From: Steve Dickson <SteveD@redhat.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: "J. Bruce Fields" <bfields@redhat.com>,
Trond Myklebust <Trond.Myklebust@netapp.com>,
"David P. Quigley" <dpquigl@tycho.nsa.gov>,
Linux NFS list <linux-nfs@vger.kernel.org>,
Linux FS devel list <linux-fsdevel@vger.kernel.org>,
Linux Security List <linux-security-module@vger.kernel.org>,
SELinux List <selinux@tycho.nsa.gov>
Subject: Re: [PATCH 00/19] lnfs: 3.9-rc5 release
Date: Tue, 23 Apr 2013 14:57:00 -0400 [thread overview]
Message-ID: <5176D97C.7050609@RedHat.com> (raw)
In-Reply-To: <1366742457.31304.545.camel@falcor1.watson.ibm.com>
On 23/04/13 14:40, Mimi Zohar wrote:
> On Tue, 2013-04-23 at 14:04 -0400, Steve Dickson wrote:
>> On 23/04/13 13:22, J. Bruce Fields wrote:
>>>>> What exactly was failing?
>>>>>
>>>>> Sorry I can't find the results right now. I'll re-run and let you know.
>>> The server is returning -EOPNOTSUPP in response to an nfs4 SETATTR which
>>> sets a mode.
>>>
>>> The operation shouldn't be failing, and if it does it should return an
>>> NFS error, not -ERRNO.
>>>
>>> I can't reproduce this just by doing chmod on the linux client. I'm not
>>> sure what pynfs is doing differently to trigger the bug.
>> thanks for talking a look...
>>
>> Hmm... I wonder if the fact nfsd4_set_nfs4_label() is returning
>> -EOPNOTSUPP instead of something like nfserr_attrnotsupp when
>> labels are not configured... Something you've pointed out
>> twice now...
>> http://www.spinics.net/lists/linux-nfs/msg36104.html
>>
>> If it is this problem I wonder why a chmod would not trigger it...
>
> Do you by any chance have EVM enabled? EVM includes the i_mode in the
> HMAC calculation. Anytime the i_mode changes, the existing HMAC is
> verified, before recalculating the HMAC to reflect the change. The
> hooks are there to update the HMAC, when using chmod.
No. CONFIG_EVM is not set.
steved.
>
> I posted a couple of patches to audit this type of error last week, but
> haven't sent a pull request yet.
>
> evm: audit integrity metadata failures
> integrity: move integrity_audit_msg()
> evm: calculate HMAC after initializing posix acl
>
> thanks,
>
> Mimi
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
prev parent reply other threads:[~2013-04-23 18:57 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-02 21:45 [PATCH 00/19] lnfs: 3.9-rc5 release Steve Dickson
2013-04-02 21:45 ` [PATCH 01/19] Security: Add hook to calculate context based on a negative dentry Steve Dickson
2013-04-02 23:35 ` Myklebust, Trond
[not found] ` <1364945729.3026.7.camel-5lNtUQgoD8Pfa3cDbr2K10B+6BGkLq7r@public.gmane.org>
2013-04-03 19:57 ` David Quigley
2013-04-02 21:45 ` [PATCH 03/19] LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data Steve Dickson
2013-04-02 21:45 ` [PATCH 04/19] SELinux: Add new labeling type native labels Steve Dickson
2013-04-02 21:45 ` [PATCH 05/19] NFSv4: Add label recommended attribute and NFSv4 flags Steve Dickson
2013-04-02 21:45 ` [PATCH 06/19] NFSv4: Introduce new label structure Steve Dickson
2013-04-02 21:45 ` [PATCH 07/19] NFSv4: Extend fattr bitmaps to support all 3 words Steve Dickson
2013-04-02 21:45 ` [PATCH 09/19] NFS: Add label lifecycle management Steve Dickson
2013-04-02 21:45 ` [PATCH 10/19] NFS: Client implementation of Labeled-NFS Steve Dickson
2013-04-02 21:45 ` [PATCH 11/19] NFS: Extend NFS xattr handlers to accept the security namespace Steve Dickson
[not found] ` <1364939160-20874-1-git-send-email-SteveD-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2013-04-02 21:45 ` [PATCH 02/19] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-04-02 21:45 ` [PATCH 08/19] NFS:Add labels to client function prototypes Steve Dickson
2013-04-02 21:45 ` [PATCH 12/19] Kconfig: Add Kconfig entry for Labeled NFS V4 client Steve Dickson
2013-04-02 21:45 ` [PATCH 13/19] NFSD: Server implementation of MAC Labeling Steve Dickson
[not found] ` <1364939160-20874-14-git-send-email-SteveD-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2013-04-10 15:19 ` J. Bruce Fields
[not found] ` <20130410151953.GC24404-spRCxval1Z7TsXDwO4sDpg@public.gmane.org>
2013-04-23 19:40 ` Steve Dickson
2013-04-23 19:44 ` J. Bruce Fields
2013-04-23 19:51 ` Steve Dickson
2013-04-02 21:46 ` [PATCH 19/19] NFSDv4.2: Added NFS v4.2 support to the NFS server Steve Dickson
2013-04-10 15:25 ` J. Bruce Fields
2013-04-10 15:58 ` Steve Dickson
2013-04-10 20:12 ` J. Bruce Fields
2013-04-11 16:58 ` Steve Dickson
2013-04-02 21:45 ` [PATCH 14/19] Kconfig: Add Kconfig entry for Labeled NFS V4 server Steve Dickson
2013-04-02 21:45 ` [PATCH 15/19] NFSv4.2: Added NFS v4.2 support to the NFS client Steve Dickson
2013-04-02 21:45 ` [PATCH 16/19] NFSv4.2: Only allocate labels on v4.2 mounts Steve Dickson
2013-04-02 21:45 ` [PATCH 17/19] NFSv4.2: Only set the label attribute " Steve Dickson
2013-04-02 21:45 ` [PATCH 18/19] NFSv4.2: Added v4.2 error codes Steve Dickson
2013-04-10 15:09 ` [PATCH 00/19] lnfs: 3.9-rc5 release J. Bruce Fields
[not found] ` <20130410150940.GB24404-spRCxval1Z7TsXDwO4sDpg@public.gmane.org>
2013-04-10 15:48 ` Steve Dickson
2013-04-12 15:03 ` J. Bruce Fields
2013-04-23 15:46 ` Steve Dickson
2013-04-23 16:05 ` J. Bruce Fields
2013-04-23 17:22 ` J. Bruce Fields
[not found] ` <20130423172227.GF20622-spRCxval1Z7TsXDwO4sDpg@public.gmane.org>
2013-04-23 18:04 ` Steve Dickson
[not found] ` <5176CD42.4080405-AfCzQyP5zfLQT0dZR+AlfA@public.gmane.org>
2013-04-23 18:15 ` J. Bruce Fields
2013-04-23 18:40 ` Mimi Zohar
2013-04-23 18:57 ` Steve Dickson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5176D97C.7050609@RedHat.com \
--to=steved@redhat.com \
--cc=Trond.Myklebust@netapp.com \
--cc=bfields@redhat.com \
--cc=dpquigl@tycho.nsa.gov \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=selinux@tycho.nsa.gov \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).