From: Casey Schaufler <email@example.com>
To: Paul Moore <firstname.lastname@example.org>, Matthew Wilcox <email@example.com>
Cc: "Eric W. Biederman" <firstname.lastname@example.org>,
Stephen Smalley <email@example.com>,
Stephen Brennan <firstname.lastname@example.org>,
Alexey Dobriyan <email@example.com>,
James Morris <firstname.lastname@example.org>,
"Serge E. Hallyn" <email@example.com>,
Eric Paris <firstname.lastname@example.org>,
email@example.com, Alexander Viro <firstname.lastname@example.org>,
Casey Schaufler <email@example.com>
Subject: Re: [PATCH v2] proc: Allow pid_revalidate() during LOOKUP_RCU
Date: Tue, 15 Dec 2020 10:09:15 -0800 [thread overview]
Message-ID: <firstname.lastname@example.org> (raw)
On 12/13/2020 3:00 PM, Paul Moore wrote:
> On Sun, Dec 13, 2020 at 11:30 AM Matthew Wilcox <email@example.com> wrote:
>> On Sun, Dec 13, 2020 at 08:22:32AM -0600, Eric W. Biederman wrote:
>>> Matthew Wilcox <firstname.lastname@example.org> writes:
>>>> On Thu, Dec 03, 2020 at 04:02:12PM -0800, Stephen Brennan wrote:
>>>>> -void pid_update_inode(struct task_struct *task, struct inode *inode)
>>>>> +static int do_pid_update_inode(struct task_struct *task, struct inode *inode,
>>>>> + unsigned int flags)
>>>> I'm really nitpicking here, but this function only _updates_ the inode
>>>> if flags says it should. So I was thinking something like this
>>>> (compile tested only).
>>>> I'd really appreocate feedback from someone like Casey or Stephen on
>>>> what they need for their security modules.
>>> Just so we don't have security module questions confusing things
>>> can we please make this a 2 patch series? With the first
>>> patch removing security_task_to_inode?
>>> The justification for the removal is that all security_task_to_inode
>>> appears to care about is the file type bits in inode->i_mode. Something
>>> that never changes. Having this in a separate patch would make that
>>> logical change easier to verify.
>> I don't think that's right, which is why I keep asking Stephen & Casey
>> for their thoughts.
> The SELinux security_task_to_inode() implementation only cares about
> inode->i_mode S_IFMT bits from the inode so that we can set the object
> class correctly. The inode's SELinux label is taken from the
> associated task.
> Casey would need to comment on Smack's needs.
SELinux uses different "class"es on subjects and objects.
Smack does not differentiate, so knows the label it wants
the inode to have when smack_task_to_inode() is called,
and sets it accordingly. Nothing is allocated in the process,
and the new value is coming from the Smack master label list.
It isn't going to go away. It appears that this is the point
of the hook. Am I missing something?
>> For example,
>> * Sets the smack pointer in the inode security blob
>> static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
>> struct inode_smack *isp = smack_inode(inode);
>> struct smack_known *skp = smk_of_task_struct(p);
>> isp->smk_inode = skp;
>> isp->smk_flags |= SMK_INODE_INSTANT;
>> That seems to do rather more than checking the file type bits.
next prev parent reply other threads:[~2020-12-15 18:10 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-04 0:02 [PATCH v2] proc: Allow pid_revalidate() during LOOKUP_RCU Stephen Brennan
2020-12-12 20:55 ` Matthew Wilcox
2020-12-13 14:22 ` Eric W. Biederman
2020-12-13 16:29 ` Matthew Wilcox
2020-12-13 23:00 ` Paul Moore
2020-12-15 18:09 ` Casey Schaufler [this message]
2020-12-15 22:04 ` Eric W. Biederman
2020-12-15 22:53 ` Casey Schaufler
2020-12-16 1:05 ` Stephen Brennan
2020-12-14 18:45 ` Casey Schaufler
2020-12-14 18:15 ` Stephen Brennan
2020-12-13 14:30 ` Eric W. Biederman
2020-12-13 16:32 ` Matthew Wilcox
2020-12-14 17:19 ` Stephen Brennan
2020-12-15 21:45 ` Eric W. Biederman
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).