From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6BD1C433F5 for ; Wed, 13 Oct 2021 15:47:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8B1DA611AD for ; Wed, 13 Oct 2021 15:47:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234817AbhJMPtD (ORCPT ); Wed, 13 Oct 2021 11:49:03 -0400 Received: from smtp-bc0c.mail.infomaniak.ch ([45.157.188.12]:43989 "EHLO smtp-bc0c.mail.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229748AbhJMPtC (ORCPT ); Wed, 13 Oct 2021 11:49:02 -0400 Received: from smtp-3-0001.mail.infomaniak.ch (unknown [10.4.36.108]) by smtp-3-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4HTxjY44HSzMqSBR; Wed, 13 Oct 2021 17:46:57 +0200 (CEST) Received: from ns3096276.ip-94-23-54.eu (unknown [23.97.221.149]) by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4HTxjX55Rfzlh8TK; Wed, 13 Oct 2021 17:46:56 +0200 (CEST) Subject: Re: [PATCH] security/landlock: use square brackets around "landlock-ruleset" To: Paul Moore , Ondrej Mosnacek , Christian Brauner Cc: Chris PeBenito , Petr Lautrbach , Christian Brauner , Linux Security Module list , SElinux list References: <20211011133704.1704369-1-brauner@kernel.org> <06b6f249-06e6-f472-c74c-bb3ff6f4b4ee@digikod.net> <20211012103830.s7kzijrn25ucjasr@wittgenstein> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: Date: Wed, 13 Oct 2021 17:47:53 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: On 12/10/2021 23:09, Paul Moore wrote: > On Tue, Oct 12, 2021 at 4:38 PM Ondrej Mosnacek wrote: >> >> On Tue, Oct 12, 2021 at 8:12 PM Paul Moore wrote: >>> On Tue, Oct 12, 2021 at 6:38 AM Christian Brauner >>> wrote: >>>> On Mon, Oct 11, 2021 at 04:38:55PM +0200, Mickaël Salaün wrote: >>>>> On 11/10/2021 15:37, Christian Brauner wrote: >>>>>> From: Christian Brauner >>>>>> >>>>>> Make the name of the anon inode fd "[landlock-ruleset]" instead of >>>>>> "landlock-ruleset". This is minor but most anon inode fds already >>>>>> carry square brackets around their name: >>>>>> >>>>>> [eventfd] >>>>>> [eventpoll] >>>>>> [fanotify] >>>>>> [fscontext] >>>>>> [io_uring] >>>>>> [pidfd] >>>>>> [signalfd] >>>>>> [timerfd] >>>>>> [userfaultfd] >>>>>> >>>>>> For the sake of consistency lets do the same for the landlock-ruleset anon >>>>>> inode fd that comes with landlock. We did the same in >>>>>> 1cdc415f1083 ("uapi, fsopen: use square brackets around "fscontext" [ver #2]") >>>>>> for the new mount api. >>>>> >>>>> Before creating "landlock-ruleset" FD, I looked at other anonymous FD >>>>> and saw this kind of inconsistency. I don't get why we need to add extra >>>>> characters to names, those brackets seem useless. If it should be part >>>> >>>> Past inconsistency shouldn't justify future inconsistency. If you have a >>>> strong opinion about this for landlock I'm not going to push for it. >>>> Exchanging more than 2-3 email about something like this seems too much. >>> >>> [NOTE: adding the SELinux list as well as Chris (SELinux refrence >>> policy maintainer) and Petr (Fedora/RHEL SELinux)] >>> >>> Chris and Petr, do either of you currently have any policy that >>> references the "landlock-ruleset" anonymous inode? In other words, >>> would adding the brackets around the name cause you any problems? >> >> AFAIU, the anon_inode transitions (the only mechanism where the "file >> name" would be exposed to the policy) are done only for inodes created >> by anon_inode_getfd_secure(), which is currently only used by >> userfaultfd. So you don't even need to ask that question; at this >> point it should be safe to change any of the names except >> "[userfaultfd]" as far as SELinux policy is concerned. > > There is also io_uring if you look at selinux/next. > > Regardless, thanks, I didn't check to see if landlock was using the > new anon inode interface, since both Mickaël and Christian were > concerned about breaking SELinux I had assumed they were using it :) > Ok, thanks Paul and Ondrej. Such anonymous inode names seem to be only exposed to proc for now. Let's change this name then. I think it make sense to backport this patch down to 5.13 to fix all the inconsistencies.