From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EEC2C2B9F4 for ; Fri, 18 Jun 2021 03:18:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 55891613B4 for ; Fri, 18 Jun 2021 03:18:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231441AbhFRDUr (ORCPT ); Thu, 17 Jun 2021 23:20:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36584 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230484AbhFRDUq (ORCPT ); Thu, 17 Jun 2021 23:20:46 -0400 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F1057C061574 for ; Thu, 17 Jun 2021 20:18:37 -0700 (PDT) Received: by mail-ej1-x630.google.com with SMTP id dm5so1024912ejc.9 for ; Thu, 17 Jun 2021 20:18:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zLggwlEz9KvaqTsvD1N67bjXjYEPfw0xJN+eofsbIEg=; b=LeS2JjPwBohnWSN3UMBVdfjycTPlOisHQcuIJVwOlO9eR1p8p0xWOrm91+3FZl6C97 G1rwNnlyYPzxy4McN2Y037p0crdsF8/zAOMC2sXR+QxnLekiwdb2BA+MMd4JepSPJy4j CtB3r+X1EkC31clb9Iw+5PQUXoOjC9nRmepkaZcWiAgX1oufedkU7HIKEpZokMf2qH7H RoEZKXdE3J0HnWEGuz8BKlTKHms1uoIqXENdI0+x5J0wBZHBJ74G78bGhvGT5wvq2Etw VAuHVTYtD4nanHpASudOb+OmfBfxWJlFH8e/oxrCBqWm+l60T8FlLlDOj+Nq6rDyxqaA a1kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zLggwlEz9KvaqTsvD1N67bjXjYEPfw0xJN+eofsbIEg=; b=dlKb2zTzMRubTzDNRuD+ph61yD3W7YJhZsrgt3ldurYA840MWqqRxQKTAuWuiUdO1S YVa0NCQ/RMz8gckq6ZCUQM9HHymZw/agE4L4qRrpD/7pyTc9JRYdsb7ecF5WSrbsX5sN 2831uPtFCZRBB3VBhsnDX4++janjN/4m3SUUsDD4Qn6bWun/xbRyA4wBarKxZSntdklQ n6MFTguGnQOkcSqt2auZwRtpzGfnwUkJWrfdtj6XQ6bgD8P0KULrpM+4nsSj14mhWDeX ky5jGnd5mA8ee4SEmiFULMu/Hh2ChGUv61gDgfQcAscDNrvoCZyJXF9B1wN/Tp0qOYBd wb4A== X-Gm-Message-State: AOAM533hopEgX6P872rAnQuaqQpL2SluqCY+hZnuYay0YcHqzQq4LJvA nBJK24ZfqlqNZbTBayOiRz//emeKUjuWb07aP59V X-Google-Smtp-Source: ABdhPJzN+mYgtC0eBkhZhzGJhLQjFCbBuFlJghEgoQO/wcTYdvnFAIXrjFWrVDier3cOEKa4xAydvckxOEAYsT5C+1Y= X-Received: by 2002:a17:907:a8f:: with SMTP id by15mr8609968ejc.91.1623986316521; Thu, 17 Jun 2021 20:18:36 -0700 (PDT) MIME-Version: 1.0 References: <20210616132227.999256-1-roberto.sassu@huawei.com> <6e1c9807-d7e8-7c26-e0ee-975afa4b9515@linux.ibm.com> <9cb676de40714d0288f85292c1f1a430@huawei.com> In-Reply-To: From: Paul Moore Date: Thu, 17 Jun 2021 23:18:25 -0400 Message-ID: Subject: Re: [PATCH] fs: Return raw xattr for security.* if there is size disagreement with LSMs To: Mimi Zohar Cc: Roberto Sassu , Stefan Berger , "viro@zeniv.linux.org.uk" , "stephen.smalley.work@gmail.com" , "casey@schaufler-ca.com" , "linux-fsdevel@vger.kernel.org" , "linux-integrity@vger.kernel.org" , "linux-security-module@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "selinux@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On Thu, Jun 17, 2021 at 11:28 AM Mimi Zohar wrote: > On Thu, 2021-06-17 at 07:09 +0000, Roberto Sassu wrote: ... > > An alternative would be to do the EVM verification twice if the > > first time didn't succeed (with vfs_getxattr_alloc() and with the > > new function that behaves like vfs_getxattr()). > > Unfortunately, I don't see an alternative. ... and while unfortunate, the impact should be non-existant if you are using the right tools to label files or ensuring that you are formatting labels properly if doing it by hand. Handling a corner case is good, but I wouldn't add a lot of code complexity trying to optimize it. -- paul moore www.paul-moore.com