From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 088C8EB64DA for ; Thu, 20 Jul 2023 16:57:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 94DC3280145; Thu, 20 Jul 2023 12:57:03 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8FE6D28004C; Thu, 20 Jul 2023 12:57:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7C565280145; Thu, 20 Jul 2023 12:57:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 6D4AA28004C for ; Thu, 20 Jul 2023 12:57:03 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 37C831401E9 for ; Thu, 20 Jul 2023 16:57:03 +0000 (UTC) X-FDA: 81032595126.30.E4E5F34 Received: from mail-ua1-f48.google.com (mail-ua1-f48.google.com [209.85.222.48]) by imf27.hostedemail.com (Postfix) with ESMTP id 441E340013 for ; Thu, 20 Jul 2023 16:57:00 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=OFmwChsR; spf=pass (imf27.hostedemail.com: domain of hughd@google.com designates 209.85.222.48 as permitted sender) smtp.mailfrom=hughd@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1689872221; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TZCX9yhI7AbKGy/HnG34aNNVUXchyn5dmI5801hBoFs=; b=reLxYMF7YMguhxlwwjVqm9sVXj07pQiM40gircpR1GrwvgcSINWuZfruqvB/0quIq9h+PV oyIyQYIOHp9XFB0e7RIrG4C6z8lIQphqG8sCyD17SpTyvZWkflRXw84DcP2H2PAy82kQuo nXvaZrzkZ2qD7mOjKglLG7HfttFTQM0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1689872221; a=rsa-sha256; cv=none; b=vVFsRq5Y7z+VkL43sxvlz5250mxa3BV0WN++i+yPW1VCvR3aMiP2qv7kuk7AIq5ORjRtq4 P8ANzTqZQVuSP8qcOQofFbPTk4ZfUk9z5d8rqBKySuO8+7ewFeXYqHx7T35RfKFKb4NQ9j fCZ2ZyE3qc0o1ntEFB33qw5bgsQig/M= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=OFmwChsR; spf=pass (imf27.hostedemail.com: domain of hughd@google.com designates 209.85.222.48 as permitted sender) smtp.mailfrom=hughd@google.com; dmarc=pass (policy=reject) header.from=google.com Received: by mail-ua1-f48.google.com with SMTP id a1e0cc1a2514c-784f7f7deddso429234241.3 for ; Thu, 20 Jul 2023 09:57:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1689872220; x=1690477020; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to; bh=TZCX9yhI7AbKGy/HnG34aNNVUXchyn5dmI5801hBoFs=; b=OFmwChsRfRqH9lASmE0v54HU6kpsRwivRWRyqB44btzy+zNV0jDMcoAocZMcp1FND+ cTyrMgIW3CLI8mL3wxSoWtBJ+tZl36pkDUnxy25Zov3bibz2ZRjelm2iUOHZ77rpItZh UTDrKqVkVnHFItLO2tlUgwvou+HqhGBpvx8dEl3TpunBsGcTJKgzd2/burDS9oRfzK1r ZoJRsjyKq+9MGqnwF/bALJxj6p/0RlAhxpa11+oAP43beOBRwV1f17nUgrNQOCy+qgnD n9DGWXgd+4FDzMQi6Gqmz2rokhcWpYWXbzn8xMZj3GGenjzAcFNrG8KEk3e90QgjWF8e iMqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689872220; x=1690477020; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=TZCX9yhI7AbKGy/HnG34aNNVUXchyn5dmI5801hBoFs=; b=V/mwNeEJSuhwDKrsuyTgNJG/akVxvMMJbe4rt+RAEeRGoFLgUwg9Tpxy1Rgpy0XRCd x2sPGKVX3anzjDoRYGD8GC9o+k0kiyjZGnMhNX19O2ziafOQN46+uAbcaAVHO2KstCM0 nkS44fBOMWEsxGhSBLk2zmY5amAxQDAt/fsiY0XnuFL8FLVmZGhdbK8HOm6jOjHVS8/F 0xDpxLqK0IW0vI+U9pqz2HoLyD1cMo+jgfx0m3g+qkswy6G/VV3+SRjJf5Wo91lTlAnw U8THAEAcemhVq07ON26snNFuiKq0C3u0R/jh5IqJWVD8SJq5dbfABLUtEqmUFaVAPXYH xYpg== X-Gm-Message-State: ABy/qLYgzW/h2mp/sOhmuaS4MfDxYqgTxiRWxnO8pKiQQM57fgb0T7a5 nLEQWzGBv3SRIm//quTVJQWr4g== X-Google-Smtp-Source: APBJJlEsYqZ49Ny+WkiZxWE5TyzQv98GOGbTZwiNitn54WzBknEBplR1bvLxwQOCYwqiC5hsOLi/Kw== X-Received: by 2002:a67:b604:0:b0:43d:6660:581b with SMTP id d4-20020a67b604000000b0043d6660581bmr2252078vsm.5.1689872220064; Thu, 20 Jul 2023 09:57:00 -0700 (PDT) Received: from ripple.attlocal.net (172-10-233-147.lightspeed.sntcca.sbcglobal.net. [172.10.233.147]) by smtp.gmail.com with ESMTPSA id w136-20020a81498e000000b0056974f4019esm319055ywa.6.2023.07.20.09.56.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Jul 2023 09:56:59 -0700 (PDT) Date: Thu, 20 Jul 2023 09:56:51 -0700 (PDT) From: Hugh Dickins X-X-Sender: hugh@ripple.attlocal.net To: Oleksandr Tymoshenko cc: Jonathan Corbet , Hugh Dickins , Andrew Morton , Christian Brauner , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH] shmem: add support for user extended attributes In-Reply-To: <20230720065430.2178136-1-ovt@google.com> Message-ID: <9b8d38f0-fd22-3f98-d070-16baf976ecb5@google.com> References: <20230720065430.2178136-1-ovt@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Stat-Signature: dweaenic1h1d45ffjmeamrz76r31hi5j X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 441E340013 X-Rspam-User: X-HE-Tag: 1689872220-428914 X-HE-Meta: U2FsdGVkX19yqd6XiFtg72JumcOdNe/uYKgXqLIuvcPwUEzp8MKfEHRznb+CX24pL53tgf1eyrxcDzffXINS2EPJWioqmlsG5brGiL1OZdJEVYh97mleP2FZhQ7ut9ER3H5FToxc2LBF7XqGYB5y/VeIFvnrCuo8BPc1eHBquMzJpGbPu0lPVBn7ZXoEBmWH897w1b7PI82lVhvmTTbEYxZiCJQLUCO+H3jZvqAkzh15cSFeEMc8KSnVZAFfSVEhjeZD0tAh/iW9b0uoKqtlbpFjKWB6ySwRtV/JdiuNgHsKWKSkEKFncEKUPlXCibYaSMPIHl0q90Sv+xwhvhT90AxplQYB2n+w6CCgQNK6Xma3afm7/s7LpNMROUXeLGCnM9NVNG+lMqzyCc4p19fc0Wwo8EAzG6nJQrkcMcsUl9tB4/Id37kC/z5BcogpqRuz+xMzTvUquOt/URRZh5D1QgPBwIjKmb51qOrUAym4aMWO1InmDGWdh9Dc5zO+NVxAJQLk5k/TSRMbYSsjOU3a5TwQ7+zHTZTI7GISMOPG+P2OOj4I/QJL8kcLOqqHW3KWyYL1vTFgU9qVQdB5sysM+UIDl8irQteYgKWkHRCh3jzuBxan8QVD75EwGhP+ylK2y/YS1izO8LXopoH00TZpcNI0CpqSDlSOgsbuGms64Wg6bGuzXBrd+crkAww6ySDyt1o7p6fVsnzGEcbUPsBQNaQzmSXjmO06y1Hdco0CVii8TC0K0pAzHlgZR5ITqY163FUWVZlBPyytKs+hjmg8Zh4TTuvmbajxvY+EcS+jhsE5EUTrhkxkdCrFlIr14ZWUlaqxcspnaRu/kKDG7nLIQwWlI9qxf87NBfnjy5H0ALUbszr/rGoqj4om/gXJWa4nf6DmOwieAQkwUOeGBr6prl/1jpjA/lNFRA4ZRqUcGXvcHWJp2KayWhdcv47haXO6769HQS4xtdmHeuDFrsc T4BiGu24 OdXxU85P7M79rhOD0aDngTHZdaOAopHb0LoLHGDzUu/v903eUgGmsUQ/yja41iuZgj/758ccj1ri284jkuDSEFubF/XuDWt1WnVfqMMAvshREWzI6Xjin9VQOpyRQ/DMze/jnGVAUb/yWurpJZE2HK7xJ98GkXn9iT6vZmdVD67uljZDznPfmaGmEgkI4ogrG+d19YHKnueRc+EVZhIlhwA5AfiSNQvrKbiJwW+wss3S+hAdxJHulGYW6E/hsMq109aIxROkXPWEQCmZZbewYSUHsNII8t1o8iQ1szkDRsfa2ikG7Tz8Pt/LIO9S348yu8FowUef5ztLB4l1GDGdnSh96ezeNk9OrWIRM1G90MHqZ0/jBZ5JHZ+8FzxZg7i32zjWAUD4D6//808OjoG5dDThOqA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, 20 Jul 2023, Oleksandr Tymoshenko wrote: > User extended attributes are not enabled in tmpfs because > the size of the value is not limited and the memory allocated > for it is not counted against any limit. Malicious > non-privileged user can exhaust kernel memory by creating > user.* extended attribute with very large value. > > There are still situations when enabling suport for extended > user attributes on tmpfs is required and the attack vector > is not applicable, for instance batch jobs with trusted binaries. > > This patch introduces two mount options to enable/disable > support for user.* extended attributes on tmpfs: > > user_xattr enable support for user extended aatributes > nouser_xattr disable support for user extended attributes > > The default behavior of the filesystem is not changed. > > Signed-off-by: Oleksandr Tymoshenko Thanks, but no. This is not something we want mount options for: we just want to limit the memory usage of tmpfs user xattrs. I've had the patch to do that limiting (taking it out of the inode space already limited by nr_inodes) in my test tree for 2.5 years now: waiting to reach the top of the heap to pull together and submit. Your sending this patch does help to raise the priority for my sending that patch: thank you; but I cannot promise when that will be. (And the way mm/shmem.c is conflicted between vfs and mm trees is rather discouraging development there at the moment: I'm hoping it can be mostly wrested back into the mm tree in the next cycle.) Hugh > --- > Documentation/filesystems/tmpfs.rst | 12 ++++++++ > include/linux/shmem_fs.h | 1 + > mm/shmem.c | 45 +++++++++++++++++++++++++++++ > 3 files changed, 58 insertions(+) > > diff --git a/Documentation/filesystems/tmpfs.rst b/Documentation/filesystems/tmpfs.rst > index f18f46be5c0c..5700ba72d095 100644 > --- a/Documentation/filesystems/tmpfs.rst > +++ b/Documentation/filesystems/tmpfs.rst > @@ -215,6 +215,16 @@ will give you tmpfs instance on /mytmpfs which can allocate 10GB > RAM/SWAP in 10240 inodes and it is only accessible by root. > > > +tmpfs, when compiled with CONFIG_TMPFS_XATTR, does not support > +Extended User Attributes for security reasons. The support can be > +enabled/disabled by two mount options: > + > +============ =========================================== > +user_xattr Enable support for Extended User Attributes > +nouser_xattr Disable upport for Extended User Attributes > +============ =========================================== > + > + > :Author: > Christoph Rohland , 1.12.01 > :Updated: > @@ -223,3 +233,5 @@ RAM/SWAP in 10240 inodes and it is only accessible by root. > KOSAKI Motohiro, 16 Mar 2010 > :Updated: > Chris Down, 13 July 2020 > +:Updated: > + Oleksandr Tymoshenko, 19 July 2023 > diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h > index 9029abd29b1c..f06d18b9041c 100644 > --- a/include/linux/shmem_fs.h > +++ b/include/linux/shmem_fs.h > @@ -53,6 +53,7 @@ struct shmem_sb_info { > spinlock_t shrinklist_lock; /* Protects shrinklist */ > struct list_head shrinklist; /* List of shinkable inodes */ > unsigned long shrinklist_len; /* Length of shrinklist */ > + bool user_xattr; /* user.* xattrs are allowed */ > }; > > static inline struct shmem_inode_info *SHMEM_I(struct inode *inode) > diff --git a/mm/shmem.c b/mm/shmem.c > index 2f2e0e618072..4f7d46d65494 100644 > --- a/mm/shmem.c > +++ b/mm/shmem.c > @@ -85,6 +85,7 @@ static struct vfsmount *shm_mnt; > > #define BLOCKS_PER_PAGE (PAGE_SIZE/512) > #define VM_ACCT(size) (PAGE_ALIGN(size) >> PAGE_SHIFT) > +#define TMPFS_USER_XATTR_INDEX 1 > > /* Pretend that each entry is of this size in directory's i_size */ > #define BOGO_DIRENT_SIZE 20 > @@ -116,11 +117,13 @@ struct shmem_options { > int huge; > int seen; > bool noswap; > + bool user_xattr; > #define SHMEM_SEEN_BLOCKS 1 > #define SHMEM_SEEN_INODES 2 > #define SHMEM_SEEN_HUGE 4 > #define SHMEM_SEEN_INUMS 8 > #define SHMEM_SEEN_NOSWAP 16 > +#define SHMEM_SEEN_USER_XATTR 32 > }; > > #ifdef CONFIG_TMPFS > @@ -3447,6 +3450,16 @@ static int shmem_xattr_handler_get(const struct xattr_handler *handler, > const char *name, void *buffer, size_t size) > { > struct shmem_inode_info *info = SHMEM_I(inode); > + struct shmem_sb_info *sbinfo = SHMEM_SB(inode->i_sb); > + > + switch (handler->flags) { > + case TMPFS_USER_XATTR_INDEX: > + if (!sbinfo->user_xattr) > + return -EOPNOTSUPP; > + break; > + default: > + break; > + } > > name = xattr_full_name(handler, name); > return simple_xattr_get(&info->xattrs, name, buffer, size); > @@ -3459,8 +3472,18 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler, > size_t size, int flags) > { > struct shmem_inode_info *info = SHMEM_I(inode); > + struct shmem_sb_info *sbinfo = SHMEM_SB(inode->i_sb); > int err; > > + switch (handler->flags) { > + case TMPFS_USER_XATTR_INDEX: > + if (!sbinfo->user_xattr) > + return -EOPNOTSUPP; > + break; > + default: > + break; > + } > + > name = xattr_full_name(handler, name); > err = simple_xattr_set(&info->xattrs, name, value, size, flags, NULL); > if (!err) { > @@ -3482,9 +3505,17 @@ static const struct xattr_handler shmem_trusted_xattr_handler = { > .set = shmem_xattr_handler_set, > }; > > +static const struct xattr_handler shmem_user_xattr_handler = { > + .prefix = XATTR_USER_PREFIX, > + .flags = TMPFS_USER_XATTR_INDEX, > + .get = shmem_xattr_handler_get, > + .set = shmem_xattr_handler_set, > +}; > + > static const struct xattr_handler *shmem_xattr_handlers[] = { > &shmem_security_xattr_handler, > &shmem_trusted_xattr_handler, > + &shmem_user_xattr_handler, > NULL > }; > > @@ -3604,6 +3635,8 @@ enum shmem_param { > Opt_inode32, > Opt_inode64, > Opt_noswap, > + Opt_user_xattr, > + Opt_nouser_xattr, > }; > > static const struct constant_table shmem_param_enums_huge[] = { > @@ -3626,6 +3659,8 @@ const struct fs_parameter_spec shmem_fs_parameters[] = { > fsparam_flag ("inode32", Opt_inode32), > fsparam_flag ("inode64", Opt_inode64), > fsparam_flag ("noswap", Opt_noswap), > + fsparam_flag ("user_xattr", Opt_user_xattr), > + fsparam_flag ("nouser_xattr", Opt_nouser_xattr), > {} > }; > > @@ -3717,6 +3752,14 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) > ctx->noswap = true; > ctx->seen |= SHMEM_SEEN_NOSWAP; > break; > + case Opt_user_xattr: > + ctx->user_xattr = true; > + ctx->seen |= SHMEM_SEEN_USER_XATTR; > + break; > + case Opt_nouser_xattr: > + ctx->user_xattr = false; > + ctx->seen |= SHMEM_SEEN_USER_XATTR; > + break; > } > return 0; > > @@ -3834,6 +3877,8 @@ static int shmem_reconfigure(struct fs_context *fc) > sbinfo->max_inodes = ctx->inodes; > sbinfo->free_inodes = ctx->inodes - inodes; > } > + if (ctx->seen & SHMEM_SEEN_USER_XATTR) > + sbinfo->user_xattr = ctx->user_xattr; > > /* > * Preserve previous mempolicy unless mpol remount option was specified. > -- > 2.41.0.255.g8b1d071c50-goog > >