* new_inode_smack() bogosities
@ 2012-01-04 22:13 Al Viro
0 siblings, 0 replies; only message in thread
From: Al Viro @ 2012-01-04 22:13 UTC (permalink / raw)
To: Casey Schaufler; +Cc: linux-kernel, linux-fsdevel, linux-security-module
1) in smack_sb_kern_mount()
isp = inode->i_security;
if (isp == NULL)
inode->i_security = new_inode_smack(sp->smk_root);
else
isp->smk_inode = sp->smk_root;
looks very fishy. How in hell had that inode managed to get created
in the first place without going through smack_inode_alloc_security()?
Is that about mounting an fs instance with in-core superblock that
is older than the call of smack_init()? That shouldn't be possible due
to initcall ordering, but if that's the case, just what would happen when
we step on *other* inodes on the same fs? There's a bunch of places where
smack assumes that ->i_security is never NULL... And if that's really
impossible, WTF is that new_inode_smack() doing there?
2) again in smack_sb_kern_mount()
spin_lock(&sp->smk_sblock);
if (sp->smk_initialized != 0) {
spin_unlock(&sp->smk_sblock);
return 0;
}
sp->smk_initialized = 1;
spin_unlock(&sp->smk_sblock);
For one thing, security_sb_kern_mount() is serialized by sb->s_umount.
For another, if it wouldn't be... this code wouldn't be able to prevent
a race. Sure, only one of them will proceed to initialize the sucker.
And another may cheerfully return before the work is actually done...
In any case, it *is* serialized on per-superblock basis.
3) in smk_fill_super(), we have
root_inode = sb->s_root->d_inode;
root_inode->i_security = new_inode_smack(smack_known_floor.smk_known);
Again, huh? This should be called after smack_init() had been done; hell,
you explicitly say so in the comments:
* Do not register smackfs if Smack wasn't enabled
* on boot. We can not put this method normally under the
* smack_init() code path since the security subsystem get
* initialized before the vfs caches.
Sounds like a misspelled assignment to ->smk_inode to me (and a leak, while
we are at it)...
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2012-01-04 22:13 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-01-04 22:13 new_inode_smack() bogosities Al Viro
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).