From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andreas Gruenbacher Subject: Re: [Cluster-devel] [RFC 11/11] gfs2: Invalide security labels of inodes that go invalid Date: Fri, 21 Aug 2015 11:25:26 +0200 Message-ID: References: <1440094798-1411-1-git-send-email-agruenba@redhat.com> <1440094798-1411-12-git-send-email-agruenba@redhat.com> <20150821064952.GB32060@infradead.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Andreas Gruenbacher , cluster-devel@redhat.com, David Quigley , Eric Paris , "J. Bruce Fields" , linux-security-module@vger.kernel.org, Alexander Viro , linux-fsdevel , "Aneesh Kumar K.V" To: Christoph Hellwig Return-path: Received: from mail-la0-f54.google.com ([209.85.215.54]:34414 "EHLO mail-la0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752533AbbHUJZ1 (ORCPT ); Fri, 21 Aug 2015 05:25:27 -0400 Received: by laba3 with SMTP id a3so37907751lab.1 for ; Fri, 21 Aug 2015 02:25:26 -0700 (PDT) In-Reply-To: <20150821064952.GB32060@infradead.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Christoph, thanks for your review. 2015-08-21 8:49 GMT+02:00 Christoph Hellwig : > On Thu, Aug 20, 2015 at 08:19:58PM +0200, Andreas Gruenbacher wrote: >> Invalide security labels of inodes when they go invalid. SELinux will reload >> the "security.selinux" xattr via iop->igetxattr on the next access. > > And if that's all that you needed just skip the detour trough the VFS > interfaces. We have more than one file system that has a similar consistency model as gfs2 so it's not really a one-off hack, and we have selinux as well as smack, with several different xattr names. Assuming that selinux or smack only have an inode available, how would they (re)load an inode's security label other than going through the vfs? I could imagine bypassing the xattr handler abstraction in the affected file systems, but that doesn't seem much better either. Thanks, Andreas