| Message ID | 20230309165455.175131-1-mic@digikod.net (mailing list archive) |
|---|---|
| Headers | show |
| Series | Landlock support for UML | expand |
Richard, Anton, Johannes, what do you think about these UML changes? On 09/03/2023 17:54, Mickaël Salaün wrote: > Hi, > > Commit cb2c7d1a1776 ("landlock: Support filesystem access-control") > introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for > User-Mode Linux. The reason was that UML's hostfs managed inodes in an > ephemeral way: from the kernel point of view, the same inode struct > could be created several times while being used by user space because > the kernel didn't hold references to inodes. Because Landlock (and > probably other subsystems) ties properties (i.e. access rights) to inode > objects, it wasn't possible to create rules that match inodes and then > allow specific accesses. > > This patch series fixes the way UML manages inodes according to the > underlying filesystem. They are now properly handles as for other > filesystems, which enables to support Landlock (and probably other > features). > > Backporting these patches requires some selftest harness patches > backports too. > > Regards, > > Mickaël Salaün (5): > hostfs: Fix ephemeral inodes > selftests/landlock: Don't create useless file layouts > selftests/landlock: Add supports_filesystem() helper > selftests/landlock: Make mounts configurable > selftests/landlock: Add tests for pseudo filesystems > > arch/Kconfig | 7 - > arch/um/Kconfig | 1 - > fs/hostfs/hostfs.h | 1 + > fs/hostfs/hostfs_kern.c | 213 ++++++------ > fs/hostfs/hostfs_user.c | 1 + > security/landlock/Kconfig | 2 +- > tools/testing/selftests/landlock/config | 8 +- > tools/testing/selftests/landlock/fs_test.c | 381 +++++++++++++++++++-- > 8 files changed, 472 insertions(+), 142 deletions(-) > > > base-commit: fe15c26ee26efa11741a7b632e9f23b01aca4cc6
----- Ursprüngliche Mail ----- > Von: "Mickaël Salaün" <mic@digikod.net> > Richard, Anton, Johannes, what do you think about these UML changes? I like them but didn't had a chance for a deeper look so far. :-S Thanks, //richard
On 21/03/2023 22:38, Richard Weinberger wrote: > ----- Ursprüngliche Mail ----- >> Von: "Mickaël Salaün" <mic@digikod.net> >> Richard, Anton, Johannes, what do you think about these UML changes? > > I like them but didn't had a chance for a deeper look so far. :-S Good! Do you think it could make it for v6.4? Should we push it in -next for testing? Thanks, Mickaël
Hi Richard, any news? On 04/04/2023 15:52, Mickaël Salaün wrote: > > On 21/03/2023 22:38, Richard Weinberger wrote: >> ----- Ursprüngliche Mail ----- >>> Von: "Mickaël Salaün" <mic@digikod.net> >>> Richard, Anton, Johannes, what do you think about these UML changes? >> >> I like them but didn't had a chance for a deeper look so far. :-S > > Good! Do you think it could make it for v6.4? Should we push it in > -next for testing? > > Thanks, > Mickaël
Hi, Commit cb2c7d1a1776 ("landlock: Support filesystem access-control") introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for User-Mode Linux. The reason was that UML's hostfs managed inodes in an ephemeral way: from the kernel point of view, the same inode struct could be created several times while being used by user space because the kernel didn't hold references to inodes. Because Landlock (and probably other subsystems) ties properties (i.e. access rights) to inode objects, it wasn't possible to create rules that match inodes and then allow specific accesses. This patch series fixes the way UML manages inodes according to the underlying filesystem. They are now properly handles as for other filesystems, which enables to support Landlock (and probably other features). Backporting these patches requires some selftest harness patches backports too. Regards, Mickaël Salaün (5): hostfs: Fix ephemeral inodes selftests/landlock: Don't create useless file layouts selftests/landlock: Add supports_filesystem() helper selftests/landlock: Make mounts configurable selftests/landlock: Add tests for pseudo filesystems arch/Kconfig | 7 - arch/um/Kconfig | 1 - fs/hostfs/hostfs.h | 1 + fs/hostfs/hostfs_kern.c | 213 ++++++------ fs/hostfs/hostfs_user.c | 1 + security/landlock/Kconfig | 2 +- tools/testing/selftests/landlock/config | 8 +- tools/testing/selftests/landlock/fs_test.c | 381 +++++++++++++++++++-- 8 files changed, 472 insertions(+), 142 deletions(-) base-commit: fe15c26ee26efa11741a7b632e9f23b01aca4cc6