All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Seth Forshee (DigitalOcean)" <sforshee@kernel.org>
To: Christian Brauner <brauner@kernel.org>,
	 Seth Forshee <sforshee@kernel.org>,
	Serge Hallyn <serge@hallyn.com>,
	 Paul Moore <paul@paul-moore.com>, Eric Paris <eparis@redhat.com>,
	 James Morris <jmorris@namei.org>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	 Jan Kara <jack@suse.cz>,
	Stephen Smalley <stephen.smalley.work@gmail.com>,
	 Ondrej Mosnacek <omosnace@redhat.com>,
	 Casey Schaufler <casey@schaufler-ca.com>,
	Mimi Zohar <zohar@linux.ibm.com>,
	 Roberto Sassu <roberto.sassu@huawei.com>,
	 Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	 Eric Snowberg <eric.snowberg@oracle.com>,
	 "Matthew Wilcox (Oracle)" <willy@infradead.org>,
	 Jonathan Corbet <corbet@lwn.net>,
	Miklos Szeredi <miklos@szeredi.hu>,
	 Amir Goldstein <amir73il@gmail.com>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	 linux-security-module@vger.kernel.org, audit@vger.kernel.org,
	 selinux@vger.kernel.org, linux-integrity@vger.kernel.org,
	 linux-doc@vger.kernel.org, linux-unionfs@vger.kernel.org
Subject: [PATCH v2 01/25] mnt_idmapping: split out core vfs[ug]id_t definitions into vfsid.h
Date: Wed, 21 Feb 2024 15:24:32 -0600	[thread overview]
Message-ID: <20240221-idmap-fscap-refactor-v2-1-3039364623bd@kernel.org> (raw)
In-Reply-To: <20240221-idmap-fscap-refactor-v2-0-3039364623bd@kernel.org>

The rootid member of cpu_vfs_cap_data is a kuid_t, but it should be a
vfsuid_t as the id stored there is mapped into the mount idmapping. It's
currently impossible to use vfsuid_t within cred.h though as it is
defined in mnt_idmapping.h, which uses definitions from cred.h.

Split out the core vfsid type definitions into a separate file which can
be included from cred.h.

Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
---
 MAINTAINERS                   |  1 +
 include/linux/mnt_idmapping.h | 66 +-------------------------------------
 include/linux/vfsid.h         | 74 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 65 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 73d898383e51..6286d78a759a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8210,6 +8210,7 @@ S:	Maintained
 F:	Documentation/filesystems/idmappings.rst
 F:	fs/mnt_idmapping.c
 F:	include/linux/mnt_idmapping.*
+F:	include/linux/vfsid.h
 F:	tools/testing/selftests/mount_setattr/
 
 FILESYSTEMS [IOMAP]
diff --git a/include/linux/mnt_idmapping.h b/include/linux/mnt_idmapping.h
index cd4d5c8781f5..f463b9e1e258 100644
--- a/include/linux/mnt_idmapping.h
+++ b/include/linux/mnt_idmapping.h
@@ -4,6 +4,7 @@
 
 #include <linux/types.h>
 #include <linux/uidgid.h>
+#include <linux/vfsid.h>
 
 struct mnt_idmap;
 struct user_namespace;
@@ -11,61 +12,6 @@ struct user_namespace;
 extern struct mnt_idmap nop_mnt_idmap;
 extern struct user_namespace init_user_ns;
 
-typedef struct {
-	uid_t val;
-} vfsuid_t;
-
-typedef struct {
-	gid_t val;
-} vfsgid_t;
-
-static_assert(sizeof(vfsuid_t) == sizeof(kuid_t));
-static_assert(sizeof(vfsgid_t) == sizeof(kgid_t));
-static_assert(offsetof(vfsuid_t, val) == offsetof(kuid_t, val));
-static_assert(offsetof(vfsgid_t, val) == offsetof(kgid_t, val));
-
-#ifdef CONFIG_MULTIUSER
-static inline uid_t __vfsuid_val(vfsuid_t uid)
-{
-	return uid.val;
-}
-
-static inline gid_t __vfsgid_val(vfsgid_t gid)
-{
-	return gid.val;
-}
-#else
-static inline uid_t __vfsuid_val(vfsuid_t uid)
-{
-	return 0;
-}
-
-static inline gid_t __vfsgid_val(vfsgid_t gid)
-{
-	return 0;
-}
-#endif
-
-static inline bool vfsuid_valid(vfsuid_t uid)
-{
-	return __vfsuid_val(uid) != (uid_t)-1;
-}
-
-static inline bool vfsgid_valid(vfsgid_t gid)
-{
-	return __vfsgid_val(gid) != (gid_t)-1;
-}
-
-static inline bool vfsuid_eq(vfsuid_t left, vfsuid_t right)
-{
-	return vfsuid_valid(left) && __vfsuid_val(left) == __vfsuid_val(right);
-}
-
-static inline bool vfsgid_eq(vfsgid_t left, vfsgid_t right)
-{
-	return vfsgid_valid(left) && __vfsgid_val(left) == __vfsgid_val(right);
-}
-
 /**
  * vfsuid_eq_kuid - check whether kuid and vfsuid have the same value
  * @vfsuid: the vfsuid to compare
@@ -96,16 +42,6 @@ static inline bool vfsgid_eq_kgid(vfsgid_t vfsgid, kgid_t kgid)
 	return vfsgid_valid(vfsgid) && __vfsgid_val(vfsgid) == __kgid_val(kgid);
 }
 
-/*
- * vfs{g,u}ids are created from k{g,u}ids.
- * We don't allow them to be created from regular {u,g}id.
- */
-#define VFSUIDT_INIT(val) (vfsuid_t){ __kuid_val(val) }
-#define VFSGIDT_INIT(val) (vfsgid_t){ __kgid_val(val) }
-
-#define INVALID_VFSUID VFSUIDT_INIT(INVALID_UID)
-#define INVALID_VFSGID VFSGIDT_INIT(INVALID_GID)
-
 /*
  * Allow a vfs{g,u}id to be used as a k{g,u}id where we want to compare
  * whether the mapped value is identical to value of a k{g,u}id.
diff --git a/include/linux/vfsid.h b/include/linux/vfsid.h
new file mode 100644
index 000000000000..90262944b042
--- /dev/null
+++ b/include/linux/vfsid.h
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_MNT_VFSID_H
+#define _LINUX_MNT_VFSID_H
+
+#include <linux/types.h>
+#include <linux/uidgid.h>
+#include <linux/build_bug.h>
+
+typedef struct {
+	uid_t val;
+} vfsuid_t;
+
+typedef struct {
+	gid_t val;
+} vfsgid_t;
+
+static_assert(sizeof(vfsuid_t) == sizeof(kuid_t));
+static_assert(sizeof(vfsgid_t) == sizeof(kgid_t));
+static_assert(offsetof(vfsuid_t, val) == offsetof(kuid_t, val));
+static_assert(offsetof(vfsgid_t, val) == offsetof(kgid_t, val));
+
+#ifdef CONFIG_MULTIUSER
+static inline uid_t __vfsuid_val(vfsuid_t uid)
+{
+	return uid.val;
+}
+
+static inline gid_t __vfsgid_val(vfsgid_t gid)
+{
+	return gid.val;
+}
+#else
+static inline uid_t __vfsuid_val(vfsuid_t uid)
+{
+	return 0;
+}
+
+static inline gid_t __vfsgid_val(vfsgid_t gid)
+{
+	return 0;
+}
+#endif
+
+static inline bool vfsuid_valid(vfsuid_t uid)
+{
+	return __vfsuid_val(uid) != (uid_t)-1;
+}
+
+static inline bool vfsgid_valid(vfsgid_t gid)
+{
+	return __vfsgid_val(gid) != (gid_t)-1;
+}
+
+static inline bool vfsuid_eq(vfsuid_t left, vfsuid_t right)
+{
+	return vfsuid_valid(left) && __vfsuid_val(left) == __vfsuid_val(right);
+}
+
+static inline bool vfsgid_eq(vfsgid_t left, vfsgid_t right)
+{
+	return vfsgid_valid(left) && __vfsgid_val(left) == __vfsgid_val(right);
+}
+
+/*
+ * vfs{g,u}ids are created from k{g,u}ids.
+ * We don't allow them to be created from regular {u,g}id.
+ */
+#define VFSUIDT_INIT(val) (vfsuid_t){ __kuid_val(val) }
+#define VFSGIDT_INIT(val) (vfsgid_t){ __kgid_val(val) }
+
+#define INVALID_VFSUID VFSUIDT_INIT(INVALID_UID)
+#define INVALID_VFSGID VFSGIDT_INIT(INVALID_GID)
+
+#endif /* _LINUX_MNT_VFSID_H */

-- 
2.43.0


  reply	other threads:[~2024-02-21 21:25 UTC|newest]

Thread overview: 87+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-21 21:24 [PATCH v2 00/25] fs: use type-safe uid representation for filesystem capabilities Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` Seth Forshee (DigitalOcean) [this message]
2024-02-22 14:09   ` [PATCH v2 01/25] mnt_idmapping: split out core vfs[ug]id_t definitions into vfsid.h Christian Brauner
2024-02-21 21:24 ` [PATCH v2 02/25] mnt_idmapping: include cred.h Seth Forshee (DigitalOcean)
2024-02-22 14:12   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 03/25] capability: add static asserts for comapatibility of vfs_cap_data and vfs_ns_cap_data Seth Forshee (DigitalOcean)
2024-02-22 14:23   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 04/25] capability: rename cpu_vfs_cap_data to vfs_caps Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 05/25] capability: use vfsuid_t for vfs_caps rootids Seth Forshee (DigitalOcean)
2024-02-22 14:25   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 06/25] capability: provide helpers for converting between xattrs and vfs_caps Seth Forshee (DigitalOcean)
2024-02-22 15:20   ` Christian Brauner
2024-02-22 15:38     ` Seth Forshee (DigitalOcean)
2024-02-23  8:08       ` Christian Brauner
2024-03-01 16:30   ` Roberto Sassu
2024-03-01 19:00     ` Seth Forshee (DigitalOcean)
2024-03-04  8:33       ` Roberto Sassu
2024-03-04 14:24         ` Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 07/25] capability: provide a helper for converting vfs_caps to xattr for userspace Seth Forshee (DigitalOcean)
2024-02-22 15:22   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 08/25] xattr: add is_fscaps_xattr() helper Seth Forshee (DigitalOcean)
2024-02-23  8:09   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 09/25] commoncap: use is_fscaps_xattr() Seth Forshee (DigitalOcean)
2024-02-23  8:10   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 10/25] xattr: " Seth Forshee (DigitalOcean)
2024-02-23  8:10   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 11/25] security: add hooks for set/get/remove of fscaps Seth Forshee (DigitalOcean)
2024-02-21 23:31   ` Paul Moore
2024-02-22  0:07     ` Seth Forshee (DigitalOcean)
2024-02-23  8:23   ` Christian Brauner
2024-03-01 15:59   ` Roberto Sassu
2024-03-01 18:50     ` Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 12/25] selinux: add hooks for fscaps operations Seth Forshee (DigitalOcean)
2024-02-21 23:38   ` Paul Moore
2024-02-22  0:10     ` Seth Forshee (DigitalOcean)
2024-02-22  0:19       ` Paul Moore
2024-02-22  0:28         ` Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 13/25] smack: " Seth Forshee (DigitalOcean)
2024-02-21 22:52   ` Casey Schaufler
2024-02-22  0:11     ` Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 14/25] evm: add support for fscaps security hooks Seth Forshee (DigitalOcean)
2024-03-01  9:19   ` Roberto Sassu
2024-03-01 12:54     ` Christian Brauner
2024-03-01 13:19       ` Roberto Sassu
2024-03-01 13:39         ` Christian Brauner
2024-03-01 14:39     ` Seth Forshee (DigitalOcean)
2024-03-01 15:04       ` Roberto Sassu
2024-03-04 15:01   ` Roberto Sassu
2024-02-21 21:24 ` [PATCH v2 15/25] security: call evm fscaps hooks from generic " Seth Forshee (DigitalOcean)
2024-02-21 23:43   ` Paul Moore
2024-02-22  0:20     ` Seth Forshee (DigitalOcean)
2024-02-22  0:37       ` Paul Moore
2024-02-21 21:24 ` [PATCH v2 16/25] fs: add inode operations to get/set/remove fscaps Seth Forshee (DigitalOcean)
2024-02-23  8:25   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 17/25] fs: add vfs_get_fscaps() Seth Forshee (DigitalOcean)
2024-02-23  8:28   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 18/25] fs: add vfs_set_fscaps() Seth Forshee (DigitalOcean)
2024-02-23  8:38   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 19/25] fs: add vfs_remove_fscaps() Seth Forshee (DigitalOcean)
2024-02-23  8:40   ` Christian Brauner
2024-02-21 21:24 ` [PATCH v2 20/25] ovl: add fscaps handlers Seth Forshee (DigitalOcean)
2024-02-23  9:04   ` Christian Brauner
2024-02-27 13:28   ` Amir Goldstein
2024-02-27 14:57     ` Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 21/25] ovl: use vfs_{get,set}_fscaps() for copy-up Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 22/25] fs: use vfs interfaces for capabilities xattrs Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 23/25] commoncap: remove cap_inode_getsecurity() Seth Forshee (DigitalOcean)
2024-02-21 21:24 ` [PATCH v2 24/25] commoncap: use vfs fscaps interfaces Seth Forshee (DigitalOcean)
2024-03-04 10:19   ` Roberto Sassu
2024-03-04 15:31     ` Seth Forshee (DigitalOcean)
2024-03-04 16:17       ` Roberto Sassu
2024-03-04 16:56         ` Seth Forshee (DigitalOcean)
2024-03-05  9:12           ` Christian Brauner
2024-03-05 12:46             ` Roberto Sassu
2024-03-05 16:26               ` Christian Brauner
2024-03-05 16:35                 ` Roberto Sassu
2024-03-05 17:03                   ` Seth Forshee (DigitalOcean)
2024-03-05 17:08                     ` Roberto Sassu
2024-03-05 17:11               ` Roberto Sassu
2024-03-05 20:17                 ` Seth Forshee (DigitalOcean)
2024-03-06  8:30                   ` Roberto Sassu
2024-03-06  2:17                 ` Mimi Zohar
2024-03-06  8:25                   ` Roberto Sassu
2024-03-06 12:56                     ` Mimi Zohar
2024-02-21 21:24 ` [PATCH v2 25/25] vfs: return -EOPNOTSUPP for fscaps from vfs_*xattr() Seth Forshee (DigitalOcean)
2024-02-22 15:27 ` [PATCH v2 00/25] fs: use type-safe uid representation for filesystem capabilities Christian Brauner
2024-02-22 16:28   ` Seth Forshee (DigitalOcean)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240221-idmap-fscap-refactor-v2-1-3039364623bd@kernel.org \
    --to=sforshee@kernel.org \
    --cc=amir73il@gmail.com \
    --cc=audit@vger.kernel.org \
    --cc=brauner@kernel.org \
    --cc=casey@schaufler-ca.com \
    --cc=corbet@lwn.net \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=eparis@redhat.com \
    --cc=eric.snowberg@oracle.com \
    --cc=jack@suse.cz \
    --cc=jmorris@namei.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux-unionfs@vger.kernel.org \
    --cc=miklos@szeredi.hu \
    --cc=omosnace@redhat.com \
    --cc=paul@paul-moore.com \
    --cc=roberto.sassu@huawei.com \
    --cc=selinux@vger.kernel.org \
    --cc=serge@hallyn.com \
    --cc=stephen.smalley.work@gmail.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=willy@infradead.org \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.