From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4D47C433EF for ; Fri, 15 Oct 2021 11:46:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CF0BA60F8F for ; Fri, 15 Oct 2021 11:46:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235360AbhJOLsz (ORCPT ); Fri, 15 Oct 2021 07:48:55 -0400 Received: from smtp-190d.mail.infomaniak.ch ([185.125.25.13]:43185 "EHLO smtp-190d.mail.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235514AbhJOLsx (ORCPT ); Fri, 15 Oct 2021 07:48:53 -0400 Received: from smtp-2-0000.mail.infomaniak.ch (unknown [10.5.36.107]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4HW4HR0DnrzMqBGg; Fri, 15 Oct 2021 13:46:43 +0200 (CEST) Received: from ns3096276.ip-94-23-54.eu (unknown [23.97.221.149]) by smtp-2-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4HW4HP55gTzlhP4W; Fri, 15 Oct 2021 13:46:41 +0200 (CEST) Subject: Re: [PATCH] security/landlock: use square brackets around "landlock-ruleset" To: Linux API , stable Cc: Paul Moore , Ondrej Mosnacek , Christian Brauner , Chris PeBenito , Petr Lautrbach , Linux Security Module list , SElinux list , Christian Brauner References: <20211011133704.1704369-1-brauner@kernel.org> <06b6f249-06e6-f472-c74c-bb3ff6f4b4ee@digikod.net> <20211012103830.s7kzijrn25ucjasr@wittgenstein> <20211015091010.3ht6lvwoxw5ygkca@wittgenstein> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: Date: Fri, 15 Oct 2021 13:47:48 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: <20211015091010.3ht6lvwoxw5ygkca@wittgenstein> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: CCing linux-api and stable to give them a chance to confirm that changing proc symlink content is OK. On 15/10/2021 11:10, Christian Brauner wrote: > On Wed, Oct 13, 2021 at 05:47:53PM +0200, Mickaël Salaün wrote: >> >> On 12/10/2021 23:09, Paul Moore wrote: >>> On Tue, Oct 12, 2021 at 4:38 PM Ondrej Mosnacek wrote: >>>> >>>> On Tue, Oct 12, 2021 at 8:12 PM Paul Moore wrote: >>>>> On Tue, Oct 12, 2021 at 6:38 AM Christian Brauner >>>>> wrote: >>>>>> On Mon, Oct 11, 2021 at 04:38:55PM +0200, Mickaël Salaün wrote: >>>>>>> On 11/10/2021 15:37, Christian Brauner wrote: >>>>>>>> From: Christian Brauner >>>>>>>> >>>>>>>> Make the name of the anon inode fd "[landlock-ruleset]" instead of >>>>>>>> "landlock-ruleset". This is minor but most anon inode fds already >>>>>>>> carry square brackets around their name: >>>>>>>> >>>>>>>> [eventfd] >>>>>>>> [eventpoll] >>>>>>>> [fanotify] >>>>>>>> [fscontext] >>>>>>>> [io_uring] >>>>>>>> [pidfd] >>>>>>>> [signalfd] >>>>>>>> [timerfd] >>>>>>>> [userfaultfd] >>>>>>>> >>>>>>>> For the sake of consistency lets do the same for the landlock-ruleset anon >>>>>>>> inode fd that comes with landlock. We did the same in >>>>>>>> 1cdc415f1083 ("uapi, fsopen: use square brackets around "fscontext" [ver #2]") >>>>>>>> for the new mount api. >>>>>>> >>>>>>> Before creating "landlock-ruleset" FD, I looked at other anonymous FD >>>>>>> and saw this kind of inconsistency. I don't get why we need to add extra >>>>>>> characters to names, those brackets seem useless. If it should be part >>>>>> >>>>>> Past inconsistency shouldn't justify future inconsistency. If you have a >>>>>> strong opinion about this for landlock I'm not going to push for it. >>>>>> Exchanging more than 2-3 email about something like this seems too much. >>>>> >>>>> [NOTE: adding the SELinux list as well as Chris (SELinux refrence >>>>> policy maintainer) and Petr (Fedora/RHEL SELinux)] >>>>> >>>>> Chris and Petr, do either of you currently have any policy that >>>>> references the "landlock-ruleset" anonymous inode? In other words, >>>>> would adding the brackets around the name cause you any problems? >>>> >>>> AFAIU, the anon_inode transitions (the only mechanism where the "file >>>> name" would be exposed to the policy) are done only for inodes created >>>> by anon_inode_getfd_secure(), which is currently only used by >>>> userfaultfd. So you don't even need to ask that question; at this >>>> point it should be safe to change any of the names except >>>> "[userfaultfd]" as far as SELinux policy is concerned. >>> >>> There is also io_uring if you look at selinux/next. >>> >>> Regardless, thanks, I didn't check to see if landlock was using the >>> new anon inode interface, since both Mickaël and Christian were >>> concerned about breaking SELinux I had assumed they were using it :) >>> >> >> Ok, thanks Paul and Ondrej. >> >> Such anonymous inode names seem to be only exposed to proc for now. >> Let's change this name then. I think it make sense to backport this >> patch down to 5.13 to fix all the inconsistencies. > > Thank you. I do appreciate the point about this being annoying that we > have this inconsistency and it has bothered me too. > > Christian >