From patchwork Tue Apr 27 11:37:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226549 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B010CC43617 for ; Tue, 27 Apr 2021 11:37:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A1A22613C5 for ; Tue, 27 Apr 2021 11:37:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236116AbhD0Lih (ORCPT ); Tue, 27 Apr 2021 07:38:37 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2927 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230365AbhD0Lie (ORCPT ); Tue, 27 Apr 2021 07:38:34 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.200]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FV0165HZyz68996; Tue, 27 Apr 2021 19:30:02 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:37:46 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu , , Jeff Mahoney , Tetsuo Handa Subject: [PATCH v3 1/6] reiserfs: Add missing calls to reiserfs_security_free() Date: Tue, 27 Apr 2021 13:37:27 +0200 Message-ID: <20210427113732.471066-2-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Commit 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation") defined reiserfs_security_free() to free the name and value of a security xattr allocated by the active LSM through security_old_inode_init_security(). However, this function is not called in the reiserfs code. Thus, this patch adds a call to reiserfs_security_free() whenever reiserfs_security_init() is called, and initializes value to NULL, to avoid to call kfree() on an uninitialized pointer. Fixes: 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation") Cc: stable@vger.kernel.org Cc: Jeff Mahoney Cc: Tetsuo Handa Reported-by: Mimi Zohar Reported-by: Tetsuo Handa Signed-off-by: Roberto Sassu --- fs/reiserfs/namei.c | 4 ++++ fs/reiserfs/xattr_security.c | 1 + 2 files changed, 5 insertions(+) diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c index e6eb05e2b2f1..6b5c51a77fae 100644 --- a/fs/reiserfs/namei.c +++ b/fs/reiserfs/namei.c @@ -695,6 +695,7 @@ static int reiserfs_create(struct user_namespace *mnt_userns, struct inode *dir, out_failed: reiserfs_write_unlock(dir->i_sb); + reiserfs_security_free(&security); return retval; } @@ -778,6 +779,7 @@ static int reiserfs_mknod(struct user_namespace *mnt_userns, struct inode *dir, out_failed: reiserfs_write_unlock(dir->i_sb); + reiserfs_security_free(&security); return retval; } @@ -877,6 +879,7 @@ static int reiserfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir, retval = journal_end(&th); out_failed: reiserfs_write_unlock(dir->i_sb); + reiserfs_security_free(&security); return retval; } @@ -1193,6 +1196,7 @@ static int reiserfs_symlink(struct user_namespace *mnt_userns, retval = journal_end(&th); out_failed: reiserfs_write_unlock(parent_dir->i_sb); + reiserfs_security_free(&security); return retval; } diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c index bb2a0062e0e5..b1ad93b60475 100644 --- a/fs/reiserfs/xattr_security.c +++ b/fs/reiserfs/xattr_security.c @@ -50,6 +50,7 @@ int reiserfs_security_init(struct inode *dir, struct inode *inode, int error; sec->name = NULL; + sec->value = NULL; /* Don't add selinux attributes on xattrs - they'll never get used */ if (IS_PRIVATE(dir)) From patchwork Tue Apr 27 11:37:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226547 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E962C43603 for ; Tue, 27 Apr 2021 11:37:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D468C61002 for ; Tue, 27 Apr 2021 11:37:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236083AbhD0Lig (ORCPT ); Tue, 27 Apr 2021 07:38:36 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2926 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235426AbhD0Lie (ORCPT ); Tue, 27 Apr 2021 07:38:34 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FV0173tFYz71fd1; Tue, 27 Apr 2021 19:30:03 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:37:47 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 2/6] security: Rewrite security_old_inode_init_security() Date: Tue, 27 Apr 2021 13:37:28 +0200 Message-ID: <20210427113732.471066-3-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org With upcoming changes, LSMs will be able to write their xattrs in the reserved slots. Boundary checking will be performed to ensure that LSMs don't write outside the passed xattr array. However, the xattr array is created only in security_inode_init_security() and not in security_old_inode_init_security(). Instead of duplicating the code for array allocation, this patch calls security_inode_init_security() from security_old_inode_init_security() and introduces a new callback, called security_initxattrs(), to copy the first element of the xattr array allocated by former function into the destination pointer provided by the latter function. Signed-off-by: Roberto Sassu --- security/security.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/security/security.c b/security/security.c index 7f14e59c4f8e..692a148ce764 100644 --- a/security/security.c +++ b/security/security.c @@ -1024,6 +1024,20 @@ int security_dentry_create_files_as(struct dentry *dentry, int mode, } EXPORT_SYMBOL(security_dentry_create_files_as); +static int security_initxattrs(struct inode *inode, const struct xattr *xattrs, + void *fs_info) +{ + struct xattr *dest = (struct xattr *)fs_info; + + if (!dest) + return 0; + + dest->name = xattrs->name; + dest->value = xattrs->value; + dest->value_len = xattrs->value_len; + return 0; +} + int security_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const initxattrs initxattrs, void *fs_data) @@ -1053,8 +1067,14 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, goto out; ret = initxattrs(inode, new_xattrs, fs_data); out: - for (xattr = new_xattrs; xattr->value != NULL; xattr++) + for (xattr = new_xattrs; xattr->value != NULL; xattr++) { + if (xattr == new_xattrs && initxattrs == &security_initxattrs && + !ret && fs_data != NULL) + continue; kfree(xattr->value); + } + if (initxattrs == &security_initxattrs) + return ret; return (ret == -EOPNOTSUPP) ? 0 : ret; } EXPORT_SYMBOL(security_inode_init_security); @@ -1071,10 +1091,25 @@ int security_old_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const char **name, void **value, size_t *len) { + struct xattr xattr = { .name = NULL, .value = NULL, .value_len = 0 }; + struct xattr *lsm_xattr = (name && value && len) ? &xattr : NULL; + int ret; + if (unlikely(IS_PRIVATE(inode))) return -EOPNOTSUPP; - return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, - qstr, name, value, len); + + ret = security_inode_init_security(inode, dir, qstr, + security_initxattrs, lsm_xattr); + if (ret) + return ret; + + if (lsm_xattr) { + *name = lsm_xattr->name; + *value = lsm_xattr->value; + *len = lsm_xattr->value_len; + } + + return 0; } EXPORT_SYMBOL(security_old_inode_init_security); From patchwork Tue Apr 27 11:37:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226545 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51CF8C43470 for ; Tue, 27 Apr 2021 11:37:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 30306613E7 for ; Tue, 27 Apr 2021 11:37:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236020AbhD0Lif (ORCPT ); Tue, 27 Apr 2021 07:38:35 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2925 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235443AbhD0Lie (ORCPT ); Tue, 27 Apr 2021 07:38:34 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FTzxw2D2Bz77b74; Tue, 27 Apr 2021 19:27:16 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:37:47 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 3/6] security: Pass xattrs allocated by LSMs to the inode_init_security hook Date: Tue, 27 Apr 2021 13:37:29 +0200 Message-ID: <20210427113732.471066-4-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org In preparation for moving EVM to the LSM infrastructure, this patch replaces the name, value, len triple with the xattr array pointer provided by security_inode_init_security(), and the base slot in the xattr array where LSMs can write xattrs. This patch also introduces the new helper lsm_find_xattr_slot(), to help LSMs find available slots in the xattr array (with a subsequent patch it will be possible to reserve more than one slot). The helper takes three arguments: the xattr array, the pointer of the base slot, whose value is incremented each time the helper is called, and the end slot so that the helper does not return a slot outside the array. Finally, this patch modifies also SELinux and Smack to use the new helper. Signed-off-by: Roberto Sassu --- include/linux/lsm_hook_defs.h | 4 ++-- include/linux/lsm_hooks.h | 21 ++++++++++++++++++--- security/security.c | 15 ++++++--------- security/selinux/hooks.c | 15 ++++++++------- security/smack/smack_lsm.c | 24 +++++++++++++----------- 5 files changed, 47 insertions(+), 32 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 477a597db013..20f91e93f511 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -111,8 +111,8 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask, LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode) LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode) LSM_HOOK(int, 0, inode_init_security, struct inode *inode, - struct inode *dir, const struct qstr *qstr, const char **name, - void **value, size_t *len) + struct inode *dir, const struct qstr *qstr, struct xattr *xattrs, + int *base_slot, void *fs_data) LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode, const struct qstr *name, const struct inode *context_inode) LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry, diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index c5498f5174ce..197d6662b262 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -27,6 +27,7 @@ #include #include +#include #include /** @@ -227,9 +228,13 @@ * @inode contains the inode structure of the newly created inode. * @dir contains the inode structure of the parent directory. * @qstr contains the last path component of the new object - * @name will be set to the allocated name suffix (e.g. selinux). - * @value will be set to the allocated attribute value. - * @len will be set to the length of the value. + * @xattrs contains the full array of xattrs allocated by LSMs where + * ->name will be set to the allocated name suffix (e.g. selinux). + * ->value will be set to the allocated attribute value. + * ->len will be set to the length of the value. + * @base_slot contains the position in @xattrs from where xattrs + * can be written. + * @fs_data contains filesystem-specific data. * Returns 0 if @name and @value have been successfully set, * -EOPNOTSUPP if no security attribute is needed, or * -ENOMEM on memory allocation failure. @@ -1660,5 +1665,15 @@ static inline void security_delete_hooks(struct security_hook_list *hooks, #endif /* CONFIG_SECURITY_WRITABLE_HOOKS */ extern int lsm_inode_alloc(struct inode *inode); +static inline struct xattr *lsm_find_xattr_slot(struct xattr *xattrs, + int *base_slot, int end_slot) +{ + if (!xattrs) + return xattrs; + + if (*base_slot >= end_slot) + return NULL; + return xattrs + (*base_slot)++; +} #endif /* ! __LINUX_LSM_HOOKS_H */ diff --git a/security/security.c b/security/security.c index 692a148ce764..527a18fd6742 100644 --- a/security/security.c +++ b/security/security.c @@ -1043,26 +1043,23 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, const initxattrs initxattrs, void *fs_data) { struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1]; - struct xattr *lsm_xattr, *evm_xattr, *xattr; - int ret; + struct xattr *xattr; + int ret, base_slot = 0; if (unlikely(IS_PRIVATE(inode))) return 0; if (!initxattrs) return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, - dir, qstr, NULL, NULL, NULL); + dir, qstr, NULL, &base_slot, fs_data); memset(new_xattrs, 0, sizeof(new_xattrs)); - lsm_xattr = new_xattrs; ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, - &lsm_xattr->name, - &lsm_xattr->value, - &lsm_xattr->value_len); + new_xattrs, &base_slot, fs_data); if (ret) goto out; - evm_xattr = lsm_xattr + 1; - ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr); + ret = evm_inode_init_security(inode, new_xattrs, + new_xattrs + base_slot); if (ret) goto out; ret = initxattrs(inode, new_xattrs, fs_data); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index ddd097790d47..6319417129af 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2916,11 +2916,13 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, static int selinux_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, - const char **name, - void **value, size_t *len) + struct xattr *xattrs, int *base_slot, + void *fs_data) { const struct task_security_struct *tsec = selinux_cred(current_cred()); struct superblock_security_struct *sbsec; + struct xattr *xattr = lsm_find_xattr_slot(xattrs, base_slot, + *base_slot + 1); u32 newsid, clen; int rc; char *context; @@ -2947,16 +2949,15 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, !(sbsec->flags & SBLABEL_MNT)) return -EOPNOTSUPP; - if (name) - *name = XATTR_SELINUX_SUFFIX; + if (xattr) { + xattr->name = XATTR_SELINUX_SUFFIX; - if (value && len) { rc = security_sid_to_context_force(&selinux_state, newsid, &context, &clen); if (rc) return rc; - *value = context; - *len = clen; + xattr->value = context; + xattr->value_len = clen; } return 0; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 12a45e61c1a5..53e32cde09fb 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -962,26 +962,28 @@ static int smack_inode_alloc_security(struct inode *inode) * @inode: the newly created inode * @dir: containing directory object * @qstr: unused - * @name: where to put the attribute name - * @value: where to put the attribute value - * @len: where to put the length of the attribute + * @xattrs: where to put the attribute + * @base_slot: where to start to write in @xattrs + * @fs_data: unused * * Returns 0 if it all works out, -ENOMEM if there's no memory */ static int smack_inode_init_security(struct inode *inode, struct inode *dir, - const struct qstr *qstr, const char **name, - void **value, size_t *len) + const struct qstr *qstr, + struct xattr *xattrs, int *base_slot, + void *fs_data) { struct inode_smack *issp = smack_inode(inode); struct smack_known *skp = smk_of_current(); struct smack_known *isp = smk_of_inode(inode); struct smack_known *dsp = smk_of_inode(dir); + struct xattr *xattr = lsm_find_xattr_slot(xattrs, base_slot, + *base_slot + 1); int may; - if (name) - *name = XATTR_SMACK_SUFFIX; + if (xattr) { + xattr->name = XATTR_SMACK_SUFFIX; - if (value && len) { rcu_read_lock(); may = smk_access_entry(skp->smk_known, dsp->smk_known, &skp->smk_rules); @@ -999,11 +1001,11 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, issp->smk_flags |= SMK_INODE_CHANGED; } - *value = kstrdup(isp->smk_known, GFP_NOFS); - if (*value == NULL) + xattr->value = kstrdup(isp->smk_known, GFP_NOFS); + if (xattr->value == NULL) return -ENOMEM; - *len = strlen(isp->smk_known); + xattr->value_len = strlen(isp->smk_known); } return 0; From patchwork Tue Apr 27 11:37:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226543 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4B4EC43461 for ; Tue, 27 Apr 2021 11:37:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7E772613DC for ; Tue, 27 Apr 2021 11:37:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235949AbhD0Lie (ORCPT ); Tue, 27 Apr 2021 07:38:34 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2928 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235353AbhD0Lie (ORCPT ); Tue, 27 Apr 2021 07:38:34 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FV03c6pYtz6yhqy; Tue, 27 Apr 2021 19:32:12 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:37:48 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 4/6] security: Support multiple LSMs implementing the inode_init_security hook Date: Tue, 27 Apr 2021 13:37:30 +0200 Message-ID: <20210427113732.471066-5-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org The current implementation of security_inode_init_security() is capable of handling only one LSM providing an xattr to be set at inode creation. That xattr is then passed to EVM to calculate the HMAC. To support multiple LSMs, each providing one or multiple xattrs, this patch makes the following modifications to security_inode_init_security(): - dynamically allocates new_xattrs, based on the number of slots requested by LSMs (through the new field lbs_xattr introduced in the lsm_blob_sizes structure); - replaces the call_int_hook() macro with its definition, to correctly handle the case of an LSM returning -EOPNOTSUPP (the loop should not be stopped); - verifies whether or not inode_init_security hook implementations operated correctly: - LSMs returning zero must fill at least a slot; - LSMs must not fill a slot outside the xattr array; - LSMs must set an xattr name for each filled slot. The modifications necessary for EVM to calculate the HMAC on all xattrs will be done in a separate patch. Signed-off-by: Roberto Sassu --- include/linux/lsm_hooks.h | 1 + security/security.c | 64 ++++++++++++++++++++++++++++++++------ security/selinux/hooks.c | 5 ++- security/smack/smack_lsm.c | 5 ++- 4 files changed, 64 insertions(+), 11 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 197d6662b262..cb6329ce8b0c 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1581,6 +1581,7 @@ struct lsm_blob_sizes { int lbs_ipc; int lbs_msg_msg; int lbs_task; + int lbs_xattr; }; /* diff --git a/security/security.c b/security/security.c index 527a18fd6742..91675003a5cf 100644 --- a/security/security.c +++ b/security/security.c @@ -30,8 +30,6 @@ #include #include -#define MAX_LSM_EVM_XATTR 2 - /* How many LSMs were built into the kernel? */ #define LSM_COUNT (__end_lsm_info - __start_lsm_info) @@ -204,6 +202,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); + lsm_set_blob_size(&needed->lbs_xattr, &blob_sizes.lbs_xattr); } /* Prepare LSM for initialization. */ @@ -339,6 +338,7 @@ static void __init ordered_lsm_init(void) init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); init_debug("task blob size = %d\n", blob_sizes.lbs_task); + init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr); /* * Create any kmem_caches needed for blobs @@ -1042,9 +1042,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const initxattrs initxattrs, void *fs_data) { - struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1]; - struct xattr *xattr; - int ret, base_slot = 0; + struct xattr *new_xattrs, *xattr; + struct security_hook_list *P; + int ret, base_slot = 0, old_base_slot; if (unlikely(IS_PRIVATE(inode))) return 0; @@ -1052,11 +1052,56 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, if (!initxattrs) return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, NULL, &base_slot, fs_data); - memset(new_xattrs, 0, sizeof(new_xattrs)); - ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, - new_xattrs, &base_slot, fs_data); - if (ret) + + /* Allocate +1 for EVM and +1 as terminator. */ + new_xattrs = kcalloc(blob_sizes.lbs_xattr + 2, sizeof(*new_xattrs), + GFP_NOFS); + if (!new_xattrs) + return -ENOMEM; + + hlist_for_each_entry(P, &security_hook_heads.inode_init_security, + list) { + old_base_slot = base_slot; + ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs, + &base_slot, fs_data); + if (ret) { + if (ret != -EOPNOTSUPP) + goto out; + + continue; + } + + if (base_slot == old_base_slot) { + WARN_ONCE( + "LSM %s: returned zero but didn't fill any slot\n", + P->lsm); + ret = -EINVAL; + goto out; + } + + if (base_slot > blob_sizes.lbs_xattr) { + WARN_ONCE( + "LSM %s: wrote xattr outside array (%d/%d)\n", + P->lsm, base_slot, blob_sizes.lbs_xattr); + ret = -EINVAL; + goto out; + } + + while (old_base_slot < base_slot) { + if (new_xattrs[old_base_slot++].name != NULL) + continue; + + WARN_ONCE("LSM %s: ret = 0 but xattr name = NULL\n", + P->lsm); + ret = -EINVAL; + goto out; + } + } + + if (!base_slot) { + ret = -EOPNOTSUPP; goto out; + } ret = evm_inode_init_security(inode, new_xattrs, new_xattrs + base_slot); @@ -1070,6 +1115,7 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, continue; kfree(xattr->value); } + kfree(new_xattrs); if (initxattrs == &security_initxattrs) return ret; return (ret == -EOPNOTSUPP) ? 0 : ret; diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6319417129af..3ea56c706a58 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -104,6 +104,8 @@ #include "audit.h" #include "avc_ss.h" +#define SELINUX_INODE_INIT_XATTRS 1 + struct selinux_state selinux_state; /* SECMARK reference count */ @@ -2922,7 +2924,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, const struct task_security_struct *tsec = selinux_cred(current_cred()); struct superblock_security_struct *sbsec; struct xattr *xattr = lsm_find_xattr_slot(xattrs, base_slot, - *base_slot + 1); + selinux_blob_sizes.lbs_xattr + SELINUX_INODE_INIT_XATTRS); u32 newsid, clen; int rc; char *context; @@ -6976,6 +6978,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { .lbs_inode = sizeof(struct inode_security_struct), .lbs_ipc = sizeof(struct ipc_security_struct), .lbs_msg_msg = sizeof(struct msg_security_struct), + .lbs_xattr = SELINUX_INODE_INIT_XATTRS, }; #ifdef CONFIG_PERF_EVENTS diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 53e32cde09fb..cecba1228602 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -51,6 +51,8 @@ #define SMK_RECEIVING 1 #define SMK_SENDING 2 +#define SMACK_INODE_INIT_XATTRS 1 + static DEFINE_MUTEX(smack_ipv6_lock); static LIST_HEAD(smk_ipv6_port_list); struct kmem_cache *smack_rule_cache; @@ -978,7 +980,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, struct smack_known *isp = smk_of_inode(inode); struct smack_known *dsp = smk_of_inode(dir); struct xattr *xattr = lsm_find_xattr_slot(xattrs, base_slot, - *base_slot + 1); + smack_blob_sizes.lbs_xattr + SMACK_INODE_INIT_XATTRS); int may; if (xattr) { @@ -4702,6 +4704,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { .lbs_inode = sizeof(struct inode_smack), .lbs_ipc = sizeof(struct smack_known *), .lbs_msg_msg = sizeof(struct smack_known *), + .lbs_xattr = SMACK_INODE_INIT_XATTRS, }; static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { From patchwork Tue Apr 27 11:37:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226553 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CF12C43461 for ; Tue, 27 Apr 2021 11:39:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0881A613DD for ; Tue, 27 Apr 2021 11:39:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237762AbhD0Ljs (ORCPT ); Tue, 27 Apr 2021 07:39:48 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2930 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235446AbhD0Ljr (ORCPT ); Tue, 27 Apr 2021 07:39:47 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.206]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FV05203t2z6yhmp; Tue, 27 Apr 2021 19:33:26 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:39:01 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 5/6] evm: Align evm_inode_init_security() definition with LSM infrastructure Date: Tue, 27 Apr 2021 13:37:31 +0200 Message-ID: <20210427113732.471066-6-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org This patch changes the evm_inode_init_security() definition to align with the LSM infrastructure, in preparation for moving IMA and EVM to that infrastructure. Signed-off-by: Roberto Sassu --- include/linux/evm.h | 19 ++++++++++++------- security/integrity/evm/evm_main.c | 19 +++++++++++++------ security/security.c | 6 +++--- 3 files changed, 28 insertions(+), 16 deletions(-) diff --git a/include/linux/evm.h b/include/linux/evm.h index 8cad46bcec9d..8b1c36c19e97 100644 --- a/include/linux/evm.h +++ b/include/linux/evm.h @@ -34,9 +34,10 @@ extern int evm_inode_removexattr(struct user_namespace *mnt_userns, struct dentry *dentry, const char *xattr_name); extern void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name); -extern int evm_inode_init_security(struct inode *inode, - const struct xattr *xattr_array, - struct xattr *evm); +extern int evm_inode_init_security(struct inode *inode, struct inode *dir, + const struct qstr *qstr, + struct xattr *xattrs, int *base_slot, + void *fs_data); extern bool evm_status_revalidate(const char *xattr_name); #ifdef CONFIG_FS_POSIX_ACL extern int posix_xattr_acl(const char *xattrname); @@ -102,11 +103,15 @@ static inline void evm_inode_post_removexattr(struct dentry *dentry, return; } -static inline int evm_inode_init_security(struct inode *inode, - const struct xattr *xattr_array, - struct xattr *evm) +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir, + const struct qstr *qstr, + struct xattr *xattrs, int *base_slot, + void *fs_data) { - return 0; + if (!xattrs || !xattrs->name) + return 0; + + return -EOPNOTSUPP; } static inline bool evm_status_revalidate(const char *xattr_name) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 84a9b7a69b1f..d647bfd0adcd 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include @@ -706,23 +707,29 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) /* * evm_inode_init_security - initializes security.evm HMAC value */ -int evm_inode_init_security(struct inode *inode, - const struct xattr *lsm_xattr, - struct xattr *evm_xattr) +int evm_inode_init_security(struct inode *inode, struct inode *dir, + const struct qstr *qstr, + struct xattr *xattrs, int *base_slot, + void *fs_data) { struct evm_xattr *xattr_data; + struct xattr *evm_xattr = lsm_find_xattr_slot(xattrs, base_slot, + *base_slot + 1); int rc; - if (!(evm_initialized & EVM_INIT_HMAC) || - !evm_protected_xattr(lsm_xattr->name)) + if (!xattrs || !xattrs->name) return 0; + if (!(evm_initialized & EVM_INIT_HMAC) || + !evm_protected_xattr(xattrs->name)) + return -EOPNOTSUPP; + xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); if (!xattr_data) return -ENOMEM; xattr_data->data.type = EVM_XATTR_HMAC; - rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest); + rc = evm_init_hmac(inode, xattrs, xattr_data->digest); if (rc < 0) goto out; diff --git a/security/security.c b/security/security.c index 91675003a5cf..f090362550fa 100644 --- a/security/security.c +++ b/security/security.c @@ -1103,9 +1103,9 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, goto out; } - ret = evm_inode_init_security(inode, new_xattrs, - new_xattrs + base_slot); - if (ret) + ret = evm_inode_init_security(inode, dir, qstr, new_xattrs, &base_slot, + fs_data); + if (ret && ret != -EOPNOTSUPP) goto out; ret = initxattrs(inode, new_xattrs, fs_data); out: From patchwork Tue Apr 27 11:37:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12226555 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DABAFC43462 for ; Tue, 27 Apr 2021 11:39:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A934460FE8 for ; Tue, 27 Apr 2021 11:39:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237886AbhD0Lju (ORCPT ); Tue, 27 Apr 2021 07:39:50 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:2931 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235982AbhD0Ljs (ORCPT ); Tue, 27 Apr 2021 07:39:48 -0400 Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.207]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4FTzzM0BFqz77b7N; Tue, 27 Apr 2021 19:28:31 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.62.217) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 27 Apr 2021 13:39:02 +0200 From: Roberto Sassu To: , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 6/6] evm: Support multiple LSMs providing an xattr Date: Tue, 27 Apr 2021 13:37:32 +0200 Message-ID: <20210427113732.471066-7-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210427113732.471066-1-roberto.sassu@huawei.com> References: <20210427113732.471066-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.62.217] X-ClientProxiedBy: lhreml751-chm.china.huawei.com (10.201.108.201) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Currently, evm_inode_init_security() processes a single LSM xattr from the array passed by security_inode_init_security(), and calculates the HMAC on it and other inode metadata. Given that initxattrs(), called by security_inode_init_security(), expects that this array is terminated when the xattr name is set to NULL, this patch reuses the same assumption for to scan all xattrs and to calculate the HMAC on all of them. Signed-off-by: Roberto Sassu --- security/integrity/evm/evm.h | 2 ++ security/integrity/evm/evm_crypto.c | 9 ++++++++- security/integrity/evm/evm_main.c | 15 +++++++++++---- 3 files changed, 21 insertions(+), 5 deletions(-) diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h index ae590f71ce7d..24eac42b9f32 100644 --- a/security/integrity/evm/evm.h +++ b/security/integrity/evm/evm.h @@ -49,6 +49,8 @@ struct evm_digest { char digest[IMA_MAX_DIGEST_SIZE]; } __packed; +int evm_protected_xattr(const char *req_xattr_name); + int evm_init_key(void); int __init evm_init_crypto(void); int evm_update_evmxattr(struct dentry *dentry, diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c index b66264b53d5d..35c5eec0517d 100644 --- a/security/integrity/evm/evm_crypto.c +++ b/security/integrity/evm/evm_crypto.c @@ -358,6 +358,7 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr, char *hmac_val) { struct shash_desc *desc; + const struct xattr *xattr; desc = init_desc(EVM_XATTR_HMAC, evm_hash_algo); if (IS_ERR(desc)) { @@ -365,7 +366,13 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr, return PTR_ERR(desc); } - crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len); + for (xattr = lsm_xattr; xattr->name != NULL; xattr++) { + if (!evm_protected_xattr(xattr->name)) + continue; + + crypto_shash_update(desc, xattr->value, xattr->value_len); + } + hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val); kfree(desc); return 0; diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index d647bfd0adcd..cd2f46770646 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -261,7 +261,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, return evm_status; } -static int evm_protected_xattr(const char *req_xattr_name) +int evm_protected_xattr(const char *req_xattr_name) { int namelen; int found = 0; @@ -713,15 +713,22 @@ int evm_inode_init_security(struct inode *inode, struct inode *dir, void *fs_data) { struct evm_xattr *xattr_data; + struct xattr *xattr; struct xattr *evm_xattr = lsm_find_xattr_slot(xattrs, base_slot, *base_slot + 1); - int rc; + int rc, evm_protected_xattrs = 0; if (!xattrs || !xattrs->name) return 0; - if (!(evm_initialized & EVM_INIT_HMAC) || - !evm_protected_xattr(xattrs->name)) + if (!(evm_initialized & EVM_INIT_HMAC)) + return -EOPNOTSUPP; + + for (xattr = xattrs; xattr->name != NULL && xattr < evm_xattr; xattr++) + if (evm_protected_xattr(xattr->name)) + evm_protected_xattrs++; + + if (!evm_protected_xattrs) return -EOPNOTSUPP; xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);