs always
provided just the suffix, causing reiserfs to not write the xattr at all
(if the suffix is shorter than the prefix), or to write an xattr with the
wrong name.

Add a temporary buffer in reiserfs_security_write(), and write to it the
full xattr name, before passing it to reiserfs_xattr_set_handle().

Since the 'security.' prefix is always prepended, remove the name length
check.

Cc: stable@vger.kernel.org # v2.6.x
Fixes: 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 fs/reiserfs/xattr_security.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
index 6bffdf9a4fd..b0c354ab113 100644
--- a/fs/reiserfs/xattr_security.c
+++ b/fs/reiserfs/xattr_security.c
@@ -95,11 +95,13 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
 			    struct inode *inode,
 			    struct reiserfs_security_handle *sec)
 {
+	char xattr_name[XATTR_NAME_MAX + 1];
 	int error;
-	if (strlen(sec->name) < sizeof(XATTR_SECURITY_PREFIX))
-		return -EINVAL;
 
-	error = reiserfs_xattr_set_handle(th, inode, sec->name, sec->value,
+	snprintf(xattr_name, sizeof(xattr_name), "%s%s", XATTR_SECURITY_PREFIX,
+		 sec->name);
+
+	error = reiserfs_xattr_set_handle(th, inode, xattr_name, sec->value,
 					  sec->length, XATTR_CREATE);
 	if (error == -ENODATA || error == -EOPNOTSUPP)
 		error = 0;
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
  2023-03-29 13:04 [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
  2023-03-29 13:04 ` [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write() Roberto Sassu
@ 2023-03-29 13:04 ` Roberto Sassu
  2023-03-30 22:50   ` Paul Moore
  2023-03-29 13:04 ` [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
  2023-03-29 13:04 ` [PATCH v9 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu
  3 siblings, 1 reply; 14+ messages in thread
From: Roberto Sassu @ 2023-03-29 13:04 UTC (permalink / raw)
  To: zohar, dmitry.kasatkin, paul, jmorris, serge,
	stephen.smalley.work, eparis, casey
  Cc: reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

From: Roberto Sassu <roberto.sassu@huawei.com>

Currently, security_inode_init_security() supports only one LSM providing
an xattr and EVM calculating the HMAC on that xattr, plus other inode
metadata.

Allow all LSMs to provide one or multiple xattrs, by extending the security
blob reservation mechanism. Introduce the new lbs_xattr_count field of the
lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
needs, and the LSM infrastructure knows how many xattr slots it should
allocate.

Dynamically allocate the new_xattrs array to be populated by LSMs with the
inode_init_security hook, and pass it to the latter instead of the
name/value/len triple.

Also, pass to the hook the number of xattrs filled by each LSM, so that
there are no gaps when the next LSM fills the array. Gaps might occur
because an LSM can legitimately request xattrs to the LSM infrastructure,
but not fill the reserved slots, if it was not initialized.

Update the documentation of security_inode_init_security() to reflect the
changes, and fix the description of the xattr name, as it is not allocated
anymore.

On the security_inode_init_security() side, ensure that if LSMs returned
zero from the hook, they correctly filled a new_xattrs slot. Consequently,
change the default return value of the hook to -EOPNOTSUPP, so that BPF LSM
returns that, and does not cause security_inode_init_security() to fail.

Finally, adapt both SELinux and Smack to use the new definition of the
inode_init_security hook, and to fill the reserved slots in the xattr
array. Introduce the lsm_find_xattr_slot() helper to retrieve an available
slot to fill, and to increment the number of filled slots.

Move the xattr->name assignment after the xattr->value one, so that it is
done only in case of successful memory allocation. For Smack, also reserve
space for the other defined xattrs although they are not set yet in
smack_inode_init_security().

Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 include/linux/lsm_hook_defs.h |  6 +--
 include/linux/lsm_hooks.h     | 14 ++++++
 security/security.c           | 92 +++++++++++++++++++++++++++--------
 security/selinux/hooks.c      | 18 ++++---
 security/smack/smack_lsm.c    | 33 ++++++++-----
 5 files changed, 120 insertions(+), 43 deletions(-)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 6bb55e61e8e..1fd95db0087 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -111,9 +111,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
 	 unsigned int obj_type)
 LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
 LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
-LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
-	 struct inode *dir, const struct qstr *qstr, const char **name,
-	 void **value, size_t *len)
+LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
+	 struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,
+	 int *num_filled_xattrs)
 LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
 	 const struct qstr *name, const struct inode *context_inode)
 LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index c2be66c669a..b60de5f2f34 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -28,6 +28,7 @@
 #include <linux/security.h>
 #include <linux/init.h>
 #include <linux/rculist.h>
+#include <linux/xattr.h>
 
 union security_list_options {
 	#define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
@@ -63,8 +64,21 @@ struct lsm_blob_sizes {
 	int	lbs_ipc;
 	int	lbs_msg_msg;
 	int	lbs_task;
+	int	lbs_xattr_count; /* number of xattr slots in new_xattrs array */
 };
 
+/*
+ * Retrieve the first available slot to fill with an xattr, and increment
+ * the number of filled slots.
+ */
+static inline struct xattr *lsm_find_xattr_slot(struct xattr *xattrs,
+						int *num_filled_xattrs)
+{
+	if (unlikely(!xattrs))
+		return NULL;
+	return xattrs + (*num_filled_xattrs)++;
+}
+
 /*
  * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
  * LSM hooks (in include/linux/lsm_hook_defs.h).
diff --git a/security/security.c b/security/security.c
index f4170efcddd..be33d643a81 100644
--- a/security/security.c
+++ b/security/security.c
@@ -31,8 +31,6 @@
 #include <linux/msg.h>
 #include <net/flow.h>
 
-#define MAX_LSM_EVM_XATTR	2
-
 /* How many LSMs were built into the kernel? */
 #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
 
@@ -212,6 +210,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
 	lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
 	lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
 	lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
+	lsm_set_blob_size(&needed->lbs_xattr_count,
+			  &blob_sizes.lbs_xattr_count);
 }
 
 /* Prepare LSM for initialization. */
@@ -378,6 +378,7 @@ static void __init ordered_lsm_init(void)
 	init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
 	init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
 	init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
+	init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
 
 	/*
 	 * Create any kmem_caches needed for blobs
@@ -1591,11 +1592,15 @@ EXPORT_SYMBOL(security_dentry_create_files_as);
  * created inode and set up the incore security field for the new inode.  This
  * hook is called by the fs code as part of the inode creation transaction and
  * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
- * hooks called by the VFS.  The hook function is expected to allocate the name
- * and value via kmalloc, with the caller being responsible for calling kfree
- * after using them.  If the security module does not use security attributes
- * or does not wish to put a security attribute on this particular inode, then
- * it should return -EOPNOTSUPP to skip this processing.
+ * hooks called by the VFS.  The hook function is expected to populate the
+ * @xattrs array, by calling lsm_find_xattr_slot() to retrieve the slots
+ * reserved by the security module with the lbs_xattr_count field of the
+ * lsm_blob_sizes structure.  For each slot, the hook function should set ->name
+ * to the attribute name suffix (e.g. selinux), to allocate ->value (will be
+ * freed by the caller) and set it to the attribute value, to set ->value_len to
+ * the length of the value.  If the security module does not use security
+ * attributes or does not wish to put a security attribute on this particular
+ * inode, then it should return -EOPNOTSUPP to skip this processing.
  *
  * Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
  * needed, or -ENOMEM on memory allocation failure.
@@ -1604,33 +1609,80 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
 				 const struct qstr *qstr,
 				 const initxattrs initxattrs, void *fs_data)
 {
-	struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
-	struct xattr *lsm_xattr, *evm_xattr, *xattr;
-	int ret;
+	struct security_hook_list *P;
+	struct xattr *new_xattrs;
+	struct xattr *xattr;
+	int num_filled_xattrs = 0, old_num_filled_xattrs;
+	int ret = -EOPNOTSUPP, i;
 
 	if (unlikely(IS_PRIVATE(inode)))
 		return 0;
 
+	if (!blob_sizes.lbs_xattr_count)
+		return 0;
+
 	if (!initxattrs)
 		return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
-				     dir, qstr, NULL, NULL, NULL);
-	memset(new_xattrs, 0, sizeof(new_xattrs));
-	lsm_xattr = new_xattrs;
-	ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
-			    &lsm_xattr->name,
-			    &lsm_xattr->value,
-			    &lsm_xattr->value_len);
-	if (ret)
+				    dir, qstr, NULL, NULL);
+	/* Allocate +1 for EVM and +1 as terminator. */
+	new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
+			     sizeof(*new_xattrs), GFP_NOFS);
+	if (!new_xattrs)
+		return -ENOMEM;
+
+	hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
+			     list) {
+		old_num_filled_xattrs = num_filled_xattrs;
+
+		ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs,
+						  &num_filled_xattrs);
+		if (ret && ret != -EOPNOTSUPP)
+			goto out;
+		/*
+		 * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
+		 * means that the LSM is not willing to provide an xattr, not
+		 * that it wants to signal an error. Thus, continue to invoke
+		 * the remaining LSMs.
+		 */
+		if (ret == -EOPNOTSUPP)
+			continue;
+
+		/* LSM should fill new_xattrs if it returns zero. */
+		if (old_num_filled_xattrs == num_filled_xattrs) {
+			WARN_ONCE(1, "LSM %s: returned zero but didn't fill any slot\n",
+				  P->lsm);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		/*
+		 * For filled xattr slots, name and value must be non-NULL.
+		 *
+		 * NULL value is interpreted by filesystems as a remove op, see
+		 * ext4_xattr_set_handle() for more details.
+		 */
+		for (i = old_num_filled_xattrs; i < num_filled_xattrs; i++) {
+			if (!new_xattrs[i].name || !new_xattrs[i].value) {
+				WARN_ONCE(1, "LSM %s: NULL xattr name and/or value\n",
+					  P->lsm);
+				ret = -EINVAL;
+				goto out;
+			}
+		}
+	}
+
+	if (!num_filled_xattrs)
 		goto out;
 
-	evm_xattr = lsm_xattr + 1;
-	ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
+	ret = evm_inode_init_security(inode, new_xattrs,
+				      new_xattrs + num_filled_xattrs);
 	if (ret)
 		goto out;
 	ret = initxattrs(inode, new_xattrs, fs_data);
 out:
 	for (xattr = new_xattrs; xattr->value != NULL; xattr++)
 		kfree(xattr->value);
+	kfree(new_xattrs);
 	return (ret == -EOPNOTSUPP) ? 0 : ret;
 }
 EXPORT_SYMBOL(security_inode_init_security);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9a5bdfc2131..dc349cf34e8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -104,6 +104,8 @@
 #include "audit.h"
 #include "avc_ss.h"
 
+#define SELINUX_INODE_INIT_XATTRS 1
+
 struct selinux_state selinux_state;
 
 /* SECMARK reference count */
@@ -2868,11 +2870,12 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
 
 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
 				       const struct qstr *qstr,
-				       const char **name,
-				       void **value, size_t *len)
+				       struct xattr *xattrs,
+				       int *num_filled_xattrs)
 {
 	const struct task_security_struct *tsec = selinux_cred(current_cred());
 	struct superblock_security_struct *sbsec;
+	struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
 	u32 newsid, clen;
 	int rc;
 	char *context;
@@ -2899,16 +2902,14 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
 	    !(sbsec->flags & SBLABEL_MNT))
 		return -EOPNOTSUPP;
 
-	if (name)
-		*name = XATTR_SELINUX_SUFFIX;
-
-	if (value && len) {
+	if (xattr) {
 		rc = security_sid_to_context_force(&selinux_state, newsid,
 						   &context, &clen);
 		if (rc)
 			return rc;
-		*value = context;
-		*len = clen;
+		xattr->value = context;
+		xattr->value_len = clen;
+		xattr->name = XATTR_SELINUX_SUFFIX;
 	}
 
 	return 0;
@@ -6918,6 +6919,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
 	.lbs_ipc = sizeof(struct ipc_security_struct),
 	.lbs_msg_msg = sizeof(struct msg_security_struct),
 	.lbs_superblock = sizeof(struct superblock_security_struct),
+	.lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
 };
 
 #ifdef CONFIG_PERF_EVENTS
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index cfcbb748da2..ba10f4e8632 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -52,6 +52,15 @@
 #define SMK_RECEIVING	1
 #define SMK_SENDING	2
 
+/*
+ * Smack uses multiple xattrs.
+ * SMACK64 - for access control, SMACK64EXEC - label for the program,
+ * SMACK64MMAP - controls library loading,
+ * SMACK64TRANSMUTE - label initialization,
+ * Not saved on files - SMACK64IPIN and SMACK64IPOUT
+ */
+#define SMACK_INODE_INIT_XATTRS 4
+
 #ifdef SMACK_IPV6_PORT_LABELING
 static DEFINE_MUTEX(smack_ipv6_lock);
 static LIST_HEAD(smk_ipv6_port_list);
@@ -939,26 +948,24 @@ static int smack_inode_alloc_security(struct inode *inode)
  * @inode: the newly created inode
  * @dir: containing directory object
  * @qstr: unused
- * @name: where to put the attribute name
- * @value: where to put the attribute value
- * @len: where to put the length of the attribute
+ * @xattrs: where to put the attributes
+ * @num_filled_xattrs: current number of filled xattrs (updated)
  *
  * Returns 0 if it all works out, -ENOMEM if there's no memory
  */
 static int smack_inode_init_security(struct inode *inode, struct inode *dir,
-				     const struct qstr *qstr, const char **name,
-				     void **value, size_t *len)
+				     const struct qstr *qstr,
+				     struct xattr *xattrs,
+				     int *num_filled_xattrs)
 {
 	struct inode_smack *issp = smack_inode(inode);
 	struct smack_known *skp = smk_of_current();
 	struct smack_known *isp = smk_of_inode(inode);
 	struct smack_known *dsp = smk_of_inode(dir);
+	struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
 	int may;
 
-	if (name)
-		*name = XATTR_SMACK_SUFFIX;
-
-	if (value && len) {
+	if (xattr) {
 		rcu_read_lock();
 		may = smk_access_entry(skp->smk_known, dsp->smk_known,
 				       &skp->smk_rules);
@@ -976,11 +983,12 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
 			issp->smk_flags |= SMK_INODE_CHANGED;
 		}
 
-		*value = kstrdup(isp->smk_known, GFP_NOFS);
-		if (*value == NULL)
+		xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
+		if (xattr->value == NULL)
 			return -ENOMEM;
 
-		*len = strlen(isp->smk_known);
+		xattr->value_len = strlen(isp->smk_known);
+		xattr->name = XATTR_SMACK_SUFFIX;
 	}
 
 	return 0;
@@ -4854,6 +4862,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
 	.lbs_ipc = sizeof(struct smack_known *),
 	.lbs_msg_msg = sizeof(struct smack_known *),
 	.lbs_superblock = sizeof(struct superblock_smack),
+	.lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
 };
 
 static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
  2023-03-29 13:04 [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
  2023-03-29 13:04 ` [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write() Roberto Sassu
  2023-03-29 13:04 ` [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
@ 2023-03-29 13:04 ` Roberto Sassu
  2023-03-30 22:55   ` Paul Moore
  2023-03-29 13:04 ` [PATCH v9 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu
  3 siblings, 1 reply; 14+ messages in thread
From: Roberto Sassu @ 2023-03-29 13:04 UTC (permalink / raw)
  To: zohar, dmitry.kasatkin, paul, jmorris, serge,
	stephen.smalley.work, eparis, casey
  Cc: reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

From: Roberto Sassu <roberto.sassu@huawei.com>

Change the evm_inode_init_security() definition to align with the LSM
infrastructure. Keep the existing behavior of including in the HMAC
calculation only the first xattr provided by LSMs.

Changing the evm_inode_init_security() definition requires passing the
xattr array allocated by security_inode_init_security(), and the number of
xattrs filled by previously invoked LSMs.

Use the newly introduced lsm_find_xattr_slot() to position EVM correctly in
the xattrs array, like a regular LSM, and to increment the number of filled
slots. For now, the LSM infrastructure allocates enough xattrs slots to
store the EVM xattr, without using the reservation mechanism.

Finally, make evm_inode_init_security() return value compatible with the
inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
setting an xattr.

EVM is a bit tricky, because xattrs is both an input and an output. If it
was just output, EVM should have returned zero if xattrs is NULL. But,
since xattrs is also input, EVM is unable to do its calculations, so return
-EOPNOTSUPP and handle this error in security_inode_init_security().

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 include/linux/evm.h               | 14 ++++++++------
 security/integrity/evm/evm_main.c | 18 +++++++++++-------
 security/security.c               |  6 +++---
 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/include/linux/evm.h b/include/linux/evm.h
index 7dc1ee74169..3c0e8591b69 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
 {
 	return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
 }
-extern int evm_inode_init_security(struct inode *inode,
-				   const struct xattr *xattr_array,
-				   struct xattr *evm);
+extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
+				   const struct qstr *qstr,
+				   struct xattr *xattrs,
+				   int *num_filled_xattrs);
 extern bool evm_revalidate_status(const char *xattr_name);
 extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
 extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
@@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
 	return;
 }
 
-static inline int evm_inode_init_security(struct inode *inode,
-					  const struct xattr *xattr_array,
-					  struct xattr *evm)
+static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
+					  const struct qstr *qstr,
+					  struct xattr *xattrs,
+					  int *num_filled_xattrs)
 {
 	return 0;
 }
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index cf24c525558..9e75759150c 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -21,6 +21,7 @@
 #include <linux/evm.h>
 #include <linux/magic.h>
 #include <linux/posix_acl_xattr.h>
+#include <linux/lsm_hooks.h>
 
 #include <crypto/hash.h>
 #include <crypto/hash_info.h>
@@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
 /*
  * evm_inode_init_security - initializes security.evm HMAC value
  */
-int evm_inode_init_security(struct inode *inode,
-				 const struct xattr *lsm_xattr,
-				 struct xattr *evm_xattr)
+int evm_inode_init_security(struct inode *inode, struct inode *dir,
+			    const struct qstr *qstr, struct xattr *xattrs,
+			    int *num_filled_xattrs)
 {
 	struct evm_xattr *xattr_data;
+	struct xattr *evm_xattr;
 	int rc;
 
-	if (!(evm_initialized & EVM_INIT_HMAC) ||
-	    !evm_protected_xattr(lsm_xattr->name))
-		return 0;
+	if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
+	    !evm_protected_xattr(xattrs->name))
+		return -EOPNOTSUPP;
+
+	evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
 
 	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
 	if (!xattr_data)
 		return -ENOMEM;
 
 	xattr_data->data.type = EVM_XATTR_HMAC;
-	rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
+	rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
 	if (rc < 0)
 		goto out;
 
diff --git a/security/security.c b/security/security.c
index be33d643a81..22ab4fb7ebf 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1674,9 +1674,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
 	if (!num_filled_xattrs)
 		goto out;
 
-	ret = evm_inode_init_security(inode, new_xattrs,
-				      new_xattrs + num_filled_xattrs);
-	if (ret)
+	ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
+				      &num_filled_xattrs);
+	if (ret && ret != -EOPNOTSUPP)
 		goto out;
 	ret = initxattrs(inode, new_xattrs, fs_data);
 out:
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH v9 4/4] evm: Support multiple LSMs providing an xattr
  2023-03-29 13:04 [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
                   ` (2 preceding siblings ...)
  2023-03-29 13:04 ` [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
@ 2023-03-29 13:04 ` Roberto Sassu
  3 siblings, 0 replies; 14+ messages in thread
From: Roberto Sassu @ 2023-03-29 13:04 UTC (permalink / raw)
  To: zohar, dmitry.kasatkin, paul, jmorris, serge,
	stephen.smalley.work, eparis, casey
  Cc: reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

From: Roberto Sassu <roberto.sassu@huawei.com>

Currently, evm_inode_init_security() processes a single LSM xattr from the
array passed by security_inode_init_security(), and calculates the HMAC on
it and other inode metadata.

As the LSM infrastructure now can pass to EVM an array with multiple
xattrs, scan them until the terminator (xattr name NULL), and calculate the
HMAC on all of them.

Also, double check that the xattrs array terminator is the first non-filled
slot (obtained with lsm_find_xattr_slot()). Consumers of the xattrs array,
such as the initxattrs() callbacks, rely on the terminator.

Finally, change the name of the lsm_xattr parameter of evm_init_hmac() to
xattrs, to reflect the new type of information passed.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 security/integrity/evm/evm.h        |  4 +++-
 security/integrity/evm/evm_crypto.c | 11 +++++++++--
 security/integrity/evm/evm_main.c   | 29 +++++++++++++++++++++++++----
 3 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f8b8c5004fc..53bd7fec93f 100644
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -46,6 +46,8 @@ struct evm_digest {
 	char digest[IMA_MAX_DIGEST_SIZE];
 } __packed;
 
+int evm_protected_xattr(const char *req_xattr_name);
+
 int evm_init_key(void);
 int evm_update_evmxattr(struct dentry *dentry,
 			const char *req_xattr_name,
@@ -58,7 +60,7 @@ int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name,
 		  const char *req_xattr_value,
 		  size_t req_xattr_value_len, char type,
 		  struct evm_digest *data);
-int evm_init_hmac(struct inode *inode, const struct xattr *xattr,
+int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
 		  char *hmac_val);
 int evm_init_secfs(void);
 
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 033804f5a5f..0fdd382b58e 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -385,10 +385,11 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
 	return rc;
 }
 
-int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
+int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
 		  char *hmac_val)
 {
 	struct shash_desc *desc;
+	const struct xattr *xattr;
 
 	desc = init_desc(EVM_XATTR_HMAC, HASH_ALGO_SHA1);
 	if (IS_ERR(desc)) {
@@ -396,7 +397,13 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
 		return PTR_ERR(desc);
 	}
 
-	crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len);
+	for (xattr = xattrs; xattr->name != NULL; xattr++) {
+		if (!evm_protected_xattr(xattr->name))
+			continue;
+
+		crypto_shash_update(desc, xattr->value, xattr->value_len);
+	}
+
 	hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val);
 	kfree(desc);
 	return 0;
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 9e75759150c..6cbd739cf84 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -306,7 +306,7 @@ static int evm_protected_xattr_common(const char *req_xattr_name,
 	return found;
 }
 
-static int evm_protected_xattr(const char *req_xattr_name)
+int evm_protected_xattr(const char *req_xattr_name)
 {
 	return evm_protected_xattr_common(req_xattr_name, false);
 }
@@ -870,14 +870,35 @@ int evm_inode_init_security(struct inode *inode, struct inode *dir,
 			    int *num_filled_xattrs)
 {
 	struct evm_xattr *xattr_data;
-	struct xattr *evm_xattr;
+	struct xattr *xattr, *evm_xattr;
+	bool evm_protected_xattrs = false;
 	int rc;
 
-	if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
-	    !evm_protected_xattr(xattrs->name))
+	if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs)
+		return -EOPNOTSUPP;
+
+	/*
+	 * security_inode_init_security() makes sure that the xattrs array is
+	 * contiguous, there is enough space for security.evm, and that there is
+	 * a terminator at the end of the array.
+	 */
+	for (xattr = xattrs; xattr->name != NULL; xattr++) {
+		if (evm_protected_xattr(xattr->name))
+			evm_protected_xattrs = true;
+	}
+
+	/* EVM xattr not needed. */
+	if (!evm_protected_xattrs)
 		return -EOPNOTSUPP;
 
 	evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
+	/*
+	 * Array terminator (xattr name = NULL) must be the first non-filled
+	 * xattr slot.
+	 */
+	WARN_ONCE(evm_xattr != xattr,
+		  "%s: xattrs terminator is not the first non-filled slot\n",
+		  __func__);
 
 	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
 	if (!xattr_data)
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write()
  2023-03-29 13:04 ` [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write() Roberto Sassu
@ 2023-03-30 21:15   ` Paul Moore
  2023-03-31  7:02     ` Roberto Sassu
  0 siblings, 1 reply; 14+ messages in thread
From: Paul Moore @ 2023-03-30 21:15 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu, stable

On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Reiserfs sets a security xattr at inode creation time in two stages: first,
> it calls reiserfs_security_init() to obtain the xattr from active LSMs;
> then, it calls reiserfs_security_write() to actually write that xattr.
>
> Unfortunately, it seems there is a wrong expectation that LSMs provide the
> full xattr name in the form 'security.<suffix>'. However, LSMs always
> provided just the suffix, causing reiserfs to not write the xattr at all
> (if the suffix is shorter than the prefix), or to write an xattr with the
> wrong name.
>
> Add a temporary buffer in reiserfs_security_write(), and write to it the
> full xattr name, before passing it to reiserfs_xattr_set_handle().
>
> Since the 'security.' prefix is always prepended, remove the name length
> check.
>
> Cc: stable@vger.kernel.org # v2.6.x
> Fixes: 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  fs/reiserfs/xattr_security.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
> index 6bffdf9a4fd..b0c354ab113 100644
> --- a/fs/reiserfs/xattr_security.c
> +++ b/fs/reiserfs/xattr_security.c
> @@ -95,11 +95,13 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
>                             struct inode *inode,
>                             struct reiserfs_security_handle *sec)
>  {
> +       char xattr_name[XATTR_NAME_MAX + 1];
>         int error;
> -       if (strlen(sec->name) < sizeof(XATTR_SECURITY_PREFIX))
> -               return -EINVAL;

If one really wanted to be paranoid they could verify that
'XATTR_SECURITY_PREFIX_LEN + strlen(sec->name) <= XATTR_NAME_MAX' and
return EINVAL, but that really shouldn't be an issue and if the
concatenation does result in a xattr name that is too big, the
snprintf() will safely truncate/managle it.

Regardless, this patch is fine with me, but it would be nice if at
least of the reiserfs/VFS folks could provide an ACK/Reviewed-by tag,
although I think we can still move forward on this without one of
those.

> -       error = reiserfs_xattr_set_handle(th, inode, sec->name, sec->value,
> +       snprintf(xattr_name, sizeof(xattr_name), "%s%s", XATTR_SECURITY_PREFIX,
> +                sec->name);
> +
> +       error = reiserfs_xattr_set_handle(th, inode, xattr_name, sec->value,
>                                           sec->length, XATTR_CREATE);
>         if (error == -ENODATA || error == -EOPNOTSUPP)
>                 error = 0;
> --
> 2.25.1

-- 
paul-moore.com

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
  2023-03-29 13:04 ` [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
@ 2023-03-30 22:50   ` Paul Moore
  2023-03-30 23:05     ` Casey Schaufler
  2023-03-31  7:17     ` Roberto Sassu
  0 siblings, 2 replies; 14+ messages in thread
From: Paul Moore @ 2023-03-30 22:50 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
>
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Currently, security_inode_init_security() supports only one LSM providing
> an xattr and EVM calculating the HMAC on that xattr, plus other inode
> metadata.
>
> Allow all LSMs to provide one or multiple xattrs, by extending the security
> blob reservation mechanism. Introduce the new lbs_xattr_count field of the
> lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
> needs, and the LSM infrastructure knows how many xattr slots it should
> allocate.
>
> Dynamically allocate the new_xattrs array to be populated by LSMs with the
> inode_init_security hook, and pass it to the latter instead of the
> name/value/len triple.
>
> Also, pass to the hook the number of xattrs filled by each LSM, so that
> there are no gaps when the next LSM fills the array. Gaps might occur
> because an LSM can legitimately request xattrs to the LSM infrastructure,
> but not fill the reserved slots, if it was not initialized.
>
> Update the documentation of security_inode_init_security() to reflect the
> changes, and fix the description of the xattr name, as it is not allocated
> anymore.
>
> On the security_inode_init_security() side, ensure that if LSMs returned
> zero from the hook, they correctly filled a new_xattrs slot. Consequently,
> change the default return value of the hook to -EOPNOTSUPP, so that BPF LSM
> returns that, and does not cause security_inode_init_security() to fail.
>
> Finally, adapt both SELinux and Smack to use the new definition of the
> inode_init_security hook, and to fill the reserved slots in the xattr
> array. Introduce the lsm_find_xattr_slot() helper to retrieve an available
> slot to fill, and to increment the number of filled slots.
>
> Move the xattr->name assignment after the xattr->value one, so that it is
> done only in case of successful memory allocation. For Smack, also reserve
> space for the other defined xattrs although they are not set yet in
> smack_inode_init_security().
>
> Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
> Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  include/linux/lsm_hook_defs.h |  6 +--
>  include/linux/lsm_hooks.h     | 14 ++++++
>  security/security.c           | 92 +++++++++++++++++++++++++++--------
>  security/selinux/hooks.c      | 18 ++++---
>  security/smack/smack_lsm.c    | 33 ++++++++-----
>  5 files changed, 120 insertions(+), 43 deletions(-)
>
> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> index 6bb55e61e8e..1fd95db0087 100644
> --- a/include/linux/lsm_hook_defs.h
> +++ b/include/linux/lsm_hook_defs.h
> @@ -111,9 +111,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
>          unsigned int obj_type)
>  LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
>  LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
> -LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
> -        struct inode *dir, const struct qstr *qstr, const char **name,
> -        void **value, size_t *len)
> +LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
> +        struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,
> +        int *num_filled_xattrs)
>  LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
>          const struct qstr *name, const struct inode *context_inode)
>  LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index c2be66c669a..b60de5f2f34 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -28,6 +28,7 @@
>  #include <linux/security.h>
>  #include <linux/init.h>
>  #include <linux/rculist.h>
> +#include <linux/xattr.h>
>
>  union security_list_options {
>         #define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
> @@ -63,8 +64,21 @@ struct lsm_blob_sizes {
>         int     lbs_ipc;
>         int     lbs_msg_msg;
>         int     lbs_task;
> +       int     lbs_xattr_count; /* number of xattr slots in new_xattrs array */
>  };
>
> +/*
> + * Retrieve the first available slot to fill with an xattr, and increment
> + * the number of filled slots.
> + */
> +static inline struct xattr *lsm_find_xattr_slot(struct xattr *xattrs,
> +                                               int *num_filled_xattrs)
> +{
> +       if (unlikely(!xattrs))
> +               return NULL;
> +       return xattrs + (*num_filled_xattrs)++;
> +}

Since this function increments the @num_filled_xattrs parameter in
addition to returning the next available xattr array slot, let's
replace the "find" with "get" so there is some hint that the state is
changing, i.e. the count is being bumped (similar to the "get" and
"put" concept).

It would also be nice if you could use the kdoc style for the function
comment block; if nothing else it is a known format and consistent
documentation is good, even if it never makes it out of the source
file.

>  /*
>   * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
>   * LSM hooks (in include/linux/lsm_hook_defs.h).
> diff --git a/security/security.c b/security/security.c
> index f4170efcddd..be33d643a81 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -31,8 +31,6 @@
>  #include <linux/msg.h>
>  #include <net/flow.h>
>
> -#define MAX_LSM_EVM_XATTR      2
> -
>  /* How many LSMs were built into the kernel? */
>  #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
>
> @@ -212,6 +210,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
>         lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
>         lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
>         lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
> +       lsm_set_blob_size(&needed->lbs_xattr_count,
> +                         &blob_sizes.lbs_xattr_count);
>  }
>
>  /* Prepare LSM for initialization. */
> @@ -378,6 +378,7 @@ static void __init ordered_lsm_init(void)
>         init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
>         init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
>         init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
> +       init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
>
>         /*
>          * Create any kmem_caches needed for blobs
> @@ -1591,11 +1592,15 @@ EXPORT_SYMBOL(security_dentry_create_files_as);
>   * created inode and set up the incore security field for the new inode.  This
>   * hook is called by the fs code as part of the inode creation transaction and
>   * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
> - * hooks called by the VFS.  The hook function is expected to allocate the name
> - * and value via kmalloc, with the caller being responsible for calling kfree
> - * after using them.  If the security module does not use security attributes
> - * or does not wish to put a security attribute on this particular inode, then
> - * it should return -EOPNOTSUPP to skip this processing.
> + * hooks called by the VFS.  The hook function is expected to populate the
> + * @xattrs array, by calling lsm_find_xattr_slot() to retrieve the slots
> + * reserved by the security module with the lbs_xattr_count field of the
> + * lsm_blob_sizes structure.  For each slot, the hook function should set ->name
> + * to the attribute name suffix (e.g. selinux), to allocate ->value (will be
> + * freed by the caller) and set it to the attribute value, to set ->value_len to
> + * the length of the value.  If the security module does not use security
> + * attributes or does not wish to put a security attribute on this particular
> + * inode, then it should return -EOPNOTSUPP to skip this processing.
>   *
>   * Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
>   * needed, or -ENOMEM on memory allocation failure.
> @@ -1604,33 +1609,80 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
>                                  const struct qstr *qstr,
>                                  const initxattrs initxattrs, void *fs_data)
>  {
> -       struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
> -       struct xattr *lsm_xattr, *evm_xattr, *xattr;
> -       int ret;
> +       struct security_hook_list *P;
> +       struct xattr *new_xattrs;
> +       struct xattr *xattr;
> +       int num_filled_xattrs = 0, old_num_filled_xattrs;

I think you can get rid of @old_num_filled_xattrs (see below), but how
about changing @num_filled_xattrs to @xattr_count, it's shorter and
just as accurate.

> +       int ret = -EOPNOTSUPP, i;
>
>         if (unlikely(IS_PRIVATE(inode)))
>                 return 0;
>
> +       if (!blob_sizes.lbs_xattr_count)
> +               return 0;
> +
>         if (!initxattrs)
>                 return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
> -                                    dir, qstr, NULL, NULL, NULL);

I would have expected the !initxattrs case to still be handled in the
hook loop below, is there a reason why we don't want to do that?  If
including it in the loop below is too much of a hassle (conditional
array allocation, etc.), should we at least put it in it's own loop?
It seems wrong that we wouldn't run through all of the LSM hooks in
this case ...

> -       memset(new_xattrs, 0, sizeof(new_xattrs));
> -       lsm_xattr = new_xattrs;
> -       ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
> -                           &lsm_xattr->name,
> -                           &lsm_xattr->value,
> -                           &lsm_xattr->value_len);
> -       if (ret)
> +                                   dir, qstr, NULL, NULL);
> +       /* Allocate +1 for EVM and +1 as terminator. */
> +       new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
> +                            sizeof(*new_xattrs), GFP_NOFS);
> +       if (!new_xattrs)
> +               return -ENOMEM;
> +
> +       hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
> +                            list) {
> +               old_num_filled_xattrs = num_filled_xattrs;
> +
> +               ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs,
> +                                                 &num_filled_xattrs);
> +               if (ret && ret != -EOPNOTSUPP)
> +                       goto out;
> +               /*
> +                * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
> +                * means that the LSM is not willing to provide an xattr, not
> +                * that it wants to signal an error. Thus, continue to invoke
> +                * the remaining LSMs.
> +                */
> +               if (ret == -EOPNOTSUPP)
> +                       continue;
> +
> +               /* LSM should fill new_xattrs if it returns zero. */
> +               if (old_num_filled_xattrs == num_filled_xattrs) {
> +                       WARN_ONCE(1, "LSM %s: returned zero but didn't fill any slot\n",
> +                                 P->lsm);
> +                       ret = -EINVAL;
> +                       goto out;
> +               }

Do we really need this check?  We don't currently check that LSMs
setup their xattrs properly and we are doing okay.

> +               /*
> +                * For filled xattr slots, name and value must be non-NULL.
> +                *
> +                * NULL value is interpreted by filesystems as a remove op, see
> +                * ext4_xattr_set_handle() for more details.
> +                */
> +               for (i = old_num_filled_xattrs; i < num_filled_xattrs; i++) {
> +                       if (!new_xattrs[i].name || !new_xattrs[i].value) {
> +                               WARN_ONCE(1, "LSM %s: NULL xattr name and/or value\n",
> +                                         P->lsm);
> +                               ret = -EINVAL;
> +                               goto out;
> +                       }
> +               }

Same here.  I worry this is extra processing with little benefit.  The
LSM updates the xattr count and we should trust it is correct.

> +       }
> +
> +       if (!num_filled_xattrs)
>                 goto out;
>
> -       evm_xattr = lsm_xattr + 1;
> -       ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
> +       ret = evm_inode_init_security(inode, new_xattrs,
> +                                     new_xattrs + num_filled_xattrs);
>         if (ret)
>                 goto out;
>         ret = initxattrs(inode, new_xattrs, fs_data);
>  out:
>         for (xattr = new_xattrs; xattr->value != NULL; xattr++)
>                 kfree(xattr->value);

We can probably drop the need for the @xattr variable by using @xattr_count.

  for (; xattr_count > 0; xattr_count--)
    kfree(new_xattrs[xattr_count - 1]->value);

> +       kfree(new_xattrs);
>         return (ret == -EOPNOTSUPP) ? 0 : ret;
>  }
>  EXPORT_SYMBOL(security_inode_init_security);
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 9a5bdfc2131..dc349cf34e8 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -104,6 +104,8 @@
>  #include "audit.h"
>  #include "avc_ss.h"
>
> +#define SELINUX_INODE_INIT_XATTRS 1
> +
>  struct selinux_state selinux_state;
>
>  /* SECMARK reference count */
> @@ -2868,11 +2870,12 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
>
>  static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>                                        const struct qstr *qstr,
> -                                      const char **name,
> -                                      void **value, size_t *len)
> +                                      struct xattr *xattrs,
> +                                      int *num_filled_xattrs)

Use 'xattr_count'.

>  {
>         const struct task_security_struct *tsec = selinux_cred(current_cred());
>         struct superblock_security_struct *sbsec;
> +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
>         u32 newsid, clen;
>         int rc;
>         char *context;
> @@ -2899,16 +2902,14 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>             !(sbsec->flags & SBLABEL_MNT))
>                 return -EOPNOTSUPP;
>
> -       if (name)
> -               *name = XATTR_SELINUX_SUFFIX;
> -
> -       if (value && len) {
> +       if (xattr) {
>                 rc = security_sid_to_context_force(&selinux_state, newsid,
>                                                    &context, &clen);
>                 if (rc)
>                         return rc;
> -               *value = context;
> -               *len = clen;
> +               xattr->value = context;
> +               xattr->value_len = clen;
> +               xattr->name = XATTR_SELINUX_SUFFIX;
>         }
>
>         return 0;
> @@ -6918,6 +6919,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
>         .lbs_ipc = sizeof(struct ipc_security_struct),
>         .lbs_msg_msg = sizeof(struct msg_security_struct),
>         .lbs_superblock = sizeof(struct superblock_security_struct),
> +       .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
>  };
>
>  #ifdef CONFIG_PERF_EVENTS
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index cfcbb748da2..ba10f4e8632 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -52,6 +52,15 @@
>  #define SMK_RECEIVING  1
>  #define SMK_SENDING    2
>
> +/*
> + * Smack uses multiple xattrs.
> + * SMACK64 - for access control, SMACK64EXEC - label for the program,
> + * SMACK64MMAP - controls library loading,
> + * SMACK64TRANSMUTE - label initialization,
> + * Not saved on files - SMACK64IPIN and SMACK64IPOUT
> + */
> +#define SMACK_INODE_INIT_XATTRS 4
> +
>  #ifdef SMACK_IPV6_PORT_LABELING
>  static DEFINE_MUTEX(smack_ipv6_lock);
>  static LIST_HEAD(smk_ipv6_port_list);
> @@ -939,26 +948,24 @@ static int smack_inode_alloc_security(struct inode *inode)
>   * @inode: the newly created inode
>   * @dir: containing directory object
>   * @qstr: unused
> - * @name: where to put the attribute name
> - * @value: where to put the attribute value
> - * @len: where to put the length of the attribute
> + * @xattrs: where to put the attributes
> + * @num_filled_xattrs: current number of filled xattrs (updated)
>   *
>   * Returns 0 if it all works out, -ENOMEM if there's no memory
>   */
>  static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> -                                    const struct qstr *qstr, const char **name,
> -                                    void **value, size_t *len)
> +                                    const struct qstr *qstr,
> +                                    struct xattr *xattrs,
> +                                    int *num_filled_xattrs)

I'll leave this up to Casey, but 'xattr_count' would be my vote :)

>  {
>         struct inode_smack *issp = smack_inode(inode);
>         struct smack_known *skp = smk_of_current();
>         struct smack_known *isp = smk_of_inode(inode);
>         struct smack_known *dsp = smk_of_inode(dir);
> +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
>         int may;
>
> -       if (name)
> -               *name = XATTR_SMACK_SUFFIX;
> -
> -       if (value && len) {
> +       if (xattr) {
>                 rcu_read_lock();
>                 may = smk_access_entry(skp->smk_known, dsp->smk_known,
>                                        &skp->smk_rules);
> @@ -976,11 +983,12 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>                         issp->smk_flags |= SMK_INODE_CHANGED;
>                 }
>
> -               *value = kstrdup(isp->smk_known, GFP_NOFS);
> -               if (*value == NULL)
> +               xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
> +               if (xattr->value == NULL)
>                         return -ENOMEM;
>
> -               *len = strlen(isp->smk_known);
> +               xattr->value_len = strlen(isp->smk_known);
> +               xattr->name = XATTR_SMACK_SUFFIX;
>         }
>
>         return 0;
> @@ -4854,6 +4862,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
>         .lbs_ipc = sizeof(struct smack_known *),
>         .lbs_msg_msg = sizeof(struct smack_known *),
>         .lbs_superblock = sizeof(struct superblock_smack),
> +       .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
>  };
>
>  static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
> --
> 2.25.1

-- 
paul-moore.com

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
  2023-03-29 13:04 ` [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
@ 2023-03-30 22:55   ` Paul Moore
  2023-03-31  7:32     ` Roberto Sassu
  0 siblings, 1 reply; 14+ messages in thread
From: Paul Moore @ 2023-03-30 22:55 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
>
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Change the evm_inode_init_security() definition to align with the LSM
> infrastructure. Keep the existing behavior of including in the HMAC
> calculation only the first xattr provided by LSMs.
>
> Changing the evm_inode_init_security() definition requires passing the
> xattr array allocated by security_inode_init_security(), and the number of
> xattrs filled by previously invoked LSMs.
>
> Use the newly introduced lsm_find_xattr_slot() to position EVM correctly in
> the xattrs array, like a regular LSM, and to increment the number of filled
> slots. For now, the LSM infrastructure allocates enough xattrs slots to
> store the EVM xattr, without using the reservation mechanism.
>
> Finally, make evm_inode_init_security() return value compatible with the
> inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
> setting an xattr.
>
> EVM is a bit tricky, because xattrs is both an input and an output. If it
> was just output, EVM should have returned zero if xattrs is NULL. But,
> since xattrs is also input, EVM is unable to do its calculations, so return
> -EOPNOTSUPP and handle this error in security_inode_init_security().

I don't quite understand why EVM would return EOPNOTSUPP if it is
enabled but there are not xattrs to measure.  It seems like EVM should
return success/0 in the no-xattr case; there were no xattrs to
measure, so it succeeded in measuring nothing.  Am I missing
something?

> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  include/linux/evm.h               | 14 ++++++++------
>  security/integrity/evm/evm_main.c | 18 +++++++++++-------
>  security/security.c               |  6 +++---
>  3 files changed, 22 insertions(+), 16 deletions(-)
>
> diff --git a/include/linux/evm.h b/include/linux/evm.h
> index 7dc1ee74169..3c0e8591b69 100644
> --- a/include/linux/evm.h
> +++ b/include/linux/evm.h
> @@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
>  {
>         return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
>  }
> -extern int evm_inode_init_security(struct inode *inode,
> -                                  const struct xattr *xattr_array,
> -                                  struct xattr *evm);
> +extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
> +                                  const struct qstr *qstr,
> +                                  struct xattr *xattrs,
> +                                  int *num_filled_xattrs);
>  extern bool evm_revalidate_status(const char *xattr_name);
>  extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
>  extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
> @@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
>         return;
>  }
>
> -static inline int evm_inode_init_security(struct inode *inode,
> -                                         const struct xattr *xattr_array,
> -                                         struct xattr *evm)
> +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
> +                                         const struct qstr *qstr,
> +                                         struct xattr *xattrs,
> +                                         int *num_filled_xattrs)
>  {
>         return 0;
>  }
> diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> index cf24c525558..9e75759150c 100644
> --- a/security/integrity/evm/evm_main.c
> +++ b/security/integrity/evm/evm_main.c
> @@ -21,6 +21,7 @@
>  #include <linux/evm.h>
>  #include <linux/magic.h>
>  #include <linux/posix_acl_xattr.h>
> +#include <linux/lsm_hooks.h>
>
>  #include <crypto/hash.h>
>  #include <crypto/hash_info.h>
> @@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
>  /*
>   * evm_inode_init_security - initializes security.evm HMAC value
>   */
> -int evm_inode_init_security(struct inode *inode,
> -                                const struct xattr *lsm_xattr,
> -                                struct xattr *evm_xattr)
> +int evm_inode_init_security(struct inode *inode, struct inode *dir,
> +                           const struct qstr *qstr, struct xattr *xattrs,
> +                           int *num_filled_xattrs)
>  {
>         struct evm_xattr *xattr_data;
> +       struct xattr *evm_xattr;
>         int rc;
>
> -       if (!(evm_initialized & EVM_INIT_HMAC) ||
> -           !evm_protected_xattr(lsm_xattr->name))
> -               return 0;
> +       if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
> +           !evm_protected_xattr(xattrs->name))
> +               return -EOPNOTSUPP;
> +
> +       evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
>
>         xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
>         if (!xattr_data)
>                 return -ENOMEM;
>
>         xattr_data->data.type = EVM_XATTR_HMAC;
> -       rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
> +       rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
>         if (rc < 0)
>                 goto out;
>
> diff --git a/security/security.c b/security/security.c
> index be33d643a81..22ab4fb7ebf 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1674,9 +1674,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
>         if (!num_filled_xattrs)
>                 goto out;
>
> -       ret = evm_inode_init_security(inode, new_xattrs,
> -                                     new_xattrs + num_filled_xattrs);
> -       if (ret)
> +       ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
> +                                     &num_filled_xattrs);
> +       if (ret && ret != -EOPNOTSUPP)
>                 goto out;
>         ret = initxattrs(inode, new_xattrs, fs_data);
>  out:
> --
> 2.25.1
>


-- 
paul-moore.com

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
  2023-03-30 22:50   ` Paul Moore
@ 2023-03-30 23:05     ` Casey Schaufler
  2023-03-31  7:17     ` Roberto Sassu
  1 sibling, 0 replies; 14+ messages in thread
From: Casey Schaufler @ 2023-03-30 23:05 UTC (permalink / raw)
  To: Paul Moore, Roberto Sassu
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu, Casey Schaufler

On 3/30/2023 3:50 PM, Paul Moore wrote:
> On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>
>> Currently, security_inode_init_security() supports only one LSM providing
>> an xattr and EVM calculating the HMAC on that xattr, plus other inode
>> metadata.
>>
>> Allow all LSMs to provide one or multiple xattrs, by extending the security
>> blob reservation mechanism. Introduce the new lbs_xattr_count field of the
>> lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
>> needs, and the LSM infrastructure knows how many xattr slots it should
>> allocate.
>>
>> Dynamically allocate the new_xattrs array to be populated by LSMs with the
>> inode_init_security hook, and pass it to the latter instead of the
>> name/value/len triple.
>>
>> Also, pass to the hook the number of xattrs filled by each LSM, so that
>> there are no gaps when the next LSM fills the array. Gaps might occur
>> because an LSM can legitimately request xattrs to the LSM infrastructure,
>> but not fill the reserved slots, if it was not initialized.
>>
>> Update the documentation of security_inode_init_security() to reflect the
>> changes, and fix the description of the xattr name, as it is not allocated
>> anymore.
>>
>> On the security_inode_init_security() side, ensure that if LSMs returned
>> zero from the hook, they correctly filled a new_xattrs slot. Consequently,
>> change the default return value of the hook to -EOPNOTSUPP, so that BPF LSM
>> returns that, and does not cause security_inode_init_security() to fail.
>>
>> Finally, adapt both SELinux and Smack to use the new definition of the
>> inode_init_security hook, and to fill the reserved slots in the xattr
>> array. Introduce the lsm_find_xattr_slot() helper to retrieve an available
>> slot to fill, and to increment the number of filled slots.
>>
>> Move the xattr->name assignment after the xattr->value one, so that it is
>> done only in case of successful memory allocation. For Smack, also reserve
>> space for the other defined xattrs although they are not set yet in
>> smack_inode_init_security().
>>
>> Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
>> Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
>> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
>> ---
>>  include/linux/lsm_hook_defs.h |  6 +--
>>  include/linux/lsm_hooks.h     | 14 ++++++
>>  security/security.c           | 92 +++++++++++++++++++++++++++--------
>>  security/selinux/hooks.c      | 18 ++++---
>>  security/smack/smack_lsm.c    | 33 ++++++++-----
>>  5 files changed, 120 insertions(+), 43 deletions(-)
>>
>> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
>> index 6bb55e61e8e..1fd95db0087 100644
>> --- a/include/linux/lsm_hook_defs.h
>> +++ b/include/linux/lsm_hook_defs.h
>> @@ -111,9 +111,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
>>          unsigned int obj_type)
>>  LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
>>  LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
>> -LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
>> -        struct inode *dir, const struct qstr *qstr, const char **name,
>> -        void **value, size_t *len)
>> +LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
>> +        struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,
>> +        int *num_filled_xattrs)
>>  LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
>>          const struct qstr *name, const struct inode *context_inode)
>>  LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
>> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
>> index c2be66c669a..b60de5f2f34 100644
>> --- a/include/linux/lsm_hooks.h
>> +++ b/include/linux/lsm_hooks.h
>> @@ -28,6 +28,7 @@
>>  #include <linux/security.h>
>>  #include <linux/init.h>
>>  #include <linux/rculist.h>
>> +#include <linux/xattr.h>
>>
>>  union security_list_options {
>>         #define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
>> @@ -63,8 +64,21 @@ struct lsm_blob_sizes {
>>         int     lbs_ipc;
>>         int     lbs_msg_msg;
>>         int     lbs_task;
>> +       int     lbs_xattr_count; /* number of xattr slots in new_xattrs array */
>>  };
>>
>> +/*
>> + * Retrieve the first available slot to fill with an xattr, and increment
>> + * the number of filled slots.
>> + */
>> +static inline struct xattr *lsm_find_xattr_slot(struct xattr *xattrs,
>> +                                               int *num_filled_xattrs)
>> +{
>> +       if (unlikely(!xattrs))
>> +               return NULL;
>> +       return xattrs + (*num_filled_xattrs)++;
>> +}
> Since this function increments the @num_filled_xattrs parameter in
> addition to returning the next available xattr array slot, let's
> replace the "find" with "get" so there is some hint that the state is
> changing, i.e. the count is being bumped (similar to the "get" and
> "put" concept).
>
> It would also be nice if you could use the kdoc style for the function
> comment block; if nothing else it is a known format and consistent
> documentation is good, even if it never makes it out of the source
> file.
>
>>  /*
>>   * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
>>   * LSM hooks (in include/linux/lsm_hook_defs.h).
>> diff --git a/security/security.c b/security/security.c
>> index f4170efcddd..be33d643a81 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> @@ -31,8 +31,6 @@
>>  #include <linux/msg.h>
>>  #include <net/flow.h>
>>
>> -#define MAX_LSM_EVM_XATTR      2
>> -
>>  /* How many LSMs were built into the kernel? */
>>  #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
>>
>> @@ -212,6 +210,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
>>         lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
>>         lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
>>         lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
>> +       lsm_set_blob_size(&needed->lbs_xattr_count,
>> +                         &blob_sizes.lbs_xattr_count);
>>  }
>>
>>  /* Prepare LSM for initialization. */
>> @@ -378,6 +378,7 @@ static void __init ordered_lsm_init(void)
>>         init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
>>         init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
>>         init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
>> +       init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
>>
>>         /*
>>          * Create any kmem_caches needed for blobs
>> @@ -1591,11 +1592,15 @@ EXPORT_SYMBOL(security_dentry_create_files_as);
>>   * created inode and set up the incore security field for the new inode.  This
>>   * hook is called by the fs code as part of the inode creation transaction and
>>   * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
>> - * hooks called by the VFS.  The hook function is expected to allocate the name
>> - * and value via kmalloc, with the caller being responsible for calling kfree
>> - * after using them.  If the security module does not use security attributes
>> - * or does not wish to put a security attribute on this particular inode, then
>> - * it should return -EOPNOTSUPP to skip this processing.
>> + * hooks called by the VFS.  The hook function is expected to populate the
>> + * @xattrs array, by calling lsm_find_xattr_slot() to retrieve the slots
>> + * reserved by the security module with the lbs_xattr_count field of the
>> + * lsm_blob_sizes structure.  For each slot, the hook function should set ->name
>> + * to the attribute name suffix (e.g. selinux), to allocate ->value (will be
>> + * freed by the caller) and set it to the attribute value, to set ->value_len to
>> + * the length of the value.  If the security module does not use security
>> + * attributes or does not wish to put a security attribute on this particular
>> + * inode, then it should return -EOPNOTSUPP to skip this processing.
>>   *
>>   * Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
>>   * needed, or -ENOMEM on memory allocation failure.
>> @@ -1604,33 +1609,80 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
>>                                  const struct qstr *qstr,
>>                                  const initxattrs initxattrs, void *fs_data)
>>  {
>> -       struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
>> -       struct xattr *lsm_xattr, *evm_xattr, *xattr;
>> -       int ret;
>> +       struct security_hook_list *P;
>> +       struct xattr *new_xattrs;
>> +       struct xattr *xattr;
>> +       int num_filled_xattrs = 0, old_num_filled_xattrs;
> I think you can get rid of @old_num_filled_xattrs (see below), but how
> about changing @num_filled_xattrs to @xattr_count, it's shorter and
> just as accurate.
>
>> +       int ret = -EOPNOTSUPP, i;
>>
>>         if (unlikely(IS_PRIVATE(inode)))
>>                 return 0;
>>
>> +       if (!blob_sizes.lbs_xattr_count)
>> +               return 0;
>> +
>>         if (!initxattrs)
>>                 return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
>> -                                    dir, qstr, NULL, NULL, NULL);
> I would have expected the !initxattrs case to still be handled in the
> hook loop below, is there a reason why we don't want to do that?  If
> including it in the loop below is too much of a hassle (conditional
> array allocation, etc.), should we at least put it in it's own loop?
> It seems wrong that we wouldn't run through all of the LSM hooks in
> this case ...
>
>> -       memset(new_xattrs, 0, sizeof(new_xattrs));
>> -       lsm_xattr = new_xattrs;
>> -       ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
>> -                           &lsm_xattr->name,
>> -                           &lsm_xattr->value,
>> -                           &lsm_xattr->value_len);
>> -       if (ret)
>> +                                   dir, qstr, NULL, NULL);
>> +       /* Allocate +1 for EVM and +1 as terminator. */
>> +       new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
>> +                            sizeof(*new_xattrs), GFP_NOFS);
>> +       if (!new_xattrs)
>> +               return -ENOMEM;
>> +
>> +       hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
>> +                            list) {
>> +               old_num_filled_xattrs = num_filled_xattrs;
>> +
>> +               ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs,
>> +                                                 &num_filled_xattrs);
>> +               if (ret && ret != -EOPNOTSUPP)
>> +                       goto out;
>> +               /*
>> +                * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
>> +                * means that the LSM is not willing to provide an xattr, not
>> +                * that it wants to signal an error. Thus, continue to invoke
>> +                * the remaining LSMs.
>> +                */
>> +               if (ret == -EOPNOTSUPP)
>> +                       continue;
>> +
>> +               /* LSM should fill new_xattrs if it returns zero. */
>> +               if (old_num_filled_xattrs == num_filled_xattrs) {
>> +                       WARN_ONCE(1, "LSM %s: returned zero but didn't fill any slot\n",
>> +                                 P->lsm);
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
> Do we really need this check?  We don't currently check that LSMs
> setup their xattrs properly and we are doing okay.
>
>> +               /*
>> +                * For filled xattr slots, name and value must be non-NULL.
>> +                *
>> +                * NULL value is interpreted by filesystems as a remove op, see
>> +                * ext4_xattr_set_handle() for more details.
>> +                */
>> +               for (i = old_num_filled_xattrs; i < num_filled_xattrs; i++) {
>> +                       if (!new_xattrs[i].name || !new_xattrs[i].value) {
>> +                               WARN_ONCE(1, "LSM %s: NULL xattr name and/or value\n",
>> +                                         P->lsm);
>> +                               ret = -EINVAL;
>> +                               goto out;
>> +                       }
>> +               }
> Same here.  I worry this is extra processing with little benefit.  The
> LSM updates the xattr count and we should trust it is correct.
>
>> +       }
>> +
>> +       if (!num_filled_xattrs)
>>                 goto out;
>>
>> -       evm_xattr = lsm_xattr + 1;
>> -       ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
>> +       ret = evm_inode_init_security(inode, new_xattrs,
>> +                                     new_xattrs + num_filled_xattrs);
>>         if (ret)
>>                 goto out;
>>         ret = initxattrs(inode, new_xattrs, fs_data);
>>  out:
>>         for (xattr = new_xattrs; xattr->value != NULL; xattr++)
>>                 kfree(xattr->value);
> We can probably drop the need for the @xattr variable by using @xattr_count.
>
>   for (; xattr_count > 0; xattr_count--)
>     kfree(new_xattrs[xattr_count - 1]->value);
>
>> +       kfree(new_xattrs);
>>         return (ret == -EOPNOTSUPP) ? 0 : ret;
>>  }
>>  EXPORT_SYMBOL(security_inode_init_security);
>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>> index 9a5bdfc2131..dc349cf34e8 100644
>> --- a/security/selinux/hooks.c
>> +++ b/security/selinux/hooks.c
>> @@ -104,6 +104,8 @@
>>  #include "audit.h"
>>  #include "avc_ss.h"
>>
>> +#define SELINUX_INODE_INIT_XATTRS 1
>> +
>>  struct selinux_state selinux_state;
>>
>>  /* SECMARK reference count */
>> @@ -2868,11 +2870,12 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
>>
>>  static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>>                                        const struct qstr *qstr,
>> -                                      const char **name,
>> -                                      void **value, size_t *len)
>> +                                      struct xattr *xattrs,
>> +                                      int *num_filled_xattrs)
> Use 'xattr_count'.
>
>>  {
>>         const struct task_security_struct *tsec = selinux_cred(current_cred());
>>         struct superblock_security_struct *sbsec;
>> +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
>>         u32 newsid, clen;
>>         int rc;
>>         char *context;
>> @@ -2899,16 +2902,14 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>>             !(sbsec->flags & SBLABEL_MNT))
>>                 return -EOPNOTSUPP;
>>
>> -       if (name)
>> -               *name = XATTR_SELINUX_SUFFIX;
>> -
>> -       if (value && len) {
>> +       if (xattr) {
>>                 rc = security_sid_to_context_force(&selinux_state, newsid,
>>                                                    &context, &clen);
>>                 if (rc)
>>                         return rc;
>> -               *value = context;
>> -               *len = clen;
>> +               xattr->value = context;
>> +               xattr->value_len = clen;
>> +               xattr->name = XATTR_SELINUX_SUFFIX;
>>         }
>>
>>         return 0;
>> @@ -6918,6 +6919,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
>>         .lbs_ipc = sizeof(struct ipc_security_struct),
>>         .lbs_msg_msg = sizeof(struct msg_security_struct),
>>         .lbs_superblock = sizeof(struct superblock_security_struct),
>> +       .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
>>  };
>>
>>  #ifdef CONFIG_PERF_EVENTS
>> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
>> index cfcbb748da2..ba10f4e8632 100644
>> --- a/security/smack/smack_lsm.c
>> +++ b/security/smack/smack_lsm.c
>> @@ -52,6 +52,15 @@
>>  #define SMK_RECEIVING  1
>>  #define SMK_SENDING    2
>>
>> +/*
>> + * Smack uses multiple xattrs.
>> + * SMACK64 - for access control, SMACK64EXEC - label for the program,
>> + * SMACK64MMAP - controls library loading,
>> + * SMACK64TRANSMUTE - label initialization,
>> + * Not saved on files - SMACK64IPIN and SMACK64IPOUT
>> + */
>> +#define SMACK_INODE_INIT_XATTRS 4
>> +
>>  #ifdef SMACK_IPV6_PORT_LABELING
>>  static DEFINE_MUTEX(smack_ipv6_lock);
>>  static LIST_HEAD(smk_ipv6_port_list);
>> @@ -939,26 +948,24 @@ static int smack_inode_alloc_security(struct inode *inode)
>>   * @inode: the newly created inode
>>   * @dir: containing directory object
>>   * @qstr: unused
>> - * @name: where to put the attribute name
>> - * @value: where to put the attribute value
>> - * @len: where to put the length of the attribute
>> + * @xattrs: where to put the attributes
>> + * @num_filled_xattrs: current number of filled xattrs (updated)
>>   *
>>   * Returns 0 if it all works out, -ENOMEM if there's no memory
>>   */
>>  static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>> -                                    const struct qstr *qstr, const char **name,
>> -                                    void **value, size_t *len)
>> +                                    const struct qstr *qstr,
>> +                                    struct xattr *xattrs,
>> +                                    int *num_filled_xattrs)
> I'll leave this up to Casey, but 'xattr_count' would be my vote :)

I don't care whether you make the xattr_count change or not. I agree that if
you do change it elsewhere you should change it here, too.

>>  {
>>         struct inode_smack *issp = smack_inode(inode);
>>         struct smack_known *skp = smk_of_current();
>>         struct smack_known *isp = smk_of_inode(inode);
>>         struct smack_known *dsp = smk_of_inode(dir);
>> +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
>>         int may;
>>
>> -       if (name)
>> -               *name = XATTR_SMACK_SUFFIX;
>> -
>> -       if (value && len) {
>> +       if (xattr) {
>>                 rcu_read_lock();
>>                 may = smk_access_entry(skp->smk_known, dsp->smk_known,
>>                                        &skp->smk_rules);
>> @@ -976,11 +983,12 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>>                         issp->smk_flags |= SMK_INODE_CHANGED;
>>                 }
>>
>> -               *value = kstrdup(isp->smk_known, GFP_NOFS);
>> -               if (*value == NULL)
>> +               xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
>> +               if (xattr->value == NULL)
>>                         return -ENOMEM;
>>
>> -               *len = strlen(isp->smk_known);
>> +               xattr->value_len = strlen(isp->smk_known);
>> +               xattr->name = XATTR_SMACK_SUFFIX;
>>         }
>>
>>         return 0;
>> @@ -4854,6 +4862,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
>>         .lbs_ipc = sizeof(struct smack_known *),
>>         .lbs_msg_msg = sizeof(struct smack_known *),
>>         .lbs_superblock = sizeof(struct superblock_smack),
>> +       .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
>>  };
>>
>>  static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
>> --
>> 2.25.1

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write()
  2023-03-30 21:15   ` Paul Moore
@ 2023-03-31  7:02     ` Roberto Sassu
  0 siblings, 0 replies; 14+ messages in thread
From: Roberto Sassu @ 2023-03-31  7:02 UTC (permalink / raw)
  To: Paul Moore
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu, stable

On Thu, 2023-03-30 at 17:15 -0400, Paul Moore wrote:
> On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> > 
> > Reiserfs sets a security xattr at inode creation time in two stages: first,
> > it calls reiserfs_security_init() to obtain the xattr from active LSMs;
> > then, it calls reiserfs_security_write() to actually write that xattr.
> > 
> > Unfortunately, it seems there is a wrong expectation that LSMs provide the
> > full xattr name in the form 'security.<suffix>'. However, LSMs always
> > provided just the suffix, causing reiserfs to not write the xattr at all
> > (if the suffix is shorter than the prefix), or to write an xattr with the
> > wrong name.
> > 
> > Add a temporary buffer in reiserfs_security_write(), and write to it the
> > full xattr name, before passing it to reiserfs_xattr_set_handle().
> > 
> > Since the 'security.' prefix is always prepended, remove the name length
> > check.
> > 
> > Cc: stable@vger.kernel.org # v2.6.x
> > Fixes: 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation")
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >  fs/reiserfs/xattr_security.c | 8 +++++---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> > 
> > diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
> > index 6bffdf9a4fd..b0c354ab113 100644
> > --- a/fs/reiserfs/xattr_security.c
> > +++ b/fs/reiserfs/xattr_security.c
> > @@ -95,11 +95,13 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
> >                             struct inode *inode,
> >                             struct reiserfs_security_handle *sec)
> >  {
> > +       char xattr_name[XATTR_NAME_MAX + 1];
> >         int error;
> > -       if (strlen(sec->name) < sizeof(XATTR_SECURITY_PREFIX))
> > -               return -EINVAL;
> 
> If one really wanted to be paranoid they could verify that
> 'XATTR_SECURITY_PREFIX_LEN + strlen(sec->name) <= XATTR_NAME_MAX' and
> return EINVAL, but that really shouldn't be an issue and if the
> concatenation does result in a xattr name that is too big, the
> snprintf() will safely truncate/managle it.

Ok, I could do it.

Thanks

Roberto

> Regardless, this patch is fine with me, but it would be nice if at
> least of the reiserfs/VFS folks could provide an ACK/Reviewed-by tag,
> although I think we can still move forward on this without one of
> those.
> 
> > -       error = reiserfs_xattr_set_handle(th, inode, sec->name, sec->value,
> > +       snprintf(xattr_name, sizeof(xattr_name), "%s%s", XATTR_SECURITY_PREFIX,
> > +                sec->name);
> > +
> > +       error = reiserfs_xattr_set_handle(th, inode, xattr_name, sec->value,
> >                                           sec->length, XATTR_CREATE);
> >         if (error == -ENODATA || error == -EOPNOTSUPP)
> >                 error = 0;
> > --
> > 2.25.1


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
  2023-03-30 22:50   ` Paul Moore
  2023-03-30 23:05     ` Casey Schaufler
@ 2023-03-31  7:17     ` Roberto Sassu
  1 sibling, 0 replies; 14+ messages in thread
From: Roberto Sassu @ 2023-03-31  7:17 UTC (permalink / raw)
  To: Paul Moore
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Thu, 2023-03-30 at 18:50 -0400, Paul Moore wrote:
> On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> > 
> > Currently, security_inode_init_security() supports only one LSM providing
> > an xattr and EVM calculating the HMAC on that xattr, plus other inode
> > metadata.
> > 
> > Allow all LSMs to provide one or multiple xattrs, by extending the security
> > blob reservation mechanism. Introduce the new lbs_xattr_count field of the
> > lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
> > needs, and the LSM infrastructure knows how many xattr slots it should
> > allocate.
> > 
> > Dynamically allocate the new_xattrs array to be populated by LSMs with the
> > inode_init_security hook, and pass it to the latter instead of the
> > name/value/len triple.
> > 
> > Also, pass to the hook the number of xattrs filled by each LSM, so that
> > there are no gaps when the next LSM fills the array. Gaps might occur
> > because an LSM can legitimately request xattrs to the LSM infrastructure,
> > but not fill the reserved slots, if it was not initialized.
> > 
> > Update the documentation of security_inode_init_security() to reflect the
> > changes, and fix the description of the xattr name, as it is not allocated
> > anymore.
> > 
> > On the security_inode_init_security() side, ensure that if LSMs returned
> > zero from the hook, they correctly filled a new_xattrs slot. Consequently,
> > change the default return value of the hook to -EOPNOTSUPP, so that BPF LSM
> > returns that, and does not cause security_inode_init_security() to fail.
> > 
> > Finally, adapt both SELinux and Smack to use the new definition of the
> > inode_init_security hook, and to fill the reserved slots in the xattr
> > array. Introduce the lsm_find_xattr_slot() helper to retrieve an available
> > slot to fill, and to increment the number of filled slots.
> > 
> > Move the xattr->name assignment after the xattr->value one, so that it is
> > done only in case of successful memory allocation. For Smack, also reserve
> > space for the other defined xattrs although they are not set yet in
> > smack_inode_init_security().
> > 
> > Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
> > Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >  include/linux/lsm_hook_defs.h |  6 +--
> >  include/linux/lsm_hooks.h     | 14 ++++++
> >  security/security.c           | 92 +++++++++++++++++++++++++++--------
> >  security/selinux/hooks.c      | 18 ++++---
> >  security/smack/smack_lsm.c    | 33 ++++++++-----
> >  5 files changed, 120 insertions(+), 43 deletions(-)
> > 
> > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> > index 6bb55e61e8e..1fd95db0087 100644
> > --- a/include/linux/lsm_hook_defs.h
> > +++ b/include/linux/lsm_hook_defs.h
> > @@ -111,9 +111,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
> >          unsigned int obj_type)
> >  LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
> >  LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
> > -LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
> > -        struct inode *dir, const struct qstr *qstr, const char **name,
> > -        void **value, size_t *len)
> > +LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
> > +        struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,
> > +        int *num_filled_xattrs)
> >  LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
> >          const struct qstr *name, const struct inode *context_inode)
> >  LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
> > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > index c2be66c669a..b60de5f2f34 100644
> > --- a/include/linux/lsm_hooks.h
> > +++ b/include/linux/lsm_hooks.h
> > @@ -28,6 +28,7 @@
> >  #include <linux/security.h>
> >  #include <linux/init.h>
> >  #include <linux/rculist.h>
> > +#include <linux/xattr.h>
> > 
> >  union security_list_options {
> >         #define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
> > @@ -63,8 +64,21 @@ struct lsm_blob_sizes {
> >         int     lbs_ipc;
> >         int     lbs_msg_msg;
> >         int     lbs_task;
> > +       int     lbs_xattr_count; /* number of xattr slots in new_xattrs array */
> >  };
> > 
> > +/*
> > + * Retrieve the first available slot to fill with an xattr, and increment
> > + * the number of filled slots.
> > + */
> > +static inline struct xattr *lsm_find_xattr_slot(struct xattr *xattrs,
> > +                                               int *num_filled_xattrs)
> > +{
> > +       if (unlikely(!xattrs))
> > +               return NULL;
> > +       return xattrs + (*num_filled_xattrs)++;
> > +}
> 
> Since this function increments the @num_filled_xattrs parameter in
> addition to returning the next available xattr array slot, let's
> replace the "find" with "get" so there is some hint that the state is
> changing, i.e. the count is being bumped (similar to the "get" and
> "put" concept).
> 
> It would also be nice if you could use the kdoc style for the function
> comment block; if nothing else it is a known format and consistent
> documentation is good, even if it never makes it out of the source
> file.

Ok, will do.

> >  /*
> >   * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
> >   * LSM hooks (in include/linux/lsm_hook_defs.h).
> > diff --git a/security/security.c b/security/security.c
> > index f4170efcddd..be33d643a81 100644
> > --- a/security/security.c
> > +++ b/security/security.c
> > @@ -31,8 +31,6 @@
> >  #include <linux/msg.h>
> >  #include <net/flow.h>
> > 
> > -#define MAX_LSM_EVM_XATTR      2
> > -
> >  /* How many LSMs were built into the kernel? */
> >  #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
> > 
> > @@ -212,6 +210,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
> >         lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
> >         lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
> >         lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
> > +       lsm_set_blob_size(&needed->lbs_xattr_count,
> > +                         &blob_sizes.lbs_xattr_count);
> >  }
> > 
> >  /* Prepare LSM for initialization. */
> > @@ -378,6 +378,7 @@ static void __init ordered_lsm_init(void)
> >         init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
> >         init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
> >         init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
> > +       init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
> > 
> >         /*
> >          * Create any kmem_caches needed for blobs
> > @@ -1591,11 +1592,15 @@ EXPORT_SYMBOL(security_dentry_create_files_as);
> >   * created inode and set up the incore security field for the new inode.  This
> >   * hook is called by the fs code as part of the inode creation transaction and
> >   * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
> > - * hooks called by the VFS.  The hook function is expected to allocate the name
> > - * and value via kmalloc, with the caller being responsible for calling kfree
> > - * after using them.  If the security module does not use security attributes
> > - * or does not wish to put a security attribute on this particular inode, then
> > - * it should return -EOPNOTSUPP to skip this processing.
> > + * hooks called by the VFS.  The hook function is expected to populate the
> > + * @xattrs array, by calling lsm_find_xattr_slot() to retrieve the slots
> > + * reserved by the security module with the lbs_xattr_count field of the
> > + * lsm_blob_sizes structure.  For each slot, the hook function should set ->name
> > + * to the attribute name suffix (e.g. selinux), to allocate ->value (will be
> > + * freed by the caller) and set it to the attribute value, to set ->value_len to
> > + * the length of the value.  If the security module does not use security
> > + * attributes or does not wish to put a security attribute on this particular
> > + * inode, then it should return -EOPNOTSUPP to skip this processing.
> >   *
> >   * Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
> >   * needed, or -ENOMEM on memory allocation failure.
> > @@ -1604,33 +1609,80 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
> >                                  const struct qstr *qstr,
> >                                  const initxattrs initxattrs, void *fs_data)
> >  {
> > -       struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
> > -       struct xattr *lsm_xattr, *evm_xattr, *xattr;
> > -       int ret;
> > +       struct security_hook_list *P;
> > +       struct xattr *new_xattrs;
> > +       struct xattr *xattr;
> > +       int num_filled_xattrs = 0, old_num_filled_xattrs;
> 
> I think you can get rid of @old_num_filled_xattrs (see below), but how
> about changing @num_filled_xattrs to @xattr_count, it's shorter and
> just as accurate.

Ok.

> > +       int ret = -EOPNOTSUPP, i;
> > 
> >         if (unlikely(IS_PRIVATE(inode)))
> >                 return 0;
> > 
> > +       if (!blob_sizes.lbs_xattr_count)
> > +               return 0;
> > +
> >         if (!initxattrs)
> >                 return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
> > -                                    dir, qstr, NULL, NULL, NULL);
> 
> I would have expected the !initxattrs case to still be handled in the
> hook loop below, is there a reason why we don't want to do that?  If
> including it in the loop below is too much of a hassle (conditional
> array allocation, etc.), should we at least put it in it's own loop?
> It seems wrong that we wouldn't run through all of the LSM hooks in
> this case ...

Uhm, you are right. If you add another loop, the function starts to be
too long. I would just check if initxattrs is not NULL below.

> > -       memset(new_xattrs, 0, sizeof(new_xattrs));
> > -       lsm_xattr = new_xattrs;
> > -       ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
> > -                           &lsm_xattr->name,
> > -                           &lsm_xattr->value,
> > -                           &lsm_xattr->value_len);
> > -       if (ret)
> > +                                   dir, qstr, NULL, NULL);
> > +       /* Allocate +1 for EVM and +1 as terminator. */
> > +       new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
> > +                            sizeof(*new_xattrs), GFP_NOFS);
> > +       if (!new_xattrs)
> > +               return -ENOMEM;
> > +
> > +       hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
> > +                            list) {
> > +               old_num_filled_xattrs = num_filled_xattrs;
> > +
> > +               ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs,
> > +                                                 &num_filled_xattrs);
> > +               if (ret && ret != -EOPNOTSUPP)
> > +                       goto out;
> > +               /*
> > +                * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
> > +                * means that the LSM is not willing to provide an xattr, not
> > +                * that it wants to signal an error. Thus, continue to invoke
> > +                * the remaining LSMs.
> > +                */
> > +               if (ret == -EOPNOTSUPP)
> > +                       continue;
> > +
> > +               /* LSM should fill new_xattrs if it returns zero. */
> > +               if (old_num_filled_xattrs == num_filled_xattrs) {
> > +                       WARN_ONCE(1, "LSM %s: returned zero but didn't fill any slot\n",
> > +                                 P->lsm);
> > +                       ret = -EINVAL;
> > +                       goto out;
> > +               }
> 
> Do we really need this check?  We don't currently check that LSMs
> setup their xattrs properly and we are doing okay.
> 
> > +               /*
> > +                * For filled xattr slots, name and value must be non-NULL.
> > +                *
> > +                * NULL value is interpreted by filesystems as a remove op, see
> > +                * ext4_xattr_set_handle() for more details.
> > +                */
> > +               for (i = old_num_filled_xattrs; i < num_filled_xattrs; i++) {
> > +                       if (!new_xattrs[i].name || !new_xattrs[i].value) {
> > +                               WARN_ONCE(1, "LSM %s: NULL xattr name and/or value\n",
> > +                                         P->lsm);
> > +                               ret = -EINVAL;
> > +                               goto out;
> > +                       }
> > +               }
> 
> Same here.  I worry this is extra processing with little benefit.  The
> LSM updates the xattr count and we should trust it is correct.

Ok, no problem for me to remove.

Sometimes more checks help to detect undesired changes in other parts
of the code.

> > +       }
> > +
> > +       if (!num_filled_xattrs)
> >                 goto out;
> > 
> > -       evm_xattr = lsm_xattr + 1;
> > -       ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
> > +       ret = evm_inode_init_security(inode, new_xattrs,
> > +                                     new_xattrs + num_filled_xattrs);
> >         if (ret)
> >                 goto out;
> >         ret = initxattrs(inode, new_xattrs, fs_data);
> >  out:
> >         for (xattr = new_xattrs; xattr->value != NULL; xattr++)
> >                 kfree(xattr->value);
> 
> We can probably drop the need for the @xattr variable by using @xattr_count.
> 
>   for (; xattr_count > 0; xattr_count--)
>     kfree(new_xattrs[xattr_count - 1]->value);

Ok.

> > +       kfree(new_xattrs);
> >         return (ret == -EOPNOTSUPP) ? 0 : ret;
> >  }
> >  EXPORT_SYMBOL(security_inode_init_security);
> > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> > index 9a5bdfc2131..dc349cf34e8 100644
> > --- a/security/selinux/hooks.c
> > +++ b/security/selinux/hooks.c
> > @@ -104,6 +104,8 @@
> >  #include "audit.h"
> >  #include "avc_ss.h"
> > 
> > +#define SELINUX_INODE_INIT_XATTRS 1
> > +
> >  struct selinux_state selinux_state;
> > 
> >  /* SECMARK reference count */
> > @@ -2868,11 +2870,12 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
> > 
> >  static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
> >                                        const struct qstr *qstr,
> > -                                      const char **name,
> > -                                      void **value, size_t *len)
> > +                                      struct xattr *xattrs,
> > +                                      int *num_filled_xattrs)
> 
> Use 'xattr_count'.
> 
> >  {
> >         const struct task_security_struct *tsec = selinux_cred(current_cred());
> >         struct superblock_security_struct *sbsec;
> > +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
> >         u32 newsid, clen;
> >         int rc;
> >         char *context;
> > @@ -2899,16 +2902,14 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
> >             !(sbsec->flags & SBLABEL_MNT))
> >                 return -EOPNOTSUPP;
> > 
> > -       if (name)
> > -               *name = XATTR_SELINUX_SUFFIX;
> > -
> > -       if (value && len) {
> > +       if (xattr) {
> >                 rc = security_sid_to_context_force(&selinux_state, newsid,
> >                                                    &context, &clen);
> >                 if (rc)
> >                         return rc;
> > -               *value = context;
> > -               *len = clen;
> > +               xattr->value = context;
> > +               xattr->value_len = clen;
> > +               xattr->name = XATTR_SELINUX_SUFFIX;
> >         }
> > 
> >         return 0;
> > @@ -6918,6 +6919,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
> >         .lbs_ipc = sizeof(struct ipc_security_struct),
> >         .lbs_msg_msg = sizeof(struct msg_security_struct),
> >         .lbs_superblock = sizeof(struct superblock_security_struct),
> > +       .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
> >  };
> > 
> >  #ifdef CONFIG_PERF_EVENTS
> > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> > index cfcbb748da2..ba10f4e8632 100644
> > --- a/security/smack/smack_lsm.c
> > +++ b/security/smack/smack_lsm.c
> > @@ -52,6 +52,15 @@
> >  #define SMK_RECEIVING  1
> >  #define SMK_SENDING    2
> > 
> > +/*
> > + * Smack uses multiple xattrs.
> > + * SMACK64 - for access control, SMACK64EXEC - label for the program,
> > + * SMACK64MMAP - controls library loading,
> > + * SMACK64TRANSMUTE - label initialization,
> > + * Not saved on files - SMACK64IPIN and SMACK64IPOUT
> > + */
> > +#define SMACK_INODE_INIT_XATTRS 4
> > +
> >  #ifdef SMACK_IPV6_PORT_LABELING
> >  static DEFINE_MUTEX(smack_ipv6_lock);
> >  static LIST_HEAD(smk_ipv6_port_list);
> > @@ -939,26 +948,24 @@ static int smack_inode_alloc_security(struct inode *inode)
> >   * @inode: the newly created inode
> >   * @dir: containing directory object
> >   * @qstr: unused
> > - * @name: where to put the attribute name
> > - * @value: where to put the attribute value
> > - * @len: where to put the length of the attribute
> > + * @xattrs: where to put the attributes
> > + * @num_filled_xattrs: current number of filled xattrs (updated)
> >   *
> >   * Returns 0 if it all works out, -ENOMEM if there's no memory
> >   */
> >  static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> > -                                    const struct qstr *qstr, const char **name,
> > -                                    void **value, size_t *len)
> > +                                    const struct qstr *qstr,
> > +                                    struct xattr *xattrs,
> > +                                    int *num_filled_xattrs)
> 
> I'll leave this up to Casey, but 'xattr_count' would be my vote :)

Ok, fine also for me.

Thanks

Roberto

> >  {
> >         struct inode_smack *issp = smack_inode(inode);
> >         struct smack_known *skp = smk_of_current();
> >         struct smack_known *isp = smk_of_inode(inode);
> >         struct smack_known *dsp = smk_of_inode(dir);
> > +       struct xattr *xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
> >         int may;
> > 
> > -       if (name)
> > -               *name = XATTR_SMACK_SUFFIX;
> > -
> > -       if (value && len) {
> > +       if (xattr) {
> >                 rcu_read_lock();
> >                 may = smk_access_entry(skp->smk_known, dsp->smk_known,
> >                                        &skp->smk_rules);
> > @@ -976,11 +983,12 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> >                         issp->smk_flags |= SMK_INODE_CHANGED;
> >                 }
> > 
> > -               *value = kstrdup(isp->smk_known, GFP_NOFS);
> > -               if (*value == NULL)
> > +               xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
> > +               if (xattr->value == NULL)
> >                         return -ENOMEM;
> > 
> > -               *len = strlen(isp->smk_known);
> > +               xattr->value_len = strlen(isp->smk_known);
> > +               xattr->name = XATTR_SMACK_SUFFIX;
> >         }
> > 
> >         return 0;
> > @@ -4854,6 +4862,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
> >         .lbs_ipc = sizeof(struct smack_known *),
> >         .lbs_msg_msg = sizeof(struct smack_known *),
> >         .lbs_superblock = sizeof(struct superblock_smack),
> > +       .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
> >  };
> > 
> >  static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
> > --
> > 2.25.1


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
  2023-03-30 22:55   ` Paul Moore
@ 2023-03-31  7:32     ` Roberto Sassu
  2023-03-31 12:18       ` Roberto Sassu
  0 siblings, 1 reply; 14+ messages in thread
From: Roberto Sassu @ 2023-03-31  7:32 UTC (permalink / raw)
  To: Paul Moore
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Thu, 2023-03-30 at 18:55 -0400, Paul Moore wrote:
> On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> > 
> > Change the evm_inode_init_security() definition to align with the LSM
> > infrastructure. Keep the existing behavior of including in the HMAC
> > calculation only the first xattr provided by LSMs.
> > 
> > Changing the evm_inode_init_security() definition requires passing the
> > xattr array allocated by security_inode_init_security(), and the number of
> > xattrs filled by previously invoked LSMs.
> > 
> > Use the newly introduced lsm_find_xattr_slot() to position EVM correctly in
> > the xattrs array, like a regular LSM, and to increment the number of filled
> > slots. For now, the LSM infrastructure allocates enough xattrs slots to
> > store the EVM xattr, without using the reservation mechanism.
> > 
> > Finally, make evm_inode_init_security() return value compatible with the
> > inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
> > setting an xattr.
> > 
> > EVM is a bit tricky, because xattrs is both an input and an output. If it
> > was just output, EVM should have returned zero if xattrs is NULL. But,
> > since xattrs is also input, EVM is unable to do its calculations, so return
> > -EOPNOTSUPP and handle this error in security_inode_init_security().
> 
> I don't quite understand why EVM would return EOPNOTSUPP if it is
> enabled but there are not xattrs to measure.  It seems like EVM should
> return success/0 in the no-xattr case; there were no xattrs to
> measure, so it succeeded in measuring nothing.  Am I missing
> something?

From a very quick look at what other LSMs do, it seems that they return
zero even if they are not initialized.

So, it makes sense to return zero also here.

Thanks

Roberto

> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >  include/linux/evm.h               | 14 ++++++++------
> >  security/integrity/evm/evm_main.c | 18 +++++++++++-------
> >  security/security.c               |  6 +++---
> >  3 files changed, 22 insertions(+), 16 deletions(-)
> > 
> > diff --git a/include/linux/evm.h b/include/linux/evm.h
> > index 7dc1ee74169..3c0e8591b69 100644
> > --- a/include/linux/evm.h
> > +++ b/include/linux/evm.h
> > @@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> >  {
> >         return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
> >  }
> > -extern int evm_inode_init_security(struct inode *inode,
> > -                                  const struct xattr *xattr_array,
> > -                                  struct xattr *evm);
> > +extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > +                                  const struct qstr *qstr,
> > +                                  struct xattr *xattrs,
> > +                                  int *num_filled_xattrs);
> >  extern bool evm_revalidate_status(const char *xattr_name);
> >  extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
> >  extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
> > @@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> >         return;
> >  }
> > 
> > -static inline int evm_inode_init_security(struct inode *inode,
> > -                                         const struct xattr *xattr_array,
> > -                                         struct xattr *evm)
> > +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > +                                         const struct qstr *qstr,
> > +                                         struct xattr *xattrs,
> > +                                         int *num_filled_xattrs)
> >  {
> >         return 0;
> >  }
> > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> > index cf24c525558..9e75759150c 100644
> > --- a/security/integrity/evm/evm_main.c
> > +++ b/security/integrity/evm/evm_main.c
> > @@ -21,6 +21,7 @@
> >  #include <linux/evm.h>
> >  #include <linux/magic.h>
> >  #include <linux/posix_acl_xattr.h>
> > +#include <linux/lsm_hooks.h>
> > 
> >  #include <crypto/hash.h>
> >  #include <crypto/hash_info.h>
> > @@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
> >  /*
> >   * evm_inode_init_security - initializes security.evm HMAC value
> >   */
> > -int evm_inode_init_security(struct inode *inode,
> > -                                const struct xattr *lsm_xattr,
> > -                                struct xattr *evm_xattr)
> > +int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > +                           const struct qstr *qstr, struct xattr *xattrs,
> > +                           int *num_filled_xattrs)
> >  {
> >         struct evm_xattr *xattr_data;
> > +       struct xattr *evm_xattr;
> >         int rc;
> > 
> > -       if (!(evm_initialized & EVM_INIT_HMAC) ||
> > -           !evm_protected_xattr(lsm_xattr->name))
> > -               return 0;
> > +       if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
> > +           !evm_protected_xattr(xattrs->name))
> > +               return -EOPNOTSUPP;
> > +
> > +       evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
> > 
> >         xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
> >         if (!xattr_data)
> >                 return -ENOMEM;
> > 
> >         xattr_data->data.type = EVM_XATTR_HMAC;
> > -       rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
> > +       rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
> >         if (rc < 0)
> >                 goto out;
> > 
> > diff --git a/security/security.c b/security/security.c
> > index be33d643a81..22ab4fb7ebf 100644
> > --- a/security/security.c
> > +++ b/security/security.c
> > @@ -1674,9 +1674,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
> >         if (!num_filled_xattrs)
> >                 goto out;
> > 
> > -       ret = evm_inode_init_security(inode, new_xattrs,
> > -                                     new_xattrs + num_filled_xattrs);
> > -       if (ret)
> > +       ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
> > +                                     &num_filled_xattrs);
> > +       if (ret && ret != -EOPNOTSUPP)
> >                 goto out;
> >         ret = initxattrs(inode, new_xattrs, fs_data);
> >  out:
> > --
> > 2.25.1
> > 
> 
> 


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
  2023-03-31  7:32     ` Roberto Sassu
@ 2023-03-31 12:18       ` Roberto Sassu
  2023-04-03 10:37         ` Mimi Zohar
  0 siblings, 1 reply; 14+ messages in thread
From: Roberto Sassu @ 2023-03-31 12:18 UTC (permalink / raw)
  To: Paul Moore
  Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
	eparis, casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Fri, 2023-03-31 at 09:32 +0200, Roberto Sassu wrote:
> On Thu, 2023-03-30 at 18:55 -0400, Paul Moore wrote:
> > On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> > <roberto.sassu@huaweicloud.com> wrote:
> > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > > 
> > > Change the evm_inode_init_security() definition to align with the LSM
> > > infrastructure. Keep the existing behavior of including in the HMAC
> > > calculation only the first xattr provided by LSMs.
> > > 
> > > Changing the evm_inode_init_security() definition requires passing the
> > > xattr array allocated by security_inode_init_security(), and the number of
> > > xattrs filled by previously invoked LSMs.
> > > 
> > > Use the newly introduced lsm_find_xattr_slot() to position EVM correctly in
> > > the xattrs array, like a regular LSM, and to increment the number of filled
> > > slots. For now, the LSM infrastructure allocates enough xattrs slots to
> > > store the EVM xattr, without using the reservation mechanism.
> > > 
> > > Finally, make evm_inode_init_security() return value compatible with the
> > > inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
> > > setting an xattr.
> > > 
> > > EVM is a bit tricky, because xattrs is both an input and an output. If it
> > > was just output, EVM should have returned zero if xattrs is NULL. But,
> > > since xattrs is also input, EVM is unable to do its calculations, so return
> > > -EOPNOTSUPP and handle this error in security_inode_init_security().
> > 
> > I don't quite understand why EVM would return EOPNOTSUPP if it is
> > enabled but there are not xattrs to measure.  It seems like EVM should
> > return success/0 in the no-xattr case; there were no xattrs to
> > measure, so it succeeded in measuring nothing.  Am I missing
> > something?
> 
> From a very quick look at what other LSMs do, it seems that they return
> zero even if they are not initialized.
> 
> So, it makes sense to return zero also here.

Oh, actually there was a reason to do that. If an LSM does not wish to
provide an xattr, it should return -EOPNOTSUPP.

As we are not checking this convention anymore, it is probably fine to
return zero. I already made the change, will send the new version
shortly.

Thanks

Roberto

> Thanks
> 
> Roberto
> 
> > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > > ---
> > >  include/linux/evm.h               | 14 ++++++++------
> > >  security/integrity/evm/evm_main.c | 18 +++++++++++-------
> > >  security/security.c               |  6 +++---
> > >  3 files changed, 22 insertions(+), 16 deletions(-)
> > > 
> > > diff --git a/include/linux/evm.h b/include/linux/evm.h
> > > index 7dc1ee74169..3c0e8591b69 100644
> > > --- a/include/linux/evm.h
> > > +++ b/include/linux/evm.h
> > > @@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> > >  {
> > >         return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
> > >  }
> > > -extern int evm_inode_init_security(struct inode *inode,
> > > -                                  const struct xattr *xattr_array,
> > > -                                  struct xattr *evm);
> > > +extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > +                                  const struct qstr *qstr,
> > > +                                  struct xattr *xattrs,
> > > +                                  int *num_filled_xattrs);
> > >  extern bool evm_revalidate_status(const char *xattr_name);
> > >  extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
> > >  extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
> > > @@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> > >         return;
> > >  }
> > > 
> > > -static inline int evm_inode_init_security(struct inode *inode,
> > > -                                         const struct xattr *xattr_array,
> > > -                                         struct xattr *evm)
> > > +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > +                                         const struct qstr *qstr,
> > > +                                         struct xattr *xattrs,
> > > +                                         int *num_filled_xattrs)
> > >  {
> > >         return 0;
> > >  }
> > > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> > > index cf24c525558..9e75759150c 100644
> > > --- a/security/integrity/evm/evm_main.c
> > > +++ b/security/integrity/evm/evm_main.c
> > > @@ -21,6 +21,7 @@
> > >  #include <linux/evm.h>
> > >  #include <linux/magic.h>
> > >  #include <linux/posix_acl_xattr.h>
> > > +#include <linux/lsm_hooks.h>
> > > 
> > >  #include <crypto/hash.h>
> > >  #include <crypto/hash_info.h>
> > > @@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
> > >  /*
> > >   * evm_inode_init_security - initializes security.evm HMAC value
> > >   */
> > > -int evm_inode_init_security(struct inode *inode,
> > > -                                const struct xattr *lsm_xattr,
> > > -                                struct xattr *evm_xattr)
> > > +int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > +                           const struct qstr *qstr, struct xattr *xattrs,
> > > +                           int *num_filled_xattrs)
> > >  {
> > >         struct evm_xattr *xattr_data;
> > > +       struct xattr *evm_xattr;
> > >         int rc;
> > > 
> > > -       if (!(evm_initialized & EVM_INIT_HMAC) ||
> > > -           !evm_protected_xattr(lsm_xattr->name))
> > > -               return 0;
> > > +       if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
> > > +           !evm_protected_xattr(xattrs->name))
> > > +               return -EOPNOTSUPP;
> > > +
> > > +       evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
> > > 
> > >         xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
> > >         if (!xattr_data)
> > >                 return -ENOMEM;
> > > 
> > >         xattr_data->data.type = EVM_XATTR_HMAC;
> > > -       rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
> > > +       rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
> > >         if (rc < 0)
> > >                 goto out;
> > > 
> > > diff --git a/security/security.c b/security/security.c
> > > index be33d643a81..22ab4fb7ebf 100644
> > > --- a/security/security.c
> > > +++ b/security/security.c
> > > @@ -1674,9 +1674,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
> > >         if (!num_filled_xattrs)
> > >                 goto out;
> > > 
> > > -       ret = evm_inode_init_security(inode, new_xattrs,
> > > -                                     new_xattrs + num_filled_xattrs);
> > > -       if (ret)
> > > +       ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
> > > +                                     &num_filled_xattrs);
> > > +       if (ret && ret != -EOPNOTSUPP)
> > >                 goto out;
> > >         ret = initxattrs(inode, new_xattrs, fs_data);
> > >  out:
> > > --
> > > 2.25.1
> > > 


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
  2023-03-31 12:18       ` Roberto Sassu
@ 2023-04-03 10:37         ` Mimi Zohar
  0 siblings, 0 replies; 14+ messages in thread
From: Mimi Zohar @ 2023-04-03 10:37 UTC (permalink / raw)
  To: Roberto Sassu, Paul Moore
  Cc: dmitry.kasatkin, jmorris, serge, stephen.smalley.work, eparis,
	casey, reiserfs-devel, linux-kernel, linux-integrity,
	linux-security-module, selinux, bpf, kpsingh, keescook,
	nicolas.bouchinet, Roberto Sassu

On Fri, 2023-03-31 at 14:18 +0200, Roberto Sassu wrote:
> On Fri, 2023-03-31 at 09:32 +0200, Roberto Sassu wrote:
> > On Thu, 2023-03-30 at 18:55 -0400, Paul Moore wrote:
> > > On Wed, Mar 29, 2023 at 9:05 AM Roberto Sassu
> > > <roberto.sassu@huaweicloud.com> wrote:
> > > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > > > 
> > > > Change the evm_inode_init_security() definition to align with the LSM
> > > > infrastructure. Keep the existing behavior of including in the HMAC
> > > > calculation only the first xattr provided by LSMs.
> > > > 
> > > > Changing the evm_inode_init_security() definition requires passing the
> > > > xattr array allocated by security_inode_init_security(), and the number of
> > > > xattrs filled by previously invoked LSMs.
> > > > 
> > > > Use the newly introduced lsm_find_xattr_slot() to position EVM correctly in
> > > > the xattrs array, like a regular LSM, and to increment the number of filled
> > > > slots. For now, the LSM infrastructure allocates enough xattrs slots to
> > > > store the EVM xattr, without using the reservation mechanism.
> > > > 
> > > > Finally, make evm_inode_init_security() return value compatible with the
> > > > inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
> > > > setting an xattr.
> > > > 
> > > > EVM is a bit tricky, because xattrs is both an input and an output. If it
> > > > was just output, EVM should have returned zero if xattrs is NULL. But,
> > > > since xattrs is also input, EVM is unable to do its calculations, so return
> > > > -EOPNOTSUPP and handle this error in security_inode_init_security().
> > > 
> > > I don't quite understand why EVM would return EOPNOTSUPP if it is
> > > enabled but there are not xattrs to measure.  It seems like EVM should
> > > return success/0 in the no-xattr case; there were no xattrs to
> > > measure, so it succeeded in measuring nothing.  Am I missing
> > > something?
> > 
> > From a very quick look at what other LSMs do, it seems that they return
> > zero even if they are not initialized.
> > 
> > So, it makes sense to return zero also here.
> 
> Oh, actually there was a reason to do that. If an LSM does not wish to
> provide an xattr, it should return -EOPNOTSUPP.

In general, the original purpose of -EOPNOTSUPP was to indicate that
the filesystem itself did not support security xattrs.  This can be
seen in evm_verify_hmac(), which returns different values (e.g.
INTEGRITY_NOLABEL, INTEGRITY_NOXATTRS, INTEGRITY_UNKNOWN) based on
whether security.evm or any protected security xattrs exist.

> 
> As we are not checking this convention anymore, it is probably fine to
> return zero. I already made the change, will send the new version
> shortly.

For security xattr initialization, agreed.

Mimi

> 
> > 
> > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > > > ---
> > > >  include/linux/evm.h               | 14 ++++++++------
> > > >  security/integrity/evm/evm_main.c | 18 +++++++++++-------
> > > >  security/security.c               |  6 +++---
> > > >  3 files changed, 22 insertions(+), 16 deletions(-)
> > > > 
> > > > diff --git a/include/linux/evm.h b/include/linux/evm.h
> > > > index 7dc1ee74169..3c0e8591b69 100644
> > > > --- a/include/linux/evm.h
> > > > +++ b/include/linux/evm.h
> > > > @@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> > > >  {
> > > >         return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
> > > >  }
> > > > -extern int evm_inode_init_security(struct inode *inode,
> > > > -                                  const struct xattr *xattr_array,
> > > > -                                  struct xattr *evm);
> > > > +extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > > +                                  const struct qstr *qstr,
> > > > +                                  struct xattr *xattrs,
> > > > +                                  int *num_filled_xattrs);
> > > >  extern bool evm_revalidate_status(const char *xattr_name);
> > > >  extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
> > > >  extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
> > > > @@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
> > > >         return;
> > > >  }
> > > > 
> > > > -static inline int evm_inode_init_security(struct inode *inode,
> > > > -                                         const struct xattr *xattr_array,
> > > > -                                         struct xattr *evm)
> > > > +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > > +                                         const struct qstr *qstr,
> > > > +                                         struct xattr *xattrs,
> > > > +                                         int *num_filled_xattrs)
> > > >  {
> > > >         return 0;
> > > >  }
> > > > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> > > > index cf24c525558..9e75759150c 100644
> > > > --- a/security/integrity/evm/evm_main.c
> > > > +++ b/security/integrity/evm/evm_main.c
> > > > @@ -21,6 +21,7 @@
> > > >  #include <linux/evm.h>
> > > >  #include <linux/magic.h>
> > > >  #include <linux/posix_acl_xattr.h>
> > > > +#include <linux/lsm_hooks.h>
> > > > 
> > > >  #include <crypto/hash.h>
> > > >  #include <crypto/hash_info.h>
> > > > @@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
> > > >  /*
> > > >   * evm_inode_init_security - initializes security.evm HMAC value
> > > >   */
> > > > -int evm_inode_init_security(struct inode *inode,
> > > > -                                const struct xattr *lsm_xattr,
> > > > -                                struct xattr *evm_xattr)
> > > > +int evm_inode_init_security(struct inode *inode, struct inode *dir,
> > > > +                           const struct qstr *qstr, struct xattr *xattrs,
> > > > +                           int *num_filled_xattrs)
> > > >  {
> > > >         struct evm_xattr *xattr_data;
> > > > +       struct xattr *evm_xattr;
> > > >         int rc;
> > > > 
> > > > -       if (!(evm_initialized & EVM_INIT_HMAC) ||
> > > > -           !evm_protected_xattr(lsm_xattr->name))
> > > > -               return 0;
> > > > +       if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
> > > > +           !evm_protected_xattr(xattrs->name))
> > > > +               return -EOPNOTSUPP;
> > > > +
> > > > +       evm_xattr = lsm_find_xattr_slot(xattrs, num_filled_xattrs);
> > > > 
> > > >         xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
> > > >         if (!xattr_data)
> > > >                 return -ENOMEM;
> > > > 
> > > >         xattr_data->data.type = EVM_XATTR_HMAC;
> > > > -       rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
> > > > +       rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
> > > >         if (rc < 0)
> > > >                 goto out;
> > > > 
> > > > diff --git a/security/security.c b/security/security.c
> > > > index be33d643a81..22ab4fb7ebf 100644
> > > > --- a/security/security.c
> > > > +++ b/security/security.c
> > > > @@ -1674,9 +1674,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
> > > >         if (!num_filled_xattrs)
> > > >                 goto out;
> > > > 
> > > > -       ret = evm_inode_init_security(inode, new_xattrs,
> > > > -                                     new_xattrs + num_filled_xattrs);
> > > > -       if (ret)
> > > > +       ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
> > > > +                                     &num_filled_xattrs);
> > > > +       if (ret && ret != -EOPNOTSUPP)
> > > >                 goto out;
> > > >         ret = initxattrs(inode, new_xattrs, fs_data);
> > > >  out:
> > > > --
> > > > 2.25.1
> > > > 
> 



^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2023-04-03 10:40 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-29 13:04 [PATCH v9 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
2023-03-29 13:04 ` [PATCH v9 1/4] reiserfs: Add security prefix to xattr name in reiserfs_security_write() Roberto Sassu
2023-03-30 21:15   ` Paul Moore
2023-03-31  7:02     ` Roberto Sassu
2023-03-29 13:04 ` [PATCH v9 2/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
2023-03-30 22:50   ` Paul Moore
2023-03-30 23:05     ` Casey Schaufler
2023-03-31  7:17     ` Roberto Sassu
2023-03-29 13:04 ` [PATCH v9 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
2023-03-30 22:55   ` Paul Moore
2023-03-31  7:32     ` Roberto Sassu
2023-03-31 12:18       ` Roberto Sassu
2023-04-03 10:37         ` Mimi Zohar
2023-03-29 13:04 ` [PATCH v9 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).