Hello, this patch queue adds an LSM hook for file systems to invalidate inode security labels. To allow selinux to revalidate invalid labels, the generic xattr handlers are cleaned up a bit and a new igetxattr inode operation is introduced: the getxattr inode operation requires a dentry which selinux doesn't have in inode_has_perm(); igetxattr instead takes an inode. Finally, gfs2 is patched to make use of this new mechanism. The new igetxattr inode operation currently is *only* used for revalidating security labels in selinux; it may make sense to use it instead of getxattr when defined. Is this approach useful? An alternative would be to modify selinux so that it always has a dentry when checking inode security labels; I would guess that this won't work in all cases, though. BACKGROUND Selinux currently assumes that, after initialization, inode->i_security always represents the current security label of the inode. This assumption works for local file systems; any change of the label must go through setxattr (or removexattr) which updates inode->i_security. On an nfs mount, other nodes can change the security label; there is no immediate notification mechanism. Other nodes will eventually notice a label change because the label is transmitted as part of the reply of operations like open. (A timeout for cached labels would help too; I'm not sure if the code implements that.) Other file systems have different consistency models. For example, gfs2 inodes go "invalid" when a node drops the inode's glocks. When such an invalid inode is accessed again, all the metadata must be read from disk again, including the security label. For that case, the file system has no way of updating the security label before selinux next uses it. Things also don't fix themselves over time; when selinux rejects access, the file system never notices. To fix that, this patch queue adds a mechanism for file systems to invalidate inode security labels, and for selinux to revalidate them; this is similar to how the inode acl cache works. Thanks, Andreas Andreas Gruenbacher (11): ubifs: Remove unused "security.*" xattr handler hfsplus: Remove unused xattr handler list operations 9p: Simplify the xattr handlers xattr handlers: Pass handler to operations instead of flags xattr handlers: Some simplifications lib: Move strcmp_prefix into string.c 9p: Stop using the generic xattr_handler infrastructure xattr: Pass inodes to xattr handlers instead of dentries vfs: Add igetxattr inode operation selinux: Allow to invalidate an inode's security label gfs2: Invalide security labels of inodes that go invalid Documentation/filesystems/Locking | 2 + Documentation/filesystems/vfs.txt | 4 ++ fs/9p/Makefile | 5 +-- fs/9p/acl.c | 65 ++++++------------------------ fs/9p/vfs_super.c | 5 +-- fs/9p/xattr.c | 74 +++++++++++++++++++++++++++++++++- fs/9p/xattr.h | 18 ++++++--- fs/9p/xattr_security.c | 80 ------------------------------------- fs/9p/xattr_trusted.c | 80 ------------------------------------- fs/9p/xattr_user.c | 80 ------------------------------------- fs/ext2/xattr.c | 4 +- fs/ext2/xattr_security.c | 19 +++++---- fs/ext2/xattr_trusted.c | 19 +++++---- fs/ext2/xattr_user.c | 25 ++++++------ fs/ext3/xattr.c | 5 ++- fs/ext3/xattr_security.c | 19 +++++---- fs/ext3/xattr_trusted.c | 19 +++++---- fs/ext3/xattr_user.c | 25 ++++++------ fs/ext4/xattr.c | 5 ++- fs/ext4/xattr_security.c | 19 +++++---- fs/ext4/xattr_trusted.c | 19 +++++---- fs/ext4/xattr_user.c | 25 ++++++------ fs/f2fs/xattr.c | 71 +++++++++++++++------------------ fs/gfs2/glops.c | 2 + fs/gfs2/inode.c | 16 ++++++-- fs/gfs2/xattr.c | 17 ++++---- fs/hfsplus/xattr.c | 33 ++++++---------- fs/hfsplus/xattr.h | 4 +- fs/hfsplus/xattr_security.c | 25 ++++-------- fs/hfsplus/xattr_trusted.c | 25 ++++-------- fs/hfsplus/xattr_user.c | 25 ++++-------- fs/jffs2/security.c | 19 +++++---- fs/jffs2/xattr.c | 8 ++-- fs/jffs2/xattr_trusted.c | 18 +++++---- fs/jffs2/xattr_user.c | 19 +++++---- fs/nfs/nfs4proc.c | 49 ++++++++++++----------- fs/ocfs2/xattr.c | 63 ++++++++++++++++------------- fs/posix_acl.c | 37 ++++++++--------- fs/reiserfs/xattr.c | 29 ++++++++------ fs/reiserfs/xattr_security.c | 24 +++++------ fs/reiserfs/xattr_trusted.c | 24 +++++------ fs/reiserfs/xattr_user.c | 24 +++++------ fs/squashfs/xattr.c | 83 ++++++++++++++------------------------- fs/ubifs/super.c | 1 - fs/ubifs/ubifs.h | 1 - fs/ubifs/xattr.c | 40 ------------------- fs/xattr.c | 37 ++++++++--------- fs/xfs/xfs_xattr.c | 16 +++++--- include/linux/fs.h | 1 + include/linux/lsm_hooks.h | 6 +++ include/linux/security.h | 5 +++ include/linux/string.h | 1 + include/linux/xattr.h | 16 ++++---- lib/string.c | 16 ++++++++ security/selinux/hooks.c | 47 ++++++++++++++++------ security/selinux/include/objsec.h | 3 +- 56 files changed, 620 insertions(+), 801 deletions(-) delete mode 100644 fs/9p/xattr_security.c delete mode 100644 fs/9p/xattr_trusted.c delete mode 100644 fs/9p/xattr_user.c -- 2.4.3 -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
