From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6ECB6C71130 for ; Mon, 7 Jul 2025 20:38:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id F27FC6B03E7; Mon, 7 Jul 2025 16:38:10 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id ED8D36B03E8; Mon, 7 Jul 2025 16:38:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DEE7B6B03E9; Mon, 7 Jul 2025 16:38:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id CA8836B03E7 for ; Mon, 7 Jul 2025 16:38:10 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 5171614011B for ; Mon, 7 Jul 2025 20:38:10 +0000 (UTC) X-FDA: 83638630740.27.96A3835 Received: from mail-qk1-f176.google.com (mail-qk1-f176.google.com [209.85.222.176]) by imf24.hostedemail.com (Postfix) with ESMTP id 2B5F4180013 for ; Mon, 7 Jul 2025 20:38:08 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=ieee.org header.s=google header.b=fhvSZ9sh; spf=pass (imf24.hostedemail.com: domain of pebenito@ieee.org designates 209.85.222.176 as permitted sender) smtp.mailfrom=pebenito@ieee.org; dmarc=pass (policy=reject) header.from=ieee.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1751920688; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=6BTlWpVgqOV5ugp/e3CPL0JyQGmCCQPxWeyY4pt9b7I=; b=DUdIooXiKDd6ZqOgbs74ZDP28E8ENyi5p9DczwKLxF9G1ob5gFBJajZsGM62q6skbAFjSg G59Zjjs/od6RQhMlXU/jBZdJ0VwNXHAP2jG83WSR/b84rQpR+mruWeQgJG9ipwmP+ONA6E otf2VYlzbVXom/OtvgeWGRkJfE/gtb4= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1751920688; a=rsa-sha256; cv=none; b=vafc7JfduN1xOukmjX+g5qsqYlyIBH6I+upsrNjNJzcT2kIA6L7gzF4iA1wBmP/B5qPcbU nNqv4Kleyqki5eRD6jm1sR4/+bp7xZoUZAAMSiXhenHvQEXiZGq1++qGU6W2YEYrcZVllx jtDXrB3+/vXcRximehmT7n9tc8AtY28= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=ieee.org header.s=google header.b=fhvSZ9sh; spf=pass (imf24.hostedemail.com: domain of pebenito@ieee.org designates 209.85.222.176 as permitted sender) smtp.mailfrom=pebenito@ieee.org; dmarc=pass (policy=reject) header.from=ieee.org Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-7d9e2f85ab4so34127985a.3 for ; Mon, 07 Jul 2025 13:38:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; t=1751920687; x=1752525487; darn=kvack.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=6BTlWpVgqOV5ugp/e3CPL0JyQGmCCQPxWeyY4pt9b7I=; b=fhvSZ9shnMnDAL88/FI1RQ/HflxX1POMEywi6aAEXTdHKZwJlieIZTfYOlerxlk1Ho S7Fv2hd6C++GTKnNZspHPqtSpDog4PBKxPzaJUdiQQ4IsRGbrOioln8wBAzNT6FX47B4 wOqj5WSvt4+ceU7XXz/HIvk4nxO1MSaqUxg3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1751920687; x=1752525487; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=6BTlWpVgqOV5ugp/e3CPL0JyQGmCCQPxWeyY4pt9b7I=; b=EMkJZolEbLyOiz8fWhF2z/KhieBIsRjV2HzzNi0waVUsKWVfcH1/cKzodrznLzRYMR P3t7c5MqgHYjm0MFvXGCCcWkdoFOyLN/mmIgSeaIcAc1n17cPNjCzWENwrbjysSg1+Cm dKtrCe1ZTI7kUZyh9UOguWEjcXQ6WbgJOM+083kYxstf1Soyh/PrKTUI/UCm8GSGth00 u9fGOwW/jSxzQzSl45Owtgx0c3UyDbFSdYvDNpCr3qgAiMSg8w3puNoc6RnaJRAXQQlf SWr/JcVzE9UpYA2aq5yXkQ/rvYQkTt2eAqmzQMG04XsMZFhYFzFYXDgdXLBf8/mb79KS m79A== X-Forwarded-Encrypted: i=1; AJvYcCW+xwQYG8qy81nTzLcVyueC7ExA2urmV/f2IzquKlZHFXqZm7F4+gPJUfNU0l9RMJ3+GNCSG9bKxQ==@kvack.org X-Gm-Message-State: AOJu0Ywws6/a7big3qkmHcZsh0gmK0iXmN5jsndwZrrx0AjQziV4oRmM 9okN3YGQFfwvmb8OpUzlUyfKCesFvWT0rBEQiWkkaN7qKheIPXnlBEtazVwh5xbNjQ== X-Gm-Gg: ASbGncsIxtA3KpwhmwU1UqxLf9PhoXQnPNOc5FBSry8JaWFsAOt8t/K7RWEbtc6TghT pbhwVfjTxwB7V//r/7k8CCSuu3sG/zXR029q3mLy7dOwEW1Z5715auBAZLz7l0qHC89aQWv0H7Y z+DBnmzbJXZkQlieVghe5KwO5/nujpyJL/fJeU4vq6G+i73wYNJZpysEJ2vAW87S5O3iG7jECau O8YC1xluZxZretoi3Eh4haaTVZhBjJ3oK77N9sBhg2Ij2K5Vnlq67fRT8DSCJP8QRZWFFdaQknc SZNBI3y0fYnjx8wVJfRTJbRYSxlPfwcg8YIoCzLCZ22TgMG9Bdtk9RXk+df4IcfMycs16JVBUi1 kbiMnzQC9hLGogSxa/28Vmx4jAxIZyGbEoxbJCXwJNWuf0fY= X-Google-Smtp-Source: AGHT+IEaHKHQ7/gC3ce/2SRKioHppqzpcheDCakLklCvAnjqt9HnqlAKfKYaZRVlYc4h5UFY3+OS2w== X-Received: by 2002:a05:620a:2916:b0:7d5:d240:ba4d with SMTP id af79cd13be357-7da01d74aaamr74728885a.22.1751920687191; Mon, 07 Jul 2025 13:38:07 -0700 (PDT) Received: from ?IPV6:2601:145:c283:58e0:5dee:da73:58da:ff15? ([2601:145:c283:58e0:5dee:da73:58da:ff15]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-702c4ccd60csm64345516d6.35.2025.07.07.13.38.06 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 07 Jul 2025 13:38:06 -0700 (PDT) Message-ID: <48916a70-2a89-4d24-8e36-d15ccc112519@ieee.org> Date: Mon, 7 Jul 2025 16:38:00 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3] fs: generalize anon_inode_make_secure_inode() and fix secretmem LSM bypass To: Paul Moore , Shivank Garg Cc: david@redhat.com, akpm@linux-foundation.org, brauner@kernel.org, rppt@kernel.org, viro@zeniv.linux.org.uk, seanjc@google.com, vbabka@suse.cz, willy@infradead.org, pbonzini@redhat.com, tabba@google.com, afranji@google.com, ackerleytng@google.com, jack@suse.cz, hch@infradead.org, cgzones@googlemail.com, ira.weiny@intel.com, roypat@amazon.co.uk, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, selinux-refpolicy@vger.kernel.org References: <20250626191425.9645-5-shivankg@amd.com> <67c40ef1-8d90-44c5-b071-b130a960ecc4@amd.com> Content-Language: en-US From: Chris PeBenito In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 2B5F4180013 X-Stat-Signature: cyrrpahyhf4gwf48wwd1pexypphit7w7 X-HE-Tag: 1751920688-316736 X-HE-Meta: U2FsdGVkX1/BfMCrHn+Q+jphi4jmcC0fn2+aBmyHeAj9w/XGB4iwrpjGiG0q+32ThFrC/aBStXAgf4F+Ut4j6GUKdEzghZxXuFHPCnUABwFkPQossIS7P/wcLmyBpYyOejT9NSjUvaUGrPOHC4d7ANxWzYtyTcXRszBJLTlXemoql+yk9gfK+uxj0SFHQ+mk9lQJDPDSkavasTnjkOUBOPKwMP/8O4d60A8A9A9p6J4S2mcUlPk318oG2W/f46yIaLL+4mXOgXhp15bCqQtEN4OajsfXpI2LZpgDyljkW/ohxStfulO1qf+74cSVGVasA+rTezAWPz7MK99SPopqkhMGZ/bwjI5u1PAj1fJL9RiwX1YKhkKYEgAct17BQQcA+FIx8eqMS+lTlRaOykkmtD35jVfwQp3LTIKooJGcjgHPx+glf0MX2SFbW1CgkrNc2eAy6EaMbiGTTSqrOjU4gl531nMILVVNsYRmoRQJ89Cpu3h64nd36sALGQ2JGIV7tJvYqKA7TtetUbi2r/fkrJs/0gsM9Zqiwepg+DYS6WZAs94lhaTvhHcWd8no+X8VnJ3H/12F+S8PKLYwxMxcZ8iLjJOXX4XHsSO5xdfT95zHYS2yly00Xcpu/afGYIrtD+/soNwaOrEQ4nVB9LVQH0It+sFUy22zaarwqpGQA/lFDyTz9BK2gONNbd7bOcQ2hBkKzrSVM6dVTTuEBg0qqsXhN0jyYLSqhNhv/ujgzH1jGPwQGT1pWzJ1j4m9WxJe4Wp7udk/QieMIjVcOb1Gx7LB/jFdUa0wKbHRQTyZ2nw8MKxr4oFOPuGHi1wDEODULMyR349Zrtuvql9ldi1I8hUcSWDZXvPzVwyO12br+/nqc1asohnIx2k4HXW12Nnlrl0MGb34KHEWgJhpddHlvTs8qreU+vDLPBl9B5pVhgnhwx8Xnfbs6FdhJdLkGJpPjg8GqeoWRqH/iA18AAO GPYfEUAj fXsjZuJqVLABdFxX6mUl6JxoGx1ifBr76I+LqvLNtB4/arBcHs6+P3/jYM0TTSFwtLGUdDorzDzis7wAj6UlgxW7chgRyXUqpXA8Cpj/V9cXUtRllFjT8u0anH2Kdf0FrC51gd3SVs3mN57OKAttFZTkR7DZXWeuioglVT9Zm50sAUvhKo7NUUllhaWsQ/EiYfXV9Cl6ChaN+/CxwwAAkrBRD/bKO7I+8icsTvkZ/UxS1iQOAD3YC/bHohP5fW4psXIJJoqhIMGkmA+HssFnPWn+z0hYDxr0DPI2i8LHkLjGSNCS2vwZbyUeIUOQjC7Yp/445eZxAxtj+tC4hcUIc0eTP76HVWiXAPCVvNwtSwOMfK7IujmOZbf90YrxKKfx0w80lZel0rGt1DJRcFbyJnqMxbYiSTPTGaoon7z12lQOtQp3PiFdgeMhNs6TI14GOCa6aZGMl7vTc0YVBlOeOZCpUsw+DqG9c919K X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 7/7/2025 4:01 PM, Paul Moore wrote: > On Fri, Jul 4, 2025 at 6:41 AM Shivank Garg wrote: >> On 7/3/2025 7:43 AM, Paul Moore wrote: >>> On Jun 26, 2025 Shivank Garg wrote: >> >> ... >> >>> Thanks again for your continued work on this! I think the patch looks >>> pretty reasonable, but it would be good to hear a bit about how you've >>> tested this before ACK'ing the patch. For example, have you tested this >>> against any of the LSMs which provide anonymous inode support? >>> >>> At the very least, the selinux-testsuite has a basic secretmem test, it >>> would be good to know if the test passes with this patch or if any >>> additional work is needed to ensure compatibility. >>> >>> https://github.com/SELinuxProject/selinux-testsuite >> >> Hi Paul, >> >> Thank you for pointing me to the selinux-testsuite. I wasn't sure how to properly >> test this patch, so your guidance was very helpful. >> >> With the current test policy (test_secretmem.te), I initially encountered the following failures: >> >> ~/selinux-testsuite/tests/secretmem# ./test >> memfd_secret() failed: Permission denied >> 1..6 >> memfd_secret() failed: Permission denied >> ok 1 >> ftruncate failed: Permission denied >> unable to mmap secret memory: Permission denied >> not ok 2 > > ... > >> To resolve this, I updated test_secretmem.te to add additional required >> permissions {create, read, write, map} >> With this change, all tests now pass successfully: >> >> diff --git a/policy/test_secretmem.te b/policy/test_secretmem.te >> index 357f41d..4cce076 100644 >> --- a/policy/test_secretmem.te >> +++ b/policy/test_secretmem.te >> @@ -13,12 +13,12 @@ testsuite_domain_type_minimal(test_nocreate_secretmem_t) >> # Domain allowed to create secret memory with the own domain type >> type test_create_secretmem_t; >> testsuite_domain_type_minimal(test_create_secretmem_t) >> -allow test_create_secretmem_t self:anon_inode create; >> +allow test_create_secretmem_t self:anon_inode { create read write map }; >> >> # Domain allowed to create secret memory with the own domain type and allowed to map WX >> type test_create_wx_secretmem_t; >> testsuite_domain_type_minimal(test_create_wx_secretmem_t) >> -allow test_create_wx_secretmem_t self:anon_inode create; >> +allow test_create_wx_secretmem_t self:anon_inode { create read write map }; > > I believe this domain also needs the anon_inode/execute permission. > >> allow test_create_wx_secretmem_t self:process execmem; >> >> # Domain not allowed to create secret memory via a type transition to a private type >> @@ -30,4 +30,4 @@ type_transition test_nocreate_transition_secretmem_t test_nocreate_transition_se >> type test_create_transition_secretmem_t; >> testsuite_domain_type_minimal(test_create_transition_secretmem_t) >> type_transition test_create_transition_secretmem_t test_create_transition_secretmem_t:anon_inode test_secretmem_inode_t "[secretmem]"; >> -allow test_create_transition_secretmem_t test_secretmem_inode_t:anon_inode create; >> +allow test_create_transition_secretmem_t test_secretmem_inode_t:anon_inode { create read write map }; >> >> Does this approach look correct to you? Please let me know if my understanding >> makes sense and what should be my next step for patch. > > [NOTE: added selinux@vger and selinux-refpolicy@vger to the To/CC line] > > Hi Shivank, > > My apologies for not responding earlier, Friday was a holiday and I > was away over the weekend. Getting back at it this morning I ran into > the same failures as you described, and had to make similar changes to > the selinux-testsuite policy (see the anon_inode/execute comment > above, I also added the capability/ipc_lock permission as needed). > > Strictly speaking this is a regression in the kernel, even if the new > behavior is correct. I'm CC'ing the SELinux and Reference Policy > lists so that the policy devs can take a look and see what impacts > there might be to the various public SELinux policies. If this looks > like it may be a significant issue, we'll need to work around this > with a SELinux "policy capability" or some other compatibility > solution. In refpolicy, there are 34 rules for anon_inode and they all have { create read write map } -- none of them have the execute permission. Of these, only 4 are explict and could potentially be broken. The remaining get it due to being unconfined, thus can be immediately fixed, since it's unconfined. IMO, this is very low impact. -- Chris PeBenito