From patchwork Thu Nov 3 13:45:06 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Gruenbacher X-Patchwork-Id: 9410883 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8A84A6022E for ; Thu, 3 Nov 2016 13:45:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 738262AB8E for ; Thu, 3 Nov 2016 13:45:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6696C2AB95; Thu, 3 Nov 2016 13:45:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EA6CA2AB8E for ; Thu, 3 Nov 2016 13:45:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757556AbcKCNpN (ORCPT ); Thu, 3 Nov 2016 09:45:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55062 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754326AbcKCNpL (ORCPT ); Thu, 3 Nov 2016 09:45:11 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id BE6A361B8C; Thu, 3 Nov 2016 13:45:10 +0000 (UTC) Received: from nux.redhat.com (vpn1-5-13.ams2.redhat.com [10.36.5.13]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uA3Dj7af022473; Thu, 3 Nov 2016 09:45:08 -0400 From: Andreas Gruenbacher To: Casey Schaufler , Al Viro Cc: Andreas Gruenbacher , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Stephen Smalley Subject: [PATCH] xattr: Fix setting security xattrs on sockfs Date: Thu, 3 Nov 2016 14:45:06 +0100 Message-Id: <1478180706-9456-1-git-send-email-agruenba@redhat.com> References: <1478115261-29669-1-git-send-email-agruenba@redhat.com> <57e9db81-d785-98ab-dd52-47c1f82c76c3@schaufler-ca.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 03 Nov 2016 13:45:11 +0000 (UTC) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Casey, the first patch broke filesystems that support setxattr for some xattrs but not security xattrs. Here's an updated patch; could you please test? Al, does this look mergeable? Thanks, Andreas --- The IOP_XATTR flag is set on sockfs because sockfs supports getting the "system.sockprotoname" xattr. Commit 6c6ef9f2 started to check this flag for setxattr support as well. This is wrong on sockfs because security xattr support there is provided by security_inode_setsecurity. Fix this by adding a security xattr handler on sockfs that returns -EAGAIN and by checking for -EAGAIN in setxattr. We cannot simply check for -EOPNOTSUPP in setxattr because there are filesystems that neither have direct security xattr support nor support via security_inode_setsecurity. A more proper fix might be to move the call to security_inode_setsecurity into sockfs, but it's not clear to me if that is safe: we would end up calling security_inode_post_setxattr as well. Signed-off-by: Andreas Gruenbacher --- fs/xattr.c | 22 ++++++++++++++-------- net/socket.c | 14 ++++++++++++++ 2 files changed, 28 insertions(+), 8 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index 3368659..2d13b4e 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -170,7 +170,7 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) { struct inode *inode = dentry->d_inode; - int error = -EOPNOTSUPP; + int error = -EAGAIN; int issec = !strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN); @@ -183,15 +183,21 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name, security_inode_post_setxattr(dentry, name, value, size, flags); } - } else if (issec) { - const char *suffix = name + XATTR_SECURITY_PREFIX_LEN; - + } else { if (unlikely(is_bad_inode(inode))) return -EIO; - error = security_inode_setsecurity(inode, suffix, value, - size, flags); - if (!error) - fsnotify_xattr(dentry); + } + if (error == -EAGAIN) { + error = -EOPNOTSUPP; + + if (issec) { + const char *suffix = name + XATTR_SECURITY_PREFIX_LEN; + + error = security_inode_setsecurity(inode, suffix, value, + size, flags); + if (!error) + fsnotify_xattr(dentry); + } } return error; diff --git a/net/socket.c b/net/socket.c index 5a9bf5e..816392a 100644 --- a/net/socket.c +++ b/net/socket.c @@ -341,6 +341,20 @@ static const struct xattr_handler sockfs_xattr_handler = { .get = sockfs_xattr_get, }; +static int sockfs_security_xattr_set(const struct xattr_handler *handler, + struct dentry *dentry, struct inode *inode, + const char *suffix, const void *value, + size_t size, int flags) +{ + /* Handled by LSM. */ + return -EAGAIN; +} + +static const struct xattr_handler sockfs_security_xattr_handler = { + .prefix = XATTR_SECURITY_PREFIX, + .set = sockfs_security_xattr_set, +}; + static const struct xattr_handler *sockfs_xattr_handlers[] = { &sockfs_xattr_handler, NULL