From: Ian Kent <raven@themaw.net>
To: Christoph Hellwig <hch@lst.de>,
Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ondrej Mosnacek <omosnace@redhat.com>,
Stephen Smalley <stephen.smalley.work@gmail.com>,
Al Viro <viro@zeniv.linux.org.uk>,
autofs@vger.kernel.org,
Linux Security Module list
<linux-security-module@vger.kernel.org>,
SElinux list <selinux@vger.kernel.org>,
Zdenek Pytela <zpytela@redhat.com>
Subject: Re: Commit 13c164b1a186 - regression for LSMs/SELinux?
Date: Wed, 30 Sep 2020 18:39:37 +0800 [thread overview]
Message-ID: <c1f38075cde1b51caa2e2e040c294d25bb650f85.camel@themaw.net> (raw)
In-Reply-To: <689756d7d7d73a8eb86d020b0dfeb976e28cc9b4.camel@themaw.net>
On Wed, 2020-09-30 at 13:50 +0800, Ian Kent wrote:
> On Tue, 2020-09-29 at 20:00 +0200, Christoph Hellwig wrote:
> > On Tue, Sep 29, 2020 at 10:23:50AM -0700, Linus Torvalds wrote:
> > > On Tue, Sep 29, 2020 at 5:16 AM Ondrej Mosnacek <
> > > omosnace@redhat.com> wrote:
> > > > OK, so it seems that reverting comes out as the best choice
> > > > here.
> > >
> > > Yeah.
> > >
> > > > BTW, I'm looking at rw_verify_area() and I see this "If (ppos)"
> > > > check
> > > > and the comment above it... And then I look at autofs_write(),
> > > > which
> > > > passes &file->f_pos, while ksys_write() passes file_ppos(file)
> > >
> > > Ok, that doesn't matter for the security_file_permission() issue,
> > > but
> > > yes, autofs is doing the traditional thing, and it's pointless.
> > > Using
> > > file_ppos(file) isn't an option since it's an inline to
> > > read_write.c,
> > > but it could just pass in NULL these days and avoid that too.
> > >
> > > So how about we just do the appended patch? Can whoever sees this
> > > problem just verify, even though it looks trivially correct...
> >
> > This looks sensible to me. I'd throw in a
> >
> > /* only for autofs, don't use in new code */
> >
> > near the export, but users of these kind of functions tend to be
> > blind copy and paste code anyway, so the comment probably isn't
> > even read by the relevant parties..
>
> I'll build a patched kernel and give it a whirl.
Duplicated the problem first then built a patched kernel and tested.
The patch makes the problem go away, communication to the daemon
is occurring fine so the use of NULL as the file position is ok.
It looks like the error returns should be as before which is good
but there may be another problem I need to fix in there that became
apparent because this problem drew attention to it. That's something
else entirely though.
>
> Ian
next prev parent reply other threads:[~2020-09-30 10:39 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-21 14:51 Commit 13c164b1a186 - regression for LSMs/SELinux? Ondrej Mosnacek
2020-09-21 16:09 ` Christoph Hellwig
2020-09-21 16:27 ` Linus Torvalds
2020-09-21 16:30 ` Al Viro
2020-09-22 0:30 ` Ian Kent
2020-09-22 1:35 ` Ian Kent
2020-09-22 7:33 ` Ondrej Mosnacek
2020-09-22 12:29 ` Stephen Smalley
2020-09-23 1:55 ` Ian Kent
2020-09-24 8:36 ` Ondrej Mosnacek
2020-09-24 9:47 ` Ian Kent
2020-09-24 14:16 ` Stephen Smalley
2020-09-25 3:37 ` Ian Kent
2020-09-25 3:44 ` Ian Kent
2020-09-25 13:37 ` Ondrej Mosnacek
2020-09-25 17:38 ` Linus Torvalds
2020-09-27 3:07 ` Ian Kent
2020-09-29 12:16 ` Ondrej Mosnacek
2020-09-29 17:23 ` Linus Torvalds
2020-09-29 18:00 ` Christoph Hellwig
2020-09-30 5:50 ` Ian Kent
2020-09-30 10:39 ` Ian Kent [this message]
2020-09-30 5:42 ` Ian Kent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c1f38075cde1b51caa2e2e040c294d25bb650f85.camel@themaw.net \
--to=raven@themaw.net \
--cc=autofs@vger.kernel.org \
--cc=hch@lst.de \
--cc=linux-security-module@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=zpytela@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).