mbox series

[v2,00/16] Tidy up file permission hooks

Message ID 20231122122715.2561213-1-amir73il@gmail.com (mailing list archive)
Headers show
Series Tidy up file permission hooks | expand

Message

Amir Goldstein Nov. 22, 2023, 12:26 p.m. UTC
Hi Christian,

During my work on fanotify "pre content" events [1], Jan and I noticed
some inconsistencies in the call sites of security_file_permission()
hooks inside rw_verify_area() and remap_verify_area().

The majority of call sites are before file_start_write(), which is how
we want them to be for fanotify "pre content" events.

For splice code, there are many duplicate calls to rw_verify_area()
for the entire range as well as for partial ranges inside iterator.

This cleanup series, mostly following Jan's suggestions, moves all
the security_file_permission() hooks before file_start_write() and
eliminates duplicate permission hook calls in the same call chain.

The last 3 patches are helpers that I used in fanotify patches to
assert that permission hooks are called with expected locking scope.

Please stage this work on a stable branch in the vfs tree, so that
I will be able to send Jan fanotify patches for "pre content" events
based on the stable vfs branch.

Thanks,
Amir.

Changes since v1:
- Split coda locking reorder patch (jaharkes)
- Fix vfs_iocb_iter_write() file_end_write() bug (Josef)
- Fix subtle allow_file_dedupe() bug (+rename) (brauner)
- Fix some minor review nits (brauner)
- Added RVB from Josef and Chuck

[1] https://github.com/amir73il/linux/commits/fan_pre_content

Amir Goldstein (16):
  ovl: add permission hooks outside of do_splice_direct()
  splice: remove permission hook from do_splice_direct()
  splice: move permission hook out of splice_direct_to_actor()
  splice: move permission hook out of splice_file_to_pipe()
  splice: remove permission hook from iter_file_splice_write()
  remap_range: move permission hooks out of do_clone_file_range()
  remap_range: move file_start_write() to after permission hook
  btrfs: move file_start_write() to after permission hook
  coda: change locking order in coda_file_write_iter()
  fs: move file_start_write() into vfs_iter_write()
  fs: move permission hook out of do_iter_write()
  fs: move permission hook out of do_iter_read()
  fs: move kiocb_start_write() into vfs_iocb_iter_write()
  fs: create __sb_write_started() helper
  fs: create file_write_started() helper
  fs: create {sb,file}_write_not_started() helpers

 drivers/block/loop.c   |   2 -
 fs/btrfs/ioctl.c       |  12 +--
 fs/cachefiles/io.c     |   5 +-
 fs/coda/file.c         |   2 -
 fs/internal.h          |   8 +-
 fs/nfsd/vfs.c          |   7 +-
 fs/overlayfs/copy_up.c |  26 +++++-
 fs/overlayfs/file.c    |  10 +--
 fs/read_write.c        | 177 ++++++++++++++++++++++++++++-------------
 fs/remap_range.c       |  37 +++++----
 fs/splice.c            |  78 ++++++++++--------
 include/linux/fs.h     |  62 ++++++++++++++-
 12 files changed, 297 insertions(+), 129 deletions(-)

Comments

Josef Bacik Nov. 22, 2023, 2:06 p.m. UTC | #1
On Wed, Nov 22, 2023 at 02:26:59PM +0200, Amir Goldstein wrote:
> Hi Christian,
> 
> During my work on fanotify "pre content" events [1], Jan and I noticed
> some inconsistencies in the call sites of security_file_permission()
> hooks inside rw_verify_area() and remap_verify_area().
> 
> The majority of call sites are before file_start_write(), which is how
> we want them to be for fanotify "pre content" events.
> 
> For splice code, there are many duplicate calls to rw_verify_area()
> for the entire range as well as for partial ranges inside iterator.
> 
> This cleanup series, mostly following Jan's suggestions, moves all
> the security_file_permission() hooks before file_start_write() and
> eliminates duplicate permission hook calls in the same call chain.
> 
> The last 3 patches are helpers that I used in fanotify patches to
> assert that permission hooks are called with expected locking scope.
> 
> Please stage this work on a stable branch in the vfs tree, so that
> I will be able to send Jan fanotify patches for "pre content" events
> based on the stable vfs branch.
> 

You can add

Reviewed-by: Josef Bacik <josef@toxicpanda.com>

To the rest of the patches that don't already have my reviewed-by.  Thanks,

Josef
Christian Brauner Nov. 22, 2023, 3:04 p.m. UTC | #2
On Wed, 22 Nov 2023 14:26:59 +0200, Amir Goldstein wrote:
> During my work on fanotify "pre content" events [1], Jan and I noticed
> some inconsistencies in the call sites of security_file_permission()
> hooks inside rw_verify_area() and remap_verify_area().
> 
> The majority of call sites are before file_start_write(), which is how
> we want them to be for fanotify "pre content" events.
> 
> [...]

Applied to the vfs.rw branch of the vfs/vfs.git tree.
Patches in the vfs.rw branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.rw

[01/16] ovl: add permission hooks outside of do_splice_direct()
        https://git.kernel.org/vfs/vfs/c/52009acbab21
[02/16] splice: remove permission hook from do_splice_direct()
        https://git.kernel.org/vfs/vfs/c/095b2d7c4b93
[03/16] splice: move permission hook out of splice_direct_to_actor()
        https://git.kernel.org/vfs/vfs/c/ead0aac245dd
[04/16] splice: move permission hook out of splice_file_to_pipe()
        https://git.kernel.org/vfs/vfs/c/74a66b648378
[05/16] splice: remove permission hook from iter_file_splice_write()
        https://git.kernel.org/vfs/vfs/c/e341582fdb7c
[06/16] remap_range: move permission hooks out of do_clone_file_range()
        https://git.kernel.org/vfs/vfs/c/6ddfddac4922
[07/16] remap_range: move file_start_write() to after permission hook
        https://git.kernel.org/vfs/vfs/c/a1fffabd504c
[08/16] btrfs: move file_start_write() to after permission hook
        https://git.kernel.org/vfs/vfs/c/ca267f48c8e9
[09/16] coda: change locking order in coda_file_write_iter()
        https://git.kernel.org/vfs/vfs/c/aee32ff62e8b
[10/16] fs: move file_start_write() into vfs_iter_write()
        https://git.kernel.org/vfs/vfs/c/f02abb810579
[11/16] fs: move permission hook out of do_iter_write()
        https://git.kernel.org/vfs/vfs/c/11dc9bc73318
[12/16] fs: move permission hook out of do_iter_read()
        https://git.kernel.org/vfs/vfs/c/c8b86e93b6e2
[13/16] fs: move kiocb_start_write() into vfs_iocb_iter_write()
        https://git.kernel.org/vfs/vfs/c/a4e6c478189e
[14/16] fs: create __sb_write_started() helper
        https://git.kernel.org/vfs/vfs/c/2a7b49f698d0
[15/16] fs: create file_write_started() helper
        https://git.kernel.org/vfs/vfs/c/0d3b7690bd1f
[16/16] fs: create {sb,file}_write_not_started() helpers
        https://git.kernel.org/vfs/vfs/c/c88b5e392b2e