LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Stephen Smalley <sds@tycho.nsa.gov>
To: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: torvalds@osdl.org, akpm@osdl.org, linux-kernel@vger.kernel.org,
	nfs@lists.sourceforge.net, James Morris <jmorris@namei.org>,
	Eric Paris <eparis@redhat.com>,
	Jim Meyering <meyering@redhat.com>
Subject: Re: [PATCH 3/3] NFS: Ensure we support selinux xattrs
Date: Wed, 24 Jan 2007 15:08:08 -0500	[thread overview]
Message-ID: <1169669288.15390.155.camel@moss-spartans.epoch.ncsc.mil> (raw)
In-Reply-To: <20070124195457.21259.53047.stgit@lade.trondhjem.org>

On Wed, 2007-01-24 at 11:54 -0800, Trond Myklebust wrote:
> From: Trond Myklebust <Trond.Myklebust@netapp.com>
> 
> Some programs (e.g. GNU "cp") are currently crashing because NFS
> allows you to inquire about SELinux security attributes (vfs_getxattr()
> automatically handles this), but returns -EOPNOTSUPP when they later
> attempt to set the SELinux security attributes.
> 
> The following patch just ensures that we pass the request to set security
> attributes on to the default SELinux handler.

That seems like a bug in cp, and it can happen under other circumstances
as well (mount with context= option).

I don't think you want to just set the incore inode security state on
the client side, as that won't be preserved.

> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
> ---
> 
>  fs/nfs/nfs3acl.c  |   13 +++++++++++++
>  fs/nfs/nfs4proc.c |   14 ++++++++++++++
>  2 files changed, 27 insertions(+), 0 deletions(-)
> 
> diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
> index 7322da4..5970e7b 100644
> --- a/fs/nfs/nfs3acl.c
> +++ b/fs/nfs/nfs3acl.c
> @@ -4,6 +4,9 @@ #include <linux/nfs3.h>
>  #include <linux/nfs_fs.h>
>  #include <linux/posix_acl_xattr.h>
>  #include <linux/nfsacl.h>
> +#include <linux/security.h>
> +#include <linux/xattr.h>
> +#include <linux/fsnotify.h>
>  
>  #define NFSDBG_FACILITY	NFSDBG_PROC
>  
> @@ -82,6 +85,16 @@ int nfs3_setxattr(struct dentry *dentry,
>  	struct posix_acl *acl;
>  	int type, error;
>  
> +	/* Selinux support */
> +	if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN)) {
> +		const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
> +		error = security_inode_setsecurity(inode, suffix, value,
> +				size, flags);
> +		if (!error)
> +			fsnotify_xattr(dentry);
> +		return error;
> +	}
> +
>  	if (strcmp(name, POSIX_ACL_XATTR_ACCESS) == 0)
>  		type = ACL_TYPE_ACCESS;
>  	else if (strcmp(name, POSIX_ACL_XATTR_DEFAULT) == 0)
> diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
> index b3fd29b..ac1082b 100644
> --- a/fs/nfs/nfs4proc.c
> +++ b/fs/nfs/nfs4proc.c
> @@ -48,6 +48,9 @@ #include <linux/nfs_page.h>
>  #include <linux/smp_lock.h>
>  #include <linux/namei.h>
>  #include <linux/mount.h>
> +#include <linux/security.h>
> +#include <linux/xattr.h>
> +#include <linux/fsnotify.h>
>  
>  #include "nfs4_fs.h"
>  #include "delegation.h"
> @@ -3547,6 +3550,17 @@ int nfs4_setxattr(struct dentry *dentry,
>  {
>  	struct inode *inode = dentry->d_inode;
>  
> +	/* Selinux support */
> +	if (!strncmp(key, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN)) {
> +		const char *suffix = key + XATTR_SECURITY_PREFIX_LEN;
> +		int error;
> +		error = security_inode_setsecurity(inode, suffix, buf,
> +				buflen, flags);
> +		if (!error)
> +			fsnotify_xattr(dentry);
> +		return error;
> +	}
> +
>  	if (strcmp(key, XATTR_NAME_NFSV4_ACL) != 0)
>  		return -EOPNOTSUPP;
>  
-- 
Stephen Smalley
National Security Agency


  reply	other threads:[~2007-01-24 20:52 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-24 19:53 [PATCH 0/3] NFS Bugfixes for 2.6.20-rc5 Trond Myklebust
2007-01-24 19:54 ` [PATCH 1/3] NFS: Fix Oops in rpc_call_sync() Trond Myklebust
2007-01-24 19:54 ` [PATCH 2/3] NFS: Fix races in nfs_revalidate_mapping() Trond Myklebust
2007-01-24 19:54 ` [PATCH 3/3] NFS: Ensure we support selinux xattrs Trond Myklebust
2007-01-24 20:08   ` Stephen Smalley [this message]
2007-01-24 20:29     ` Linus Torvalds
2007-01-24 20:40       ` [NFS] " Trond Myklebust

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1169669288.15390.155.camel@moss-spartans.epoch.ncsc.mil \
    --to=sds@tycho.nsa.gov \
    --cc=Trond.Myklebust@netapp.com \
    --cc=akpm@osdl.org \
    --cc=eparis@redhat.com \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=meyering@redhat.com \
    --cc=nfs@lists.sourceforge.net \
    --cc=torvalds@osdl.org \
    --subject='Re: [PATCH 3/3] NFS: Ensure we support selinux xattrs' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).