* Denying access from sb_umount issue
@ 2020-01-27 20:34 Alexander Ivanov
2020-01-27 20:58 ` James Morris
0 siblings, 1 reply; 3+ messages in thread
From: Alexander Ivanov @ 2020-01-27 20:34 UTC (permalink / raw)
To: linux-security-module
The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls
dput(path.dentry);
mntput_no_expire(mnt);
regardless of what do_mount() returns?
Thanks,
--Alex
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Denying access from sb_umount issue
2020-01-27 20:34 Denying access from sb_umount issue Alexander Ivanov
@ 2020-01-27 20:58 ` James Morris
2020-01-27 21:10 ` Alexander Ivanov
0 siblings, 1 reply; 3+ messages in thread
From: James Morris @ 2020-01-27 20:58 UTC (permalink / raw)
To: Alexander Ivanov; +Cc: linux-security-module
On Mon, 27 Jan 2020, Alexander Ivanov wrote:
> The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls
>
> dput(path.dentry);
> mntput_no_expire(mnt);
>
> regardless of what do_mount() returns?
You mean do_umount()?
There are several other do_umount() error cases which would have the same
behavior, right after security_sb_umount().
What error codes are you seeing for the consecutive failures?
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Denying access from sb_umount issue
2020-01-27 20:58 ` James Morris
@ 2020-01-27 21:10 ` Alexander Ivanov
0 siblings, 0 replies; 3+ messages in thread
From: Alexander Ivanov @ 2020-01-27 21:10 UTC (permalink / raw)
To: James Morris; +Cc: linux-security-module
On Mon, 27 Jan 2020 12:58 -08:00, James Morris <jmorris@namei.org> wrote:
> On Mon, 27 Jan 2020, Alexander Ivanov wrote:
>
> > The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls
> >
> > dput(path.dentry);
> > mntput_no_expire(mnt);
> >
> > regardless of what do_mount() returns?
>
> You mean do_umount()?
>
yes, typo, sorry.
> There are several other do_umount() error cases which would have the same
> behavior, right after security_sb_umount().
>
We do umount with MNT_DETACH, thus those early returns seem not applicable?
> What error codes are you seeing for the consecutive failures?
>
We got EBUSY.
Thanks,
--Alex
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-27 21:09 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-27 20:34 Denying access from sb_umount issue Alexander Ivanov
2020-01-27 20:58 ` James Morris
2020-01-27 21:10 ` Alexander Ivanov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).