From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukasz Pawelczyk Subject: Re: [PATCH v2 0/7] Smack namespace Date: Tue, 26 May 2015 18:42:35 +0200 Message-ID: <1432658555.1974.26.camel@samsung.com> References: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> <1432557162-19123-1-git-send-email-l.pawelczyk@samsung.com> <556484BD.2060004@tycho.nsa.gov> <1432657655.1974.21.camel@samsung.com> <5564A088.4040507@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-reply-to: <5564A088.4040507-+05T5uksL2qpZYMLLGbcSA@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Stephen Smalley Cc: Lukasz Pawelczyk , linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Tetsuo Handa , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, David Howells , Paul Moore , Jonathan Corbet , Jingoo Han , Jeff Layton , Alexey Dobriyan , Kees Cook , Mauro Carvalho Chehab , Fabian Frederick , Casey Schaufler , Al Viro , James Morris , "Kirill A. Shutemov" , John Johansen , Rafal Krypa , Greg KH , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Miklos Szeredi , Oleg Nesterov , Andy List-Id: containers.vger.kernel.org On wto, 2015-05-26 at 12:34 -0400, Stephen Smalley wrote: > > On wto, 2015-05-26 at 10:35 -0400, Stephen Smalley wrote: > >> On 05/25/2015 08:32 AM, Lukasz Pawelczyk wrote: > > > > I call the inode operation by hand in the post_setxattr. > > > > The label will effectively be set twice, which is not ideal, but there > > is no other option right now without reworking the hooks as you said. > > > > This shouldn't really be a problem because the Smack operations will not > > use the filesystem label (even when it's set incorrectly for a moment) > > but an already initialized smack_known structure for this inode that has > > all the values filled in properly. > > > > The only attack vector I can think of is hard rebooting the machine in a > > way that mapped label is really saved in the filesystem before the > > unmapped will have a chance. Should I be worried about that? This sounds > > a little unreal. > > If it were my security module, I would be worried about it. Even aside > from maliciously induced failure, you are leaving yourself open to > inconsistencies arising upon crashes. I would suggest modifying the > setxattr hook so that the security module can override the original > value/size pair with its own definition before it is passed to the inode > operation. There is already precedent in that security modules are > allowed to override the value/size returned by getxattr for security.*, > so this just makes them fully parallel. Will do. Thank you. -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics