linux-next: build failure after merge of the integrity tree

linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 2650 bytes --]

Hi all,

After merging the integrity tree, today's linux-next build (x86_64
allmodconfig) failed like this:

In file included from <command-line>:
include/linux/module_signature.h:32:2: error: unknown type name 'u8'
  u8 algo;  /* Public-key crypto algorithm [0] */
  ^~
include/linux/module_signature.h:33:2: error: unknown type name 'u8'
  u8 hash;  /* Digest algorithm [0] */
  ^~
include/linux/module_signature.h:34:2: error: unknown type name 'u8'
  u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
  ^~
include/linux/module_signature.h:35:2: error: unknown type name 'u8'
  u8 signer_len; /* Length of signer's name [0] */
  ^~
include/linux/module_signature.h:36:2: error: unknown type name 'u8'
  u8 key_id_len; /* Length of key identifier [0] */
  ^~
include/linux/module_signature.h:37:2: error: unknown type name 'u8'
  u8 __pad[3];
  ^~
include/linux/module_signature.h:38:2: error: unknown type name '__be32'
  __be32 sig_len; /* Length of signature data */
  ^~~~~~
include/linux/module_signature.h:41:54: error: unknown type name 'size_t'
 int mod_check_sig(const struct module_signature *ms, size_t file_len,
                                                      ^~~~~~
include/linux/module_signature.h:41:54: note: 'size_t' is defined in header '<stddef.h>'; did you forget to '#include <stddef.h>'?
include/linux/module_signature.h:1:1:
+#include <stddef.h>
 /* SPDX-License-Identifier: GPL-2.0+ */
include/linux/module_signature.h:41:54:
 int mod_check_sig(const struct module_signature *ms, size_t file_len,
                                                      ^~~~~~

Caused by commit

  c8424e776b09 ("MODSIGN: Export module signature definitions")

We now have build time checks to make sure that include files are self
contained.

I have added the following fix patch for today.

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Tue, 6 Aug 2019 12:09:36 +1000
Subject: [PATCH] MODSIGN: make new include file self contained

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 include/linux/module_signature.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/module_signature.h b/include/linux/module_signature.h
index 523617fc5b6a..7eb4b00381ac 100644
--- a/include/linux/module_signature.h
+++ b/include/linux/module_signature.h
@@ -9,6 +9,8 @@
 #ifndef _LINUX_MODULE_SIGNATURE_H
 #define _LINUX_MODULE_SIGNATURE_H
 
+#include <linux/types.h>
+
 /* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */
 #define MODULE_SIG_STRING "~Module signature appended~\n"
 
-- 
2.20.1

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the integrity tree

[Thiago Jung Bauermann]

Hello Stephen,

Stephen Rothwell <sfr@canb.auug.org.au> writes:

> Hi all,
>
> After merging the integrity tree, today's linux-next build (x86_64
> allmodconfig) failed like this:
>
> In file included from <command-line>:
> include/linux/module_signature.h:32:2: error: unknown type name 'u8'
>   u8 algo;  /* Public-key crypto algorithm [0] */
>   ^~
> include/linux/module_signature.h:33:2: error: unknown type name 'u8'
>   u8 hash;  /* Digest algorithm [0] */
>   ^~
> include/linux/module_signature.h:34:2: error: unknown type name 'u8'
>   u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
>   ^~
> include/linux/module_signature.h:35:2: error: unknown type name 'u8'
>   u8 signer_len; /* Length of signer's name [0] */
>   ^~
> include/linux/module_signature.h:36:2: error: unknown type name 'u8'
>   u8 key_id_len; /* Length of key identifier [0] */
>   ^~
> include/linux/module_signature.h:37:2: error: unknown type name 'u8'
>   u8 __pad[3];
>   ^~
> include/linux/module_signature.h:38:2: error: unknown type name '__be32'
>   __be32 sig_len; /* Length of signature data */
>   ^~~~~~
> include/linux/module_signature.h:41:54: error: unknown type name 'size_t'
>  int mod_check_sig(const struct module_signature *ms, size_t file_len,
>                                                       ^~~~~~
> include/linux/module_signature.h:41:54: note: 'size_t' is defined in header '<stddef.h>'; did you forget to '#include <stddef.h>'?
> include/linux/module_signature.h:1:1:
> +#include <stddef.h>
>  /* SPDX-License-Identifier: GPL-2.0+ */
> include/linux/module_signature.h:41:54:
>  int mod_check_sig(const struct module_signature *ms, size_t file_len,
>                                                       ^~~~~~
>
> Caused by commit
>
>   c8424e776b09 ("MODSIGN: Export module signature definitions")
>
> We now have build time checks to make sure that include files are self
> contained.
>
> I have added the following fix patch for today.
>
> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Tue, 6 Aug 2019 12:09:36 +1000
> Subject: [PATCH] MODSIGN: make new include file self contained
>
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
>  include/linux/module_signature.h | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/include/linux/module_signature.h b/include/linux/module_signature.h
> index 523617fc5b6a..7eb4b00381ac 100644
> --- a/include/linux/module_signature.h
> +++ b/include/linux/module_signature.h
> @@ -9,6 +9,8 @@
>  #ifndef _LINUX_MODULE_SIGNATURE_H
>  #define _LINUX_MODULE_SIGNATURE_H
>
> +#include <linux/types.h>
> +
>  /* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */
>  #define MODULE_SIG_STRING "~Module signature appended~\n"

Sorry for the trouble. I wasn't aware of that build time check.
I'll enable HEADER_TEST and KERNEL_HEADER_TEST for my next patches.

Thanks for providing the fix. Should I post a new version or can Mimi
squash the above into the original patch?

--
Thiago Jung Bauermann
IBM Linux Technology Center

Re: linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 547 bytes --]

Hi Thiago,

On Tue, 06 Aug 2019 00:18:06 -0300 Thiago Jung Bauermann <bauerman@linux.ibm.com> wrote:
>
> Sorry for the trouble. I wasn't aware of that build time check.
> I'll enable HEADER_TEST and KERNEL_HEADER_TEST for my next patches.

I do allmodconfig builds which enable those.

> Thanks for providing the fix. Should I post a new version or can Mimi
> squash the above into the original patch?

Up to Mimi, but either works (or just committing my patch if the tree is
normally not rebased).

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the integrity tree

[Mimi Zohar]

Hi Stephen,

On Tue, 2019-08-06 at 13:45 +1000, Stephen Rothwell wrote:
> Hi Thiago,
> 
> On Tue, 06 Aug 2019 00:18:06 -0300 Thiago Jung Bauermann <bauerman@linux.ibm.com> wrote:
> >
> > Sorry for the trouble. I wasn't aware of that build time check.
> > I'll enable HEADER_TEST and KERNEL_HEADER_TEST for my next patches.

ditto

> 
> I do allmodconfig builds which enable those.
> 
> > Thanks for providing the fix. Should I post a new version or can Mimi
> > squash the above into the original patch?
> 
> Up to Mimi, but either works (or just committing my patch if the tree is
> normally not rebased).

Based on the new "Documentation/maintainer/rebasing-and-merging.rst",
I'm under the impression that we shouldn't be rebasing, even for
"just" adding tags.  Waiting for tags before pushing out to next-
integrity is causing delays, but we're trying out this approach.  So
for now, I've included your commit.

thanks,

Mimi

RE: linux-next: build failure after merge of the integrity tree

[Roberto Sassu]

> From: Stephen Rothwell [mailto:sfr@canb.auug.org.au]
> Sent: Tuesday, February 7, 2023 1:51 AM
> Hi all,
> 
> After merging the integrity tree, today's linux-next build (x86_64
> allmodconfig) failed like this:
> 
> security/integrity/ima/ima_main.c: In function 'ima_file_mprotect':
> security/integrity/ima/ima_main.c:473:34: error: implicit declaration of
> function 'file_mnt_user_ns'; did you mean 'get_user_ns'? [-Werror=implicit-
> function-declaration]
>   473 |         action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
>       |                                  ^~~~~~~~~~~~~~~~
>       |                                  get_user_ns
> security/integrity/ima/ima_main.c:473:34: error: passing argument 1 of
> 'ima_get_action' makes pointer from integer without a cast [-Werror=int-
> conversion]
>   473 |         action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
>       |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>       |                                  |
>       |                                  int
> In file included from security/integrity/ima/ima_main.c:30:
> security/integrity/ima/ima.h:258:38: note: expected 'struct mnt_idmap *' but
> argument is of type 'int'
>   258 | int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
>       |                    ~~~~~~~~~~~~~~~~~~^~~~~
> cc1: all warnings being treated as errors
> 
> Caused by commit
> 
>   4958db3245fa ("ima: Introduce MMAP_CHECK_REQPROT hook")
> 
> interacting with commit
> 
>   39f60c1ccee7 ("fs: port xattr to mnt_idmap")
> 
> from the vfs-idmapping tree.
> 
> I have applied the following merge fix patch for today.

Hi Stephen

the fix looks ok for me.

Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>

Thanks

Roberto

> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Tue, 7 Feb 2023 11:31:16 +1100
> Subject: [PATCH] fixup for "ima: Introduce MMAP_CHECK_REQPROT hook"
> 
> interacting with "fs: port xattr to mnt_idmap"
> 
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
>  security/integrity/ima/ima_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/integrity/ima/ima_main.c
> b/security/integrity/ima/ima_main.c
> index 7a05af9f481f..d66a0a36415e 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -470,7 +470,7 @@ int ima_file_mprotect(struct vm_area_struct *vma,
> unsigned long prot)
>  	action = ima_get_action(file_mnt_idmap(vma->vm_file), inode,
>  				current_cred(), secid, MAY_EXEC,
> MMAP_CHECK,
>  				&pcr, &template, NULL, NULL);
> -	action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
> +	action |= ima_get_action(file_mnt_idmap(vma->vm_file), inode,
>  				 current_cred(), secid, MAY_EXEC,
>  				 MMAP_CHECK_REQPROT, &pcr, &template,
> NULL,
>  				 NULL);
> --
> 2.35.1
> x
> --
> Cheers,
> Stephen Rothwell

linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 2626 bytes --]

Hi all,

After merging the integrity tree, today's linux-next build (x86_64
allmodconfig) failed like this:

security/integrity/ima/ima_main.c: In function 'ima_file_mprotect':
security/integrity/ima/ima_main.c:473:34: error: implicit declaration of function 'file_mnt_user_ns'; did you mean 'get_user_ns'? [-Werror=implicit-function-declaration]
  473 |         action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
      |                                  ^~~~~~~~~~~~~~~~
      |                                  get_user_ns
security/integrity/ima/ima_main.c:473:34: error: passing argument 1 of 'ima_get_action' makes pointer from integer without a cast [-Werror=int-conversion]
  473 |         action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                  |
      |                                  int
In file included from security/integrity/ima/ima_main.c:30:
security/integrity/ima/ima.h:258:38: note: expected 'struct mnt_idmap *' but argument is of type 'int'
  258 | int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
      |                    ~~~~~~~~~~~~~~~~~~^~~~~
cc1: all warnings being treated as errors

Caused by commit

  4958db3245fa ("ima: Introduce MMAP_CHECK_REQPROT hook")

interacting with commit

  39f60c1ccee7 ("fs: port xattr to mnt_idmap")

from the vfs-idmapping tree.

I have applied the following merge fix patch for today.

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Tue, 7 Feb 2023 11:31:16 +1100
Subject: [PATCH] fixup for "ima: Introduce MMAP_CHECK_REQPROT hook"

interacting with "fs: port xattr to mnt_idmap"

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 security/integrity/ima/ima_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 7a05af9f481f..d66a0a36415e 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -470,7 +470,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
 	action = ima_get_action(file_mnt_idmap(vma->vm_file), inode,
 				current_cred(), secid, MAY_EXEC, MMAP_CHECK,
 				&pcr, &template, NULL, NULL);
-	action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
+	action |= ima_get_action(file_mnt_idmap(vma->vm_file), inode,
 				 current_cred(), secid, MAY_EXEC,
 				 MMAP_CHECK_REQPROT, &pcr, &template, NULL,
 				 NULL);
-- 
2.35.1
x
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the integrity tree

[Mimi Zohar]

Hi Stephen,

On Fri, 2019-06-14 at 15:34 +1000, Stephen Rothwell wrote:
> Hi all,
> 
> After merging the integrity tree, today's linux-next build (powerpc
> ppc64_defconfig) failed like this:
> 
> drivers/infiniband/core/device.c: In function 'ib_core_init':
> drivers/infiniband/core/device.c:2531:8: error: implicit declaration of function 'register_blocking_lsm_notifier'; did you mean 'register_lsm_notifier'? [-Werror=implicit-function-declaration]
>   ret = register_blocking_lsm_notifier(&ibdev_lsm_nb);
>         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>         register_lsm_notifier
> drivers/infiniband/core/device.c:2550:2: error: implicit declaration of function 'unregister_blocking_lsm_notifier'; did you mean 'unregister_lsm_notifier'? [-Werror=implicit-function-declaration]
>   unregister_blocking_lsm_notifier(&ibdev_lsm_nb);
>   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>   unregister_lsm_notifier
> 
> Caused by commit
> 
>   bafe78e69508 ("LSM: switch to blocking policy update notifiers")
> 
> CONFIG_SECURITY is not set for this build and the !CONFIG_SECURITY
> declarations were not fixed up in linux/security.h.
> 
> I have used the integrity tree from next-20190613 for today.

Thank you!  A new version of the patch has been push to the next-
integrity branch.

Mimi

linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]

Hi all,

After merging the integrity tree, today's linux-next build (powerpc
ppc64_defconfig) failed like this:

drivers/infiniband/core/device.c: In function 'ib_core_init':
drivers/infiniband/core/device.c:2531:8: error: implicit declaration of function 'register_blocking_lsm_notifier'; did you mean 'register_lsm_notifier'? [-Werror=implicit-function-declaration]
  ret = register_blocking_lsm_notifier(&ibdev_lsm_nb);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        register_lsm_notifier
drivers/infiniband/core/device.c:2550:2: error: implicit declaration of function 'unregister_blocking_lsm_notifier'; did you mean 'unregister_lsm_notifier'? [-Werror=implicit-function-declaration]
  unregister_blocking_lsm_notifier(&ibdev_lsm_nb);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  unregister_lsm_notifier

Caused by commit

  bafe78e69508 ("LSM: switch to blocking policy update notifiers")

CONFIG_SECURITY is not set for this build and the !CONFIG_SECURITY
declarations were not fixed up in linux/security.h.

I have used the integrity tree from next-20190613 for today.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 143 bytes --]

Hi Mimi,

On Tue, 17 Jul 2018 09:18:06 -0400 Mimi Zohar <zohar@linux.ibm.com> wrote:
>
> Done

Thanks

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the integrity tree

[Mimi Zohar]

On Tue, 2018-07-17 at 14:40 +1000, Stephen Rothwell wrote:
> Hi all,
> 
> After merging the integrity tree, today's linux-next build (x86_64
> allmodconfig) failed like this:
> 
> security/integrity/ima/ima_main.c:549:5: error: redefinition of 'ima_load_data'
>  int ima_load_data(enum kernel_load_data_id id)
>      ^~~~~~~~~~~~~
> security/integrity/ima/ima_main.c:506:5: note: previous definition of 'ima_load_data' was here
>  int ima_load_data(enum kernel_load_data_id id)
>      ^~~~~~~~~~~~~
> 
> Caused by commit
> 
>   4995c7ac4490 ("ima: based on policy require signed kexec kernel images")
> 
> interacting with commit
> 
>   16c267aac86b ("ima: based on policy require signed kexec kernel images")
> 
> from the sceurity tree.
> 
> Basically the same set of patches are in the security tree and the
> integrity tree as different commits.  The merge managed to add this
> function twice.  I have added a patche to remove one copy of the function.
> 
> Please clean up the integrity tree relative to the security tree.

Done

linux-next: build failure after merge of the integrity tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 977 bytes --]

Hi all,

After merging the integrity tree, today's linux-next build (x86_64
allmodconfig) failed like this:

security/integrity/ima/ima_main.c:549:5: error: redefinition of 'ima_load_data'
 int ima_load_data(enum kernel_load_data_id id)
     ^~~~~~~~~~~~~
security/integrity/ima/ima_main.c:506:5: note: previous definition of 'ima_load_data' was here
 int ima_load_data(enum kernel_load_data_id id)
     ^~~~~~~~~~~~~

Caused by commit

  4995c7ac4490 ("ima: based on policy require signed kexec kernel images")

interacting with commit

  16c267aac86b ("ima: based on policy require signed kexec kernel images")

from the sceurity tree.

Basically the same set of patches are in the security tree and the
integrity tree as different commits.  The merge managed to add this
function twice.  I have added a patche to remove one copy of the function.

Please clean up the integrity tree relative to the security tree.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]