From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1C73C77B7C for ; Tue, 24 Jun 2025 09:02:19 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9F7D48D0002; Tue, 24 Jun 2025 05:02:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9CFD98D0001; Tue, 24 Jun 2025 05:02:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 90C748D0002; Tue, 24 Jun 2025 05:02:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 807A78D0001 for ; Tue, 24 Jun 2025 05:02:19 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 4693D1601AC for ; Tue, 24 Jun 2025 09:02:18 +0000 (UTC) X-FDA: 83589702756.05.1B4DD3B Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by imf30.hostedemail.com (Postfix) with ESMTP id 77D1380011 for ; Tue, 24 Jun 2025 09:02:16 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=EH4HuEM6; spf=pass (imf30.hostedemail.com: domain of brauner@kernel.org designates 172.105.4.254 as permitted sender) smtp.mailfrom=brauner@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1750755736; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=OwUKBD5hoSKwAPC6IDJMxglTllN/Y1GbwkdCwGk8vRU=; b=QyACa0Vp/IVuJMrCL8RUztql2f+DWdiKBSmuYiaIXFUcXFYPhyoyC9SWEmGMIGp/EtHgPv W9ErbIcSD/w4BBV8nTX/G/swIgHL2NKNtOyXy5QYX3tTx5pB75eABNpSs2YLrOQg3a5TOG 6ssEOAYVK9nsPzmfjm2wTs9CQpexlCs= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1750755736; a=rsa-sha256; cv=none; b=FGvYhnujCayctto68aWL9hd2moixpkjeM+eppAtg4GK6buJDduJSM5LSrVMmnrJFwOz4ig l/O148TbvZ8Q0zbqx4MDN644e6e6A81PIftwC8VRtTWtsXydVpbyqFE5rr5UOm8xARKgCj jB/iSWenCKQSnmfajn8udqf6icip2Xw= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=EH4HuEM6; spf=pass (imf30.hostedemail.com: domain of brauner@kernel.org designates 172.105.4.254 as permitted sender) smtp.mailfrom=brauner@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id C1A34629CF; Tue, 24 Jun 2025 09:02:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EBAF4C4CEE3; Tue, 24 Jun 2025 09:02:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1750755735; bh=RYBkNNitf5svZH4js90PzpOw2USAgvJPhk2Xr/4Wr4c=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=EH4HuEM6RvBdtrTQe68Z/JuJzhwhGI1DoOHoxlOg/zPA2Ltx43kiWw4v731PF2qQr xzAZnDdge6rY6/DdEPt4NZxhWroDrBdx4J8oAGvxwpzfa4Dr+VzBiaYrhZuZj10zJj YgreLuEQjpwZ1uLX1rc/kY3wK+sxBk2o9p/41yNuZ+9SWvAtZTa4W9QZ5CUl+WIInP pwLA5j7MVOsupjh1qcebSJWI5sYWpLZzTb4dZ2W2cnrxwROZTyEW6jfCqQd4LAZv8x iLKupLi0L7DeOnU/BFkzw68A9qL8+ttJmmiog9lbjh8W9CYo8DczBpIU3UOoGYOkXN rJmaGVdEvMpUA== Date: Tue, 24 Jun 2025 11:02:08 +0200 From: Christian Brauner To: Peter Zijlstra Cc: Vlastimil Babka , Christoph Hellwig , Sean Christopherson , Mike Rapoport , Shivank Garg , david@redhat.com, akpm@linux-foundation.org, paul@paul-moore.com, viro@zeniv.linux.org.uk, willy@infradead.org, pbonzini@redhat.com, tabba@google.com, afranji@google.com, ackerleytng@google.com, jack@suse.cz, cgzones@googlemail.com, ira.weiny@intel.com, roypat@amazon.co.uk, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH] fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Message-ID: <20250624-einwickeln-geflecht-f9cc9cc67d3c@brauner> References: <20250619-fixpunkt-querfeldein-53eb22d0135f@brauner> <20250619-ablichten-korpulent-0efe2ddd0ee6@brauner> <20250623-warmwasser-giftig-ff656fce89ad@brauner> <20250623142836.GT1613200@noisy.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20250623142836.GT1613200@noisy.programming.kicks-ass.net> X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 77D1380011 X-Stat-Signature: ib9prcnj8k4umj7xtwmw9rerc6ffab1g X-Rspam-User: X-HE-Tag: 1750755736-95188 X-HE-Meta: U2FsdGVkX1/ZIWzggrgGypfdMYnYhBF7gtdONlZSOvzgpOWpLmK83ggeQrVjfXbHa6Q9KHsgpN0pFSHVLSDmw8IpVu9J3XQj7PXp9/uyTzXaQRRebyiJQBTg6zbyjLhP9uFSkvyINo6To78zPgVCqLZdKeyYgC3gDbsffvS5Au/DScegLKjzlJA1fIfQvizYR0uxGJpCYtjGiKdHjdCPWuG1eaeSn/6CGEM6KJQ97HPfqIFhfPfE8/lPUsBZlhMRfFJN1kS386efUU8/jx9uw7t/dhcD0ibANQumqCMjm4eNne4azxZ6Q2fc7TYpdXiHHoTQPvlCj10eFoShYnCnPwmNgu2CRzXpDykBx9ZFHao5Y+qbYOA+5KR5fddCQxesfv8CNEDPqOrO2UCROEdCI061Qoozb7reR8mYAoCgbNyDpTzG6xtfSZ6tyqdsx1/njR7RjWGIOzngh0IOd6iVXu+h0BOeoSf7KOyofbJ8NZPyzLwDVdokMl73++x/T0p1wo1UeF6RSASiCexnM47g/tmHwIjjZKK5FcgSEQ7gi8ountmMZvQ+N9gu+LVwci1HNl/hAH+Ynlz0yJvi3NPqgA3BxuuM5denipLN6NZPXTCdo4Xna8gvEkIuYcKBlMdCkRFyywl3uBgeVdyNPtif7QNQ5LiFAgXzTFEOYc4y/MoDHuOUO7LFRdyDi+PLZBid0/Ddep6p7c8ornaURFqaui2HKjY1KyeSud6nujk4wJsKZ9v76XNZprCIM5uKY1uG6byktfCRsRFIS7L/9bDADxxyRUoxRbDgGpF40YpGBNjDHs/4LQmorjlkJ9XEwyFJiOG0la0aoAaLBFf66pVSDQaABKwoqd6TTkM/78pl43VPAg4tL2qfiy3QuTPpodBEGOcc9BHXNAqqzSMbx4vLc+DWYo9XPJ99p0ZlDY0laRE61wsEvjcWw4ibM9NQ81Np2V6EOgw/muC8htoS7Nt fBdWmIDR ITlDAH41FMt8vADlwDj9vhxPjCNJDAlHPRMxHa5n9pG4PQlMIxx1ZBOLN1i18XFQJe33JnAU9YzjABmLaN9XT27yBp26btkJTnNORI8o68sqIgrmtvoxcK601fy4a6c/DypfA5LBbruOIHn2JuPQeEtETipnQ8lJ9bwNO/Se9px/dnLWwaTN4ybNPEnrY+ycoiyDfEOnQJdxK5B/7bfFL237L7xSjKKPuRT8Dl0Oq9R+v5S9Czr6qAP20c1PJSr4OAVIwbI/ajffg4iHOQVm7xudB1J7x4zGacdumH2GyAkiI/1U5zre7whO/yw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Jun 23, 2025 at 04:28:36PM +0200, Peter Zijlstra wrote: > On Mon, Jun 23, 2025 at 04:21:15PM +0200, Vlastimil Babka wrote: > > On 6/23/25 16:01, Christoph Hellwig wrote: > > > On Mon, Jun 23, 2025 at 07:00:39AM -0700, Christoph Hellwig wrote: > > >> On Mon, Jun 23, 2025 at 12:16:27PM +0200, Christian Brauner wrote: > > >> > I'm more than happy to switch a bunch of our exports so that we only > > >> > allow them for specific modules. But for that we also need > > >> > EXPOR_SYMBOL_FOR_MODULES() so we can switch our non-gpl versions. > > >> > > >> Huh? Any export for a specific in-tree module (or set thereof) is > > >> by definition internals and an _GPL export if perfectly fine and > > >> expected. > > > > Peterz tells me EXPORT_SYMBOL_GPL_FOR_MODULES() is not limited to in-tree > > modules, so external module with GPL and matching name can import. > > > > But if we're targetting in-tree stuff like kvm, we don't need to provide a > > non-GPL variant I think? > > So the purpose was to limit specific symbols to known in-tree module > users (hence GPL only). > > Eg. KVM; x86 exports a fair amount of low level stuff just because KVM. > Nobody else should be touching those symbols. > > If you have a pile of symbols for !GPL / out-of-tree consumers, it > doesn't really make sense to limit the export to a named set of modules, > does it? > > So yes, nothing limits things to in-tree modules per-se. The > infrastructure only really cares about module names (and implicitly > trusts the OS to not overwrite existing kernel modules etc.). So you > could add an out-of-tree module name to the list (or have an out-of-free > module have a name that matches a glob; "kvm-vmware" would match "kvm-*" > for example). > > But that is very much beyond the intention of things. So I'm not well-versed in all the GPL vs non-GPL exports. I'm thinking of cases like EXPORT_SYMBOL(fget_task_next); That's exposed to gfs2 (and bpf but that's built-in). I see no reason to risk spreading the usage of that special-thing to anywhere else. So I would use EXPORT_*_FOR_MODULES(gfs2) for this and we'd notice if anything else is trying to use that thing. Another excellent candidate is: /* * synchronous analog of fput(); for kernel threads that might be needed * in some umount() (and thus can't use flush_delayed_fput() without * risking deadlocks), need to wait for completion of __fput() and know * for this specific struct file it won't involve anything that would * need them. Use only if you really need it - at the very least, * don't blindly convert fput() by kernel thread to that. */ void __fput_sync(struct file *file) { if (file_ref_put(&file->f_ref)) __fput(file); } EXPORT_SYMBOL(__fput_sync); That thing worries me to no end because that can be used to wreak all kinds of havoc and I want that thing tied down so no one can even look at it without getting a compile time or runtime error that we can immediately notice. So for that as well I want to allow-list modules that we have explictly acknowledged to use it. But iiuc I can't just switch that non-GPL exported symbol to a GPL exported symbol. And I don't want to be involved in some kind of ideological warfare around that stuff. I care about not growing more users of __fput_sync(). So any advice is appreciated.