LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: NeilBrown <neilb@suse.de>
To: Al Viro <viro@ZenIV.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link.
Date: Fri, 20 Mar 2015 15:39:30 +1100	[thread overview]
Message-ID: <20150320153930.1f180e06@notabene.brown> (raw)
In-Reply-To: <20150316210035.GC29656@ZenIV.linux.org.uk>

[-- Attachment #1: Type: text/plain, Size: 1659 bytes --]

On Mon, 16 Mar 2015 21:00:35 +0000 Al Viro <viro@ZenIV.linux.org.uk> wrote:

> On Mon, Mar 16, 2015 at 03:43:19PM +1100, NeilBrown wrote:
> > Some of dentry_has_perm() is not rcu-safe, so if LOOKUP_RCU
> > is set in selinux_inode_follow_link(), give up with
> > -ECHILD.
> > 
> > It is possible that dentry_has_perm could sometimes complete
> > in RCU more, in which case the flag could be propagated further
> > down the stack...
> 
> It bloody well can.  Expand it a bit and you'll see - the nastiness
> comes from avc_audit() doing
>         return slow_avc_audit(ssid, tsid, tclass,
>                               requested, audited, denied, result,
>                               a, 0);
> and passing that 0 to slow_avc_audit().  Pass it MAY_NOT_BLOCK instead
> and it'll bugger off with -ECHILD in blocking case.
> 
> Call chain is dentry_has_perm -> inode_has_perm -> avc_has_perm -> avc_audit.
> Expand those (including avc_audit()) and make slow_avc_audit() get
> flags & LOOKUP_RCU ? MAY_NOT_BLOCK : 0.

There is more to it than that.

avc_has_perm calls avc_has_perm_noaudit which does:

	rcu_read_lock();
	...
	if (unlikely(!node)) {
		node = avc_compute_av(ssid, tsid, tclass, avd);
	} else ...

	...
	rcu_read_unlock();

and avc_compute_av() does

	rcu_read_unlock();
	security_compute_av(ssid, tsid, tclass, avd);
	rcu_read_lock();

(yes: unlock, and then lock).
so avc_has_perm_noaudit needs to bail out of RCU-walk if node turns out to be
NULL.
So I either add another 'flags' arg to that, or replace the current one which
is unused .... or leave it as someone else's problem :-)

NeilBrown

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

  reply	other threads:[~2015-03-20  4:39 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-03-16  4:43 [PATCH 00/13] Support follow_link in RCU-walk. - V2 NeilBrown
2015-03-16  4:43 ` [PATCH 01/13] VFS: replace {, total_}link_count in task_struct with pointer to nameidata NeilBrown
2015-03-16 19:46   ` Al Viro
2015-03-16  4:43 ` [PATCH 02/13] VFS: make all ->follow_link handlers aware for LOOKUP_RCU NeilBrown
2015-03-16  4:43 ` [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link NeilBrown
2015-03-16 21:00   ` Al Viro
2015-03-20  4:39     ` NeilBrown [this message]
2015-03-20  5:12       ` Al Viro
2015-03-16  4:43 ` [PATCH 03/13] VFS: remove nameidata args from ->follow_link and ->put_link NeilBrown
2015-03-16 20:47   ` Al Viro
2015-03-16  4:43 ` [PATCH 05/13] VFS/namei: use terminate_walk when symlink lookup fails NeilBrown
2015-03-16  4:43 ` [PATCH 12/13] XFS: allow follow_link to often succeed in RCU-walk NeilBrown
2015-03-16 22:37   ` Al Viro
2015-03-16  4:43 ` [PATCH 10/13] VFS/namei: handle LOOKUP_RCU in page_follow_link_light NeilBrown
2015-03-16 22:50   ` Al Viro
2015-03-19 22:38     ` NeilBrown
2015-03-19 23:46       ` Al Viro
2015-03-16  4:43 ` [PATCH 11/13] xfs: use RCU to free 'struct xfs_mount' NeilBrown
2015-03-16  4:43 ` [PATCH 13/13] NFS: support LOOKUP_RCU in nfs_follow_link NeilBrown
2015-03-16  4:43 ` [PATCH 06/13] VFS/namei: new flag to support RCU symlinks: LOOKUP_LINK_RCU NeilBrown
2015-03-16 22:33   ` Al Viro
2015-03-17  0:59     ` Al Viro
2015-03-16  4:43 ` [PATCH 07/13] VFS/namei: abort RCU-walk on symlink if atime needs updating NeilBrown
2015-03-16  4:43 ` [PATCH 08/13] VFS/namei: enhance follow_link to support RCU-walk NeilBrown
2015-03-16  4:43 ` [PATCH 09/13] VFS/namei: enable RCU-walk when following symlinks NeilBrown
2015-03-16 22:44   ` Al Viro
2015-03-16 19:14 ` [PATCH 00/13] Support follow_link in RCU-walk. - V2 Al Viro

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150320153930.1f180e06@notabene.brown \
    --to=neilb@suse.de \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=viro@ZenIV.linux.org.uk \
    --subject='Re: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link.' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).