linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v3 0/1] Relax restrictions on user.* xattr
@ 2021-09-02 15:22 Vivek Goyal
  2021-09-02 15:22 ` [PATCH v3 1/1] xattr: Allow user.* xattr on symlink and special files Vivek Goyal
                   ` (5 more replies)
  0 siblings, 6 replies; 39+ messages in thread
From: Vivek Goyal @ 2021-09-02 15:22 UTC (permalink / raw)
  To: viro
  Cc: linux-fsdevel, linux-kernel, virtio-fs, dwalsh, dgilbert, vgoyal,
	christian.brauner, casey.schaufler, linux-security-module,
	selinux, tytso, miklos, gscrivan, bfields, stephen.smalley.work,
	agruenba, david

Hi,

This is V3 of the patch. Previous versions were posted here.

v2:
https://lore.kernel.org/linux-fsdevel/20210708175738.360757-1-vgoyal@redhat.com/
v1:
https://lore.kernel.org/linux-fsdevel/20210625191229.1752531-1-vgoyal@redhat.co
+m/

Changes since v2
----------------
- Do not call inode_permission() for special files as file mode bits
  on these files represent permissions to read/write from/to device
  and not necessarily permission to read/write xattrs. In this case
  now user.* extended xattrs can be read/written on special files
  as long as caller is owner of file or has CAP_FOWNER.
 
- Fixed "man xattr". Will post a patch in same thread little later. (J.
  Bruce Fields)

- Fixed xfstest 062. Changed it to run only on older kernels where
  user extended xattrs are not allowed on symlinks/special files. Added
  a new replacement test 648 which does exactly what 062. Just that
  it is supposed to run on newer kernels where user extended xattrs
  are allowed on symlinks and special files. Will post patch in 
  same thread (Ted Ts'o).

Testing
-------
- Ran xfstest "./check -g auto" with and without patches and did not
  notice any new failures.

- Tested setting "user.*" xattr with ext4/xfs/btrfs/overlay/nfs
  filesystems and it works.
 
Description
===========

Right now we don't allow setting user.* xattrs on symlinks and special
files at all. Initially I thought that real reason behind this
restriction is quota limitations but from last conversation it seemed
that real reason is that permission bits on symlink and special files
are special and different from regular files and directories, hence
this restriction is in place. (I tested with xfs user quota enabled and
quota restrictions kicked in on symlink).

This version of patch allows reading/writing user.* xattr on symlink and
special files if caller is owner or priviliged (has CAP_FOWNER) w.r.t inode.

Who wants to set user.* xattr on symlink/special files
-----------------------------------------------------
I have primarily two users at this point of time.

- virtiofs daemon.

- fuse-overlay. Giuseppe, seems to set user.* xattr attrs on unpriviliged
  fuse-overlay as well and he ran into similar issue. So fuse-overlay
  should benefit from this change as well.

Why virtiofsd wants to set user.* xattr on symlink/special files
----------------------------------------------------------------
In virtiofs, actual file server is virtiosd daemon running on host.
There we have a mode where xattrs can be remapped to something else.
For example security.selinux can be remapped to
user.virtiofsd.securit.selinux on the host.

This remapping is useful when SELinux is enabled in guest and virtiofs
as being used as rootfs. Guest and host SELinux policy might not match
and host policy might deny security.selinux xattr setting by guest
onto host. Or host might have SELinux disabled and in that case to
be able to set security.selinux xattr, virtiofsd will need to have
CAP_SYS_ADMIN (which we are trying to avoid). Being able to remap
guest security.selinux (or other xattrs) on host to something else
is also better from security point of view.

But when we try this, we noticed that SELinux relabeling in guest
is failing on some symlinks. When I debugged a little more, I
came to know that "user.*" xattrs are not allowed on symlinks
or special files.

So if we allow owner (or CAP_FOWNER) to set user.* xattr, it will
allow virtiofs to arbitrarily remap guests's xattrs to something
else on host and that solves this SELinux issue nicely and provides
two SELinux policies (host and guest) to co-exist nicely without
interfering with each other.

Thanks
Vivek

Vivek Goyal (1):
  xattr: Allow user.* xattr on symlink and special files

 fs/xattr.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

-- 
2.31.1


^ permalink raw reply	[flat|nested] 39+ messages in thread

end of thread, other threads:[~2021-09-15 17:00 UTC | newest]

Thread overview: 39+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02 15:22 [PATCH v3 0/1] Relax restrictions on user.* xattr Vivek Goyal
2021-09-02 15:22 ` [PATCH v3 1/1] xattr: Allow user.* xattr on symlink and special files Vivek Goyal
2021-09-02 15:38 ` [PATCH 2/1] man-pages: xattr.7: Update text for user extended xattr behavior change Vivek Goyal
2021-09-02 15:43 ` [PATCH v3 0/1] Relax restrictions on user.* xattr Casey Schaufler
2021-09-02 17:05   ` Vivek Goyal
2021-09-02 17:42     ` Vivek Goyal
2021-09-02 18:55       ` Casey Schaufler
2021-09-02 20:06         ` Vivek Goyal
2021-09-02 22:34           ` Casey Schaufler
2021-09-03 15:26             ` Vivek Goyal
2021-09-03 18:49               ` Casey Schaufler
2021-09-06  7:45             ` [Virtio-fs] " Sergio Lopez
2021-09-06 14:55             ` Dr. David Alan Gilbert
2021-09-13 19:05               ` Casey Schaufler
2021-09-14 12:51                 ` Vivek Goyal
2021-09-14 13:56                   ` Casey Schaufler
2021-09-14 13:59                   ` Bruce Fields
2021-09-14 14:32                     ` Vivek Goyal
2021-09-14 15:01                       ` Bruce Fields
2021-09-15 16:33                       ` Dr. Greg
2021-09-02 15:47 ` [PATCH 3/1] xfstests: generic/062: Do not run on newer kernels Vivek Goyal
2021-09-03  4:55   ` Dave Chinner
2021-09-03  6:31   ` Andreas Gruenbacher
2021-09-03  6:56     ` Andreas Gruenbacher
2021-09-03 14:42       ` Bruce Fields
2021-09-03 15:43         ` Vivek Goyal
2021-09-03 15:50           ` Bruce Fields
2021-09-03 16:01             ` Casey Schaufler
2021-09-03 16:03             ` Vivek Goyal
2021-09-03  6:31   ` Zorro Lang
2021-09-02 15:50 ` [PATCH 4/1] xfstest: Add a new test to test xattr operations Vivek Goyal
2021-09-02 17:52 ` [PATCH v3 0/1] Relax restrictions on user.* xattr Andreas Gruenbacher
2021-09-02 18:48   ` Vivek Goyal
2021-09-02 19:19     ` Casey Schaufler
2021-09-06 14:39   ` Dr. David Alan Gilbert
2021-09-06 14:56     ` Miklos Szeredi
2021-09-07 21:40       ` Vivek Goyal
2021-09-08  7:37         ` Miklos Szeredi
2021-09-08 14:20           ` Eric W. Biederman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).