Eric Lee / smarc-fsl-linux-kernel

06 Nov, 2019

1 commit

  • 3484eba91   FROMLIST: Add flags option to get xattr method paired to __vfs_getxattr ... Browse Code »

    Add a flag option to get xattr method that could have a bit flag of
    XATTR_NOSECURITY passed to it. XATTR_NOSECURITY is generally then
    set in the __vfs_getxattr path when called by security
    infrastructure.

    This handles the case of a union filesystem driver that is being
    requested by the security layer to report back the xattr data.

    For the use case where access is to be blocked by the security layer.

    The path then could be security(dentry) ->
    __vfs_getxattr(dentry...XATTR_NOSECURITY) ->
    handler->get(dentry...XATTR_NOSECURITY) ->
    __vfs_getxattr(lower_dentry...XATTR_NOSECURITY) ->
    lower_handler->get(lower_dentry...XATTR_NOSECURITY)
    which would report back through the chain data and success as
    expected, the logging security layer at the top would have the
    data to determine the access permissions and report back the target
    context that was blocked.

    Without the get handler flag, the path on a union filesystem would be
    the errant security(dentry) -> __vfs_getxattr(dentry) ->
    handler->get(dentry) -> vfs_getxattr(lower_dentry) -> nested ->
    security(lower_dentry, log off) -> lower_handler->get(lower_dentry)
    which would report back through the chain no data, and -EACCES.

    For selinux for both cases, this would translate to a correctly
    determined blocked access. In the first case with this change a correct avc
    log would be reported, in the second legacy case an incorrect avc log
    would be reported against an uninitialized u:object_r:unlabeled:s0
    context making the logs cosmetically useless for audit2allow.

    This patch series is inert and is the wide-spread addition of the
    flags option for xattr functions, and a replacement of __vfs_getxattr
    with __vfs_getxattr(...XATTR_NOSECURITY).

    Signed-off-by: Mark Salyzyn
    Reviewed-by: Jan Kara
    Acked-by: Jan Kara
    Acked-by: Jeff Layton
    Acked-by: David Sterba
    Acked-by: Darrick J. Wong
    Acked-by: Mike Marshall
    Cc: Stephen Smalley
    Cc: linux-kernel@vger.kernel.org
    Cc: kernel-team@android.com
    Cc: linux-security-module@vger.kernel.org

    (cherry picked from (rejected from archive because of too many recipients))
    Signed-off-by: Mark Salyzyn
    Bug: 133515582
    Bug: 136124883
    Bug: 129319403
    Change-Id: Iabbb8771939d5f66667a26bb23ddf4c562c349a1

    Mark Salyzyn
     

08 Sep, 2018

1 commit

  • e02a53d92   9p: acl: fix uninitialized iattr access ... Browse Code »

    iattr is passed to v9fs_vfs_setattr_dotl which does send various
    values from iattr over the wire, even if it tells the server to
    only look at iattr.ia_valid fields this could leak some stack data.

    Link: http://lkml.kernel.org/r/1536339057-21974-2-git-send-email-asmadeus@codewreck.org
    Addresses-Coverity-ID: 1195601 ("Uninitalized scalar variable")
    Signed-off-by: Dominique Martinet

    Dominique Martinet
     

23 Feb, 2017

1 commit

  • b5c66bab7   9p: fix a potential acl leak ... Browse Code »

    posix_acl_update_mode() could possibly clear 'acl', if so we leak the
    memory pointed by 'acl'. Save this pointer before calling
    posix_acl_update_mode() and release the memory if 'acl' really gets
    cleared.

    Link: http://lkml.kernel.org/r/1486678332-2430-1-git-send-email-xiyou.wangcong@gmail.com
    Signed-off-by: Cong Wang
    Reported-by: Mark Salyzyn
    Reviewed-by: Jan Kara
    Reviewed-by: Greg Kurz
    Cc: Eric Van Hensbergen
    Cc: Ron Minnich
    Cc: Latchesar Ionkov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Cong Wang
     

22 Sep, 2016

1 commit

  • 073931017   posix_acl: Clear SGID bit when setting file permissions ... Browse Code »

    When file permissions are modified via chmod(2) and the user is not in
    the owning group or capable of CAP_FSETID, the setgid bit is cleared in
    inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file
    permissions as well as the new ACL, but doesn't clear the setgid bit in
    a similar way; this allows to bypass the check in chmod(2). Fix that.

    References: CVE-2016-7097
    Reviewed-by: Christoph Hellwig
    Reviewed-by: Jeff Layton
    Signed-off-by: Jan Kara
    Signed-off-by: Andreas Gruenbacher

    Jan Kara
     

01 Jul, 2016

1 commit

  • 0d4d717f2   vfs: Verify acls are valid within superblock's s_user_ns. ... Browse Code »

    Update posix_acl_valid to verify that an acl is within a user namespace.

    Update the callers of posix_acl_valid to pass in an appropriate
    user namespace. For posix_acl_xattr_set and v9fs_xattr_set_acl pass in
    inode->i_sb->s_user_ns to posix_acl_valid. For md_unpack_acl pass in
    &init_user_ns as no inode or superblock is in sight.

    Acked-by: Seth Forshee
    Signed-off-by: "Eric W. Biederman"

    Eric W. Biederman
     

28 May, 2016

1 commit

11 Apr, 2016

1 commit

31 Mar, 2016

1 commit

  • b8a7a3a66   posix_acl: Inode acl caching fixes ... Browse Code »

    When get_acl() is called for an inode whose ACL is not cached yet, the
    get_acl inode operation is called to fetch the ACL from the filesystem.
    The inode operation is responsible for updating the cached acl with
    set_cached_acl(). This is done without locking at the VFS level, so
    another task can call set_cached_acl() or forget_cached_acl() before the
    get_acl inode operation gets to calling set_cached_acl(), and then
    get_acl's call to set_cached_acl() results in caching an outdate ACL.

    Prevent this from happening by setting the cached ACL pointer to a
    task-specific sentinel value before calling the get_acl inode operation.
    Move the responsibility for updating the cached ACL from the get_acl
    inode operations to get_acl(). There, only set the cached ACL if the
    sentinel value hasn't changed.

    The sentinel values are chosen to have odd values. Likewise, the value
    of ACL_NOT_CACHED is odd. In contrast, ACL object pointers always have
    an even value (ACLs are aligned in memory). This allows to distinguish
    uncached ACLs values from ACL objects.

    In addition, switch from guarding inode->i_acl and inode->i_default_acl
    upates by the inode->i_lock spinlock to using xchg() and cmpxchg().

    Filesystems that do not want ACLs returned from their get_acl inode
    operations to be cached must call forget_cached_acl() to prevent the VFS
    from doing so.

    (Patch written by Al Viro and Andreas Gruenbacher.)

    Signed-off-by: Andreas Gruenbacher
    Signed-off-by: Al Viro

    Andreas Gruenbacher
     

07 Dec, 2015

2 commits

14 Nov, 2015

2 commits

  • e409de992   9p: xattr simplifications ... Browse Code »

    Now that the xattr handler is passed to the xattr handler operations, we
    can use the same get and set operations for the user, trusted, and security
    xattr namespaces. In those namespaces, we can access the full attribute
    name by "reattaching" the name prefix the vfs has skipped for us. Add a
    xattr_full_name helper to make this obvious in the code.

    For the "system.posix_acl_access" and "system.posix_acl_default"
    attributes, handler->prefix is the full attribute name; the suffix is the
    empty string.

    Signed-off-by: Andreas Gruenbacher
    Cc: Eric Van Hensbergen
    Cc: Ron Minnich
    Cc: Latchesar Ionkov
    Cc: v9fs-developer@lists.sourceforge.net
    Signed-off-by: Al Viro

    Andreas Gruenbacher
     
  • d9a82a040   xattr handlers: Pass handler to operations instead of flags ... Browse Code »

    The xattr_handler operations are currently all passed a file system
    specific flags value which the operations can use to disambiguate between
    different handlers; some file systems use that to distinguish the xattr
    namespace, for example. In some oprations, it would be useful to also have
    access to the handler prefix. To allow that, pass a pointer to the handler
    to operations instead of the flags value alone.

    Signed-off-by: Andreas Gruenbacher
    Reviewed-by: Christoph Hellwig
    Signed-off-by: Al Viro

    Andreas Gruenbacher
     

16 Apr, 2015

1 commit

26 Jan, 2014

2 commits

26 Feb, 2013

5 commits

18 Sep, 2012

1 commit

  • 5f3a4a28e   userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr ... Browse Code »

    - Pass the user namespace the uid and gid values in the xattr are stored
    in into posix_acl_from_xattr.

    - Pass the user namespace kuid and kgid values should be converted into
    when storing uid and gid values in an xattr in posix_acl_to_xattr.

    - Modify all callers of posix_acl_from_xattr and posix_acl_to_xattr to
    pass in &init_user_ns.

    In the short term this change is not strictly needed but it makes the
    code clearer. In the longer term this change is necessary to be able to
    mount filesystems outside of the initial user namespace that natively
    store posix acls in the linux xattr format.

    Cc: Theodore Tso
    Cc: Andrew Morton
    Cc: Andreas Dilger
    Cc: Jan Kara
    Cc: Al Viro
    Signed-off-by: "Eric W. Biederman"

    Eric W. Biederman
     

01 Aug, 2011

2 commits

26 Jul, 2011

6 commits

  • e08dc1325   p9: avoid unused variable warning ... Browse Code »

    Commit 4e34e719e457 ("fs: take the ACL checks to common code") removed
    the use of the 'acl' variable in v9fs_iop_get_acl(), but left the
    variable definition around. Remove it to get rid of the warning:

    fs/9p/acl.c: In function ‘v9fs_iop_get_acl’:
    fs/9p/acl.c:101:20: warning: unused variable ‘acl’

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • 4e34e719e   fs: take the ACL checks to common code ... Browse Code »

    Replace the ->check_acl method with a ->get_acl method that simply reads an
    ACL from disk after having a cache miss. This means we can replace the ACL
    checking boilerplate code with a single implementation in namei.c.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Al Viro

    Christoph Hellwig
     
  • 826cae2f2   kill boilerplates around posix_acl_create_masq() ... Browse Code »

    new helper: posix_acl_create(&acl, gfp, mode_p). Replaces acl with
    modified clone, on failure releases acl and replaces with NULL.
    Returns 0 or -ve on error. All callers of posix_acl_create_masq()
    switched.

    Signed-off-by: Al Viro

    Al Viro
     
  • bc26ab5f6   kill boilerplate around posix_acl_chmod_masq() ... Browse Code »

    new helper: posix_acl_chmod(&acl, gfp, mode). Replaces acl with modified
    clone or with NULL if that has failed; returns 0 or -ve on error. All
    callers of posix_acl_chmod_masq() switched to that - they'd been doing
    exactly the same thing.

    Signed-off-by: Al Viro

    Al Viro
     
  • ebbb0ef28   9p: do no return 0 from ->check_acl without actually checking ... Browse Code »

    If we do not want to use ACLs we at least need to perform normal Unix
    permission checks. From the comment I'm not quite sure that's what
    is intended, but if 0p wants to do permission checks entirely on the
    server it needs to do so in ->permission, not in ->check_acl.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Al Viro

    Christoph Hellwig
     
  • e77819e57   vfs: move ACL cache lookup into generic code ... Browse Code »

    This moves logic for checking the cached ACL values from low-level
    filesystems into generic code. The end result is a streamlined ACL
    check that doesn't need to load the inode->i_op->check_acl pointer at
    all for the common cached case.

    The filesystems also don't need to check for a non-blocking RCU walk
    case in their acl_check() functions, because that is all handled at a
    VFS layer.

    Signed-off-by: Linus Torvalds
    Signed-off-by: Al Viro

    Linus Torvalds
     

24 Jul, 2011

1 commit

20 Jul, 2011

2 commits

24 Mar, 2011

1 commit

23 Mar, 2011

1 commit

15 Mar, 2011

4 commits

  • 5ffc0cb30   fs/9p: Add inode hashing ... Browse Code »

    We didn't add the inode to inode hash in 9p. We need to do that
    to get sync to work, otherwise __mark_inode_dirty will not
    add the inode to super block's dirty list.

    Signed-off-by: Aneesh Kumar K.V
    Signed-off-by: Venkateswararao Jujjuri
    Signed-off-by: Eric Van Hensbergen

    Aneesh Kumar K.V
     
  • e782ef710   [fs/9P] Add posixacl mount option ... Browse Code »

    The mount option access=client is overloaded as it assumes acl too.
    Adding posixacl option to enable POSIX ACLs makes it explicit and clear.
    Also it is convenient in the future to add other types of acls like richacls.

    Ideally, the access mode 'client' should be just like V9FS_ACCESS_USER
    except it underscores the location of access check.
    Traditional 9P protocol lets the server perform access checks but with
    this mode, all the access checks will be performed on the client itself.
    Server just follows the client's directive.

    Signed-off-by: Venkateswararao Jujjuri
    Signed-off-by: Eric Van Hensbergen

    Venkateswararao Jujjuri (JV)
     
  • d344b0fb7   [fs/9p] Initialze cached acls both in cached/uncached mode. ... Browse Code »

    With create/mkdir/mknod in non cached mode we initialize the inode using
    v9fs_get_inode. v9fs_get_inode doesn't initialize the cache inode value
    to NULL. This is causing to trip on BUG_ON in v9fs_get_cached_acl.
    Fix is to initialize acls to NULL and not to leave them in ACL_NOT_CACHED
    state.

    Signed-off-by: Venkateswararao Jujjuri
    Signed-off-by: Eric Van Hensbergen
    Reviewed-by: Aneesh Kumar K.V

    Venkateswararao Jujjuri (JV)
     
  • c61fa0d6d   [fs/9p] Plug potential acl leak ... Browse Code »

    In v9fs_get_acl() if __v9fs_get_acl() gets only one of the
    dacl/pacl we are not releasing it.

    Signed-off-by: Venkateswararao Jujjuri
    Signed-off-by: Eric Van Hensbergen
    Reviewed-by: Aneesh Kumar K.V

    Venkateswararao Jujjuri (JV)
     

11 Jan, 2011

2 commits