* [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock
@ 2022-01-31 18:57 Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 1/2] selinux: Fix selinux_sb_mnt_opts_compat() Scott Mayhew
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Scott Mayhew @ 2022-01-31 18:57 UTC (permalink / raw)
To: paul; +Cc: selinux, linux-nfs, linux-kernel
selinux_sb_mnt_opts_compat() is called under the sb_lock spinlock and
shouldn't be performing any memory allocations.
The first patch fixes this by parsing the sids at the same time the
context mount options are being parsed from the mount options string
and storing the parsed sids in the selinux_mnt_opts struct.
The second patch adds logic to selinux_set_mnt_opts() and
selinux_sb_remount() that checks to see if a sid has already been
parsed before calling parse_sid(), and adds the parsed sids to the
data being copied in selinux_fs_context_dup().
Scott Mayhew (2):
selinux: Fix selinux_sb_mnt_opts_compat()
selinux: try to use preparsed sid before calling parse_sid()
security/selinux/hooks.c | 147 ++++++++++++++++++++++++---------------
1 file changed, 92 insertions(+), 55 deletions(-)
--
2.31.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v3 1/2] selinux: Fix selinux_sb_mnt_opts_compat()
2022-01-31 18:57 [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Scott Mayhew
@ 2022-01-31 18:57 ` Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 2/2] selinux: try to use preparsed sid before calling parse_sid() Scott Mayhew
2022-02-01 21:44 ` [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Paul Moore
2 siblings, 0 replies; 4+ messages in thread
From: Scott Mayhew @ 2022-01-31 18:57 UTC (permalink / raw)
To: paul; +Cc: selinux, linux-nfs, linux-kernel
selinux_sb_mnt_opts_compat() is called under the sb_lock spinlock and
shouldn't be performing any memory allocations. Fix this by parsing the
sids at the same time we're chopping up the security mount options
string and then using the pre-parsed sids when doing the comparison.
Fixes: cc274ae7763d ("selinux: fix sleeping function called from invalid context")
Fixes: 69c4a42d72eb ("lsm,selinux: add new hook to compare new mount to an existing mount")
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
security/selinux/hooks.c | 75 ++++++++++++++++++++++------------------
1 file changed, 41 insertions(+), 34 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5b6895e4fc29..9645ff982ca5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -342,6 +342,10 @@ static void inode_free_security(struct inode *inode)
struct selinux_mnt_opts {
const char *fscontext, *context, *rootcontext, *defcontext;
+ u32 fscontext_sid;
+ u32 context_sid;
+ u32 rootcontext_sid;
+ u32 defcontext_sid;
};
static void selinux_free_mnt_opts(void *mnt_opts)
@@ -598,15 +602,14 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
return 0;
}
-static int parse_sid(struct super_block *sb, const char *s, u32 *sid,
- gfp_t gfp)
+static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
{
int rc = security_context_str_to_sid(&selinux_state, s,
- sid, gfp);
+ sid, GFP_KERNEL);
if (rc)
pr_warn("SELinux: security_context_str_to_sid"
"(%s) failed for (dev %s, type %s) errno=%d\n",
- s, sb->s_id, sb->s_type->name, rc);
+ s, sb ? sb->s_id : "?", sb ? sb->s_type->name : "?", rc);
return rc;
}
@@ -673,8 +676,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
*/
if (opts) {
if (opts->fscontext) {
- rc = parse_sid(sb, opts->fscontext, &fscontext_sid,
- GFP_KERNEL);
+ rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
if (rc)
goto out;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
@@ -683,8 +685,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= FSCONTEXT_MNT;
}
if (opts->context) {
- rc = parse_sid(sb, opts->context, &context_sid,
- GFP_KERNEL);
+ rc = parse_sid(sb, opts->context, &context_sid);
if (rc)
goto out;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
@@ -693,8 +694,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= CONTEXT_MNT;
}
if (opts->rootcontext) {
- rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid,
- GFP_KERNEL);
+ rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
if (rc)
goto out;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
@@ -703,8 +703,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= ROOTCONTEXT_MNT;
}
if (opts->defcontext) {
- rc = parse_sid(sb, opts->defcontext, &defcontext_sid,
- GFP_KERNEL);
+ rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
if (rc)
goto out;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
@@ -996,21 +995,29 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
if (opts->context || opts->defcontext)
goto err;
opts->context = s;
+ if (selinux_initialized(&selinux_state))
+ parse_sid(NULL, s, &opts->context_sid);
break;
case Opt_fscontext:
if (opts->fscontext)
goto err;
opts->fscontext = s;
+ if (selinux_initialized(&selinux_state))
+ parse_sid(NULL, s, &opts->fscontext_sid);
break;
case Opt_rootcontext:
if (opts->rootcontext)
goto err;
opts->rootcontext = s;
+ if (selinux_initialized(&selinux_state))
+ parse_sid(NULL, s, &opts->rootcontext_sid);
break;
case Opt_defcontext:
if (opts->context || opts->defcontext)
goto err;
opts->defcontext = s;
+ if (selinux_initialized(&selinux_state))
+ parse_sid(NULL, s, &opts->defcontext_sid);
break;
}
@@ -2648,8 +2655,6 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
{
struct selinux_mnt_opts *opts = mnt_opts;
struct superblock_security_struct *sbsec = sb->s_security;
- u32 sid;
- int rc;
/*
* Superblock not initialized (i.e. no options) - reject if any
@@ -2666,34 +2671,36 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
if (opts->fscontext) {
- rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT);
- if (rc)
+ if (opts->fscontext_sid == SECSID_NULL)
return 1;
- if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+ else if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
+ opts->fscontext_sid))
return 1;
}
if (opts->context) {
- rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT);
- if (rc)
+ if (opts->context_sid == SECSID_NULL)
return 1;
- if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+ else if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
+ opts->context_sid))
return 1;
}
if (opts->rootcontext) {
- struct inode_security_struct *root_isec;
-
- root_isec = backing_inode_security(sb->s_root);
- rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT);
- if (rc)
- return 1;
- if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+ if (opts->rootcontext_sid == SECSID_NULL)
return 1;
+ else {
+ struct inode_security_struct *root_isec;
+
+ root_isec = backing_inode_security(sb->s_root);
+ if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
+ opts->rootcontext_sid))
+ return 1;
+ }
}
if (opts->defcontext) {
- rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT);
- if (rc)
+ if (opts->defcontext_sid == SECSID_NULL)
return 1;
- if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+ else if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
+ opts->defcontext_sid))
return 1;
}
return 0;
@@ -2713,14 +2720,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
return 0;
if (opts->fscontext) {
- rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL);
+ rc = parse_sid(sb, opts->fscontext, &sid);
if (rc)
return rc;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
goto out_bad_option;
}
if (opts->context) {
- rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL);
+ rc = parse_sid(sb, opts->context, &sid);
if (rc)
return rc;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
@@ -2729,14 +2736,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
if (opts->rootcontext) {
struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root);
- rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL);
+ rc = parse_sid(sb, opts->rootcontext, &sid);
if (rc)
return rc;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
goto out_bad_option;
}
if (opts->defcontext) {
- rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL);
+ rc = parse_sid(sb, opts->defcontext, &sid);
if (rc)
return rc;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v3 2/2] selinux: try to use preparsed sid before calling parse_sid()
2022-01-31 18:57 [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 1/2] selinux: Fix selinux_sb_mnt_opts_compat() Scott Mayhew
@ 2022-01-31 18:57 ` Scott Mayhew
2022-02-01 21:44 ` [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Paul Moore
2 siblings, 0 replies; 4+ messages in thread
From: Scott Mayhew @ 2022-01-31 18:57 UTC (permalink / raw)
To: paul; +Cc: selinux, linux-nfs, linux-kernel
Avoid unnecessary parsing of sids that have already been parsed via
selinux_sb_eat_lsm_opts().
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
security/selinux/hooks.c | 88 +++++++++++++++++++++++++++-------------
1 file changed, 59 insertions(+), 29 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9645ff982ca5..05d24b7a68cf 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -676,36 +676,48 @@ static int selinux_set_mnt_opts(struct super_block *sb,
*/
if (opts) {
if (opts->fscontext) {
- rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
- if (rc)
- goto out;
+ if (opts->fscontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
+ if (rc)
+ goto out;
+ } else
+ fscontext_sid = opts->fscontext_sid;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
fscontext_sid))
goto out_double_mount;
sbsec->flags |= FSCONTEXT_MNT;
}
if (opts->context) {
- rc = parse_sid(sb, opts->context, &context_sid);
- if (rc)
- goto out;
+ if (opts->context_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->context, &context_sid);
+ if (rc)
+ goto out;
+ } else
+ context_sid = opts->context_sid;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
context_sid))
goto out_double_mount;
sbsec->flags |= CONTEXT_MNT;
}
if (opts->rootcontext) {
- rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
- if (rc)
- goto out;
+ if (opts->rootcontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
+ if (rc)
+ goto out;
+ } else
+ rootcontext_sid = opts->rootcontext_sid;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
rootcontext_sid))
goto out_double_mount;
sbsec->flags |= ROOTCONTEXT_MNT;
}
if (opts->defcontext) {
- rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
- if (rc)
- goto out;
+ if (opts->defcontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
+ if (rc)
+ goto out;
+ } else
+ defcontext_sid = opts->defcontext_sid;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
defcontext_sid))
goto out_double_mount;
@@ -2710,7 +2722,6 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
{
struct selinux_mnt_opts *opts = mnt_opts;
struct superblock_security_struct *sbsec = selinux_superblock(sb);
- u32 sid;
int rc;
if (!(sbsec->flags & SE_SBINITIALIZED))
@@ -2720,33 +2731,48 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
return 0;
if (opts->fscontext) {
- rc = parse_sid(sb, opts->fscontext, &sid);
- if (rc)
- return rc;
- if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+ if (opts->fscontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->fscontext,
+ &opts->fscontext_sid);
+ if (rc)
+ return rc;
+ }
+ if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
+ opts->fscontext_sid))
goto out_bad_option;
}
if (opts->context) {
- rc = parse_sid(sb, opts->context, &sid);
- if (rc)
- return rc;
- if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+ if (opts->context_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->context, &opts->context_sid);
+ if (rc)
+ return rc;
+ }
+ if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
+ opts->context_sid))
goto out_bad_option;
}
if (opts->rootcontext) {
struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root);
- rc = parse_sid(sb, opts->rootcontext, &sid);
- if (rc)
- return rc;
- if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+ if (opts->rootcontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->rootcontext,
+ &opts->rootcontext_sid);
+ if (rc)
+ return rc;
+ }
+ if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
+ opts->rootcontext_sid))
goto out_bad_option;
}
if (opts->defcontext) {
- rc = parse_sid(sb, opts->defcontext, &sid);
- if (rc)
- return rc;
- if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+ if (opts->defcontext_sid == SECSID_NULL) {
+ rc = parse_sid(sb, opts->defcontext,
+ &opts->defcontext_sid);
+ if (rc)
+ return rc;
+ }
+ if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
+ opts->defcontext_sid))
goto out_bad_option;
}
return 0;
@@ -2844,6 +2870,10 @@ static int selinux_fs_context_dup(struct fs_context *fc,
if (!opts->defcontext)
return -ENOMEM;
}
+ opts->fscontext_sid = src->fscontext_sid;
+ opts->context_sid = src->context_sid;
+ opts->rootcontext_sid = src->rootcontext_sid;
+ opts->defcontext_sid = src->defcontext_sid;
return 0;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock
2022-01-31 18:57 [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 1/2] selinux: Fix selinux_sb_mnt_opts_compat() Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 2/2] selinux: try to use preparsed sid before calling parse_sid() Scott Mayhew
@ 2022-02-01 21:44 ` Paul Moore
2 siblings, 0 replies; 4+ messages in thread
From: Paul Moore @ 2022-02-01 21:44 UTC (permalink / raw)
To: Scott Mayhew; +Cc: selinux, linux-nfs, linux-kernel
On Mon, Jan 31, 2022 at 1:57 PM Scott Mayhew <smayhew@redhat.com> wrote:
>
> selinux_sb_mnt_opts_compat() is called under the sb_lock spinlock and
> shouldn't be performing any memory allocations.
>
> The first patch fixes this by parsing the sids at the same time the
> context mount options are being parsed from the mount options string
> and storing the parsed sids in the selinux_mnt_opts struct.
>
> The second patch adds logic to selinux_set_mnt_opts() and
> selinux_sb_remount() that checks to see if a sid has already been
> parsed before calling parse_sid(), and adds the parsed sids to the
> data being copied in selinux_fs_context_dup().
>
> Scott Mayhew (2):
> selinux: Fix selinux_sb_mnt_opts_compat()
> selinux: try to use preparsed sid before calling parse_sid()
>
> security/selinux/hooks.c | 147 ++++++++++++++++++++++++---------------
> 1 file changed, 92 insertions(+), 55 deletions(-)
Merged both into selinux/next, thanks Scott.
--
paul-moore.com
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-02-01 21:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-31 18:57 [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 1/2] selinux: Fix selinux_sb_mnt_opts_compat() Scott Mayhew
2022-01-31 18:57 ` [PATCH v3 2/2] selinux: try to use preparsed sid before calling parse_sid() Scott Mayhew
2022-02-01 21:44 ` [PATCH v3 0/2] selinux: parse sids earlier to avoid doing memory allocations under spinlock Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).