From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E56BC369C2 for ; Thu, 24 Apr 2025 14:56:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B26076B00A3; Thu, 24 Apr 2025 10:56:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id AD5396B00B7; Thu, 24 Apr 2025 10:56:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9754D6B00B8; Thu, 24 Apr 2025 10:56:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 7726B6B00A3 for ; Thu, 24 Apr 2025 10:56:11 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 8D8C3B7BE7 for ; Thu, 24 Apr 2025 14:56:11 +0000 (UTC) X-FDA: 83369237742.04.120164B Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by imf23.hostedemail.com (Postfix) with ESMTP id 8373A14000C for ; Thu, 24 Apr 2025 14:56:09 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=QBQ9cDer; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf23.hostedemail.com: domain of stephen.smalley.work@gmail.com designates 209.85.215.172 as permitted sender) smtp.mailfrom=stephen.smalley.work@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1745506569; a=rsa-sha256; cv=none; b=ioctICiSbpR/NOS2PQEiFFWfwc46cBAJjEc/ANtZ0vG0//+hqqE4/0J6piKL87wYyLP5nH uInwrWeMbixQV5NbvpkhXyiVG/RAo9T58WEW7wJ9SI5KMgfmoRPilu9EcLNOCxTZvBDA7q aF46Y0663jmYnyedn/UONb2Hye3uUUo= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=QBQ9cDer; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf23.hostedemail.com: domain of stephen.smalley.work@gmail.com designates 209.85.215.172 as permitted sender) smtp.mailfrom=stephen.smalley.work@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1745506569; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=XVQ6Vlt4NNJnu1Z1vtdE/XWsTaunsynSA+99ZYAMqk8=; b=0qdxjxWm6FDdcndNLbS8CpZrlU6csNCqhHncu5iaow6iUTPRvxtHedETtokcs6dkFiTF0o kOYd+RY6hXvezs4IOb811biglLxS0k0ZDNtqhkW43M4J8pcI3byN6WQwxgELBapcWAfePL 3ymZvgU9J+AQEQTisvi1isf9T5iTiJ8= Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-879d2e419b9so936359a12.2 for ; Thu, 24 Apr 2025 07:56:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1745506568; x=1746111368; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=XVQ6Vlt4NNJnu1Z1vtdE/XWsTaunsynSA+99ZYAMqk8=; b=QBQ9cDermm6B9SAkYXTlZ1KhGpQJBoSZx0fFqYKiwH9RgTr2SvmHOIAMYnPg3QY1mM kG1ft/TtW6LKuaJyqEfNNDuFDaGKgplTClCKC/cxNXuYxftiTk81tVUMCxr2a02qQAPI h3cX7vPSHJJGaty3gR5ZfiFqwkCrgYOIfBufWfa2tQyPIsnnBzaQXft0sLCKzn4r/KeU qn7qTA9MW6t0QJTDx5tlAXg+UqWgivxNk8JF+UeYt1tQQ4oeQ5XG2dNJzyeOUzgOgBQC Cc2D4YmSojRq0M4zs+G4th+K+WgZxVBCvY/32PcuhpDqywnPq2/Wqgz0AfYABl9yqb6b ab4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745506568; x=1746111368; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=XVQ6Vlt4NNJnu1Z1vtdE/XWsTaunsynSA+99ZYAMqk8=; b=R569CmUdVnIJ6Nn7icSYL0iQ1JYx96VEZC7bB+EG3yFKOsObx2LrIL7uHEFfbiYr9Y 8/z6yo6le6xeKE/vPjebHxM0Fxj1ZWpZzzFvKfnDdtMbLK+gUsIFshlb+8OXEDWLMtWV YFI9jQ6Ixqi7zCc15/2vKT3jUVbT09oCHCA1v1MkcNXkIrsxz5SXI3qKnRVhqBQazZvY MP0Na5+rYMldWnTEE3C4oLcgIz/oax5Dgqs7n2uwHcAwxCIKP7QGPl+7bK1kmQIAU722 CqETsMpSo4rCWJ87ZSUaryYBlcxThefWydAmH6QoUobgP8M+iO5w5+dF2P8xYE2OjKCd rmlQ== X-Forwarded-Encrypted: i=1; AJvYcCUuMvz8WVKWcXQaPz0LS9VAfltAiqrJV0f3CrhOwIC2x6O2SRaTABNxUY83HSZL40B8Ujt+O1p2dA==@kvack.org X-Gm-Message-State: AOJu0Yy2E42hEzuQX29JrpqHoLrZpdod5SReT0LvwBy8hAPjBxFQ9kza oAsuJoah6NfXjctg/HFDNxpTeEGwEGUbXGA8Hqz0TwiJa66ABhjCgMgNHIWFru+0j8EITrVO8KE lKhDqT7RdyFdRyWHoZ4wbCR/z8aQ= X-Gm-Gg: ASbGncs6ttENd8r5FYdyypJ7DtMPHVCknGLp8e1geUqyYkHzP7f9zgklHtrqzlRcikG gezd8de0h3KBaufbKd6OOwR7Oru9AUydsDKdBdib5XJEcFpPk9oKYQIFxtgM4ZTFR7I+2zmuVac SDZa1HOMmeB8839X630v4U+g== X-Google-Smtp-Source: AGHT+IEbFCGCJlB5vwHS30qkE4/L+5bhyu8cj/YTejcSzM6Yxuwz6SugUsZP/CZ0O2+4bpe4a837ytsYPYIeG9Uw/1Q= X-Received: by 2002:a17:90b:2d4f:b0:2fa:e9b:33b8 with SMTP id 98e67ed59e1d1-309ed2a3af4mr5112037a91.18.1745506568259; Thu, 24 Apr 2025 07:56:08 -0700 (PDT) MIME-Version: 1.0 References: <20250424124644.4413-1-stephen.smalley.work@gmail.com> <2025042427-hardship-captive-4d7b@gregkh> In-Reply-To: From: Stephen Smalley Date: Thu, 24 Apr 2025 10:55:56 -0400 X-Gm-Features: ATxdqUFne-6xhD2JUQrYbdPmY5HUdNSqZkJv09bxOacTWyu64a6h6ZIhT5E-DvE Message-ID: Subject: Re: [PATCH] vfs,shmem,kernfs: fix listxattr to include security.* xattrs To: Greg Kroah-Hartman Cc: paul@paul-moore.com, omosnace@redhat.com, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, Tejun Heo , Alexander Viro , Christian Brauner , Jan Kara , Hugh Dickins , Baolin Wang , Andrew Morton , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 8373A14000C X-Stat-Signature: gt1q7dubdfp7axmype88w7i6fd4jwsag X-Rspam-User: X-HE-Tag: 1745506569-140461 X-HE-Meta: U2FsdGVkX19Xub0ofmcMYBjnvEsSXIlTxFEb25GPTbQnCd/ggcgQwD7wNh19ETtY9dBUsEzOTA7xruo0iSCApBu5xHyUMfRcLf/881e36DkxU4/vXZoPNiqqnZfWJBTj/g0f4eST4KRHXrdN/RBRliUxReAbYk6qDkwtdDiKRjnZ9bODdCee7iwnOFxU9QwVAQJ/nIyAUA4v4ENxTpch1ZlbxfYzfsgAGtOQQ/X/lRIa/tUKcNG8qzBFh9GJW58biiJ39AwePjPg1zIXAAEMJTk+4TTV37fm1gyY38SYW1YhXtrMgc2v1miwf+/uraYWH+HDeoL7copdvPjQ/MWTkZWBV3ylIQ3bqKSkB6UtmnYtAKROrwpKtytxlnUW1adU9IjxPYhWWVRmCp8N1HhJXYYYg6FmR9xXmuMVYc/4eWxrxlfDYyYXvEQkI3QeKOHC7aTLtTAMhWT1yhtxJpQN19gBHMolDy0nxEtPWVqBreNbwX9RilWDtcYRxq7ocSTiEshRCDCnTYgpU6CHUv3qDQgcbTBEU6RnVKCOukvqbicJMBpYOqPtk8o1/lOKCf7opW8CoDmmo1WPKyxd7dy3DkE/yDzfeYJKTISg57WgnRMRcOFNXBz6cSJu1TKFRRG/ai51SYOuPATRE2k2JYCQF13azcbRpeGI8WC5DhFnnMOXBcysO6BAq7nwymAGzdN7C/aJ5kH2vD27DHoxCc/AHF8RrvhWqYh5yg/3xA2o+yVNh+RXDuMEdF7UtCABTcIHNrjEwOIZbOYUntNDXHFXjD3AoSUOW+FBMjTgAl7lHEfHZUY8FTG+HYbFat6h2z9YiJputMKTHX+1P+Ows6lX9c8KAeEVTjIANivDo6y7TWRAbPPUlDRoJCKPjRv1r1LBGVPCigf41bS/6aK293nZfL1ARWzp7Q2x7WTIhSy4buZHt+sl1Ubx2oz2/IbYEwDMCnT04zKpn+Iv246r5qB GVihTLPH HMfXTu0kLzcC4ExA13oBW5n1ZJstqn9RYg9cHDcPGL7fBhBVWbySXam7lSx4sJGS33zAz0kNdDXiJ5+QIWYjrmRDgXaqU+GIUckOn4kP9ysheeS1g3hldTNO14zMQbTZVD1nI5htGWdA4aT4DO9Is+OGUi+ts2e+k8jwmSAK6+kJekNLr2v716lfO//w1obrRIHPq3LMm/TxfPdfZ9WxRx5x9JQkpB7+rwgbpskHigd+Wfg0xTVg06GuAa25dw8Hk4u+DWIndcejdqPLHt0btsqezZY/cubX4364BDVsB2+I6kGXFtXW20D925udlWc+z1bBs81CoD5v/4tCsiS50fvNCuRllyNF5MwmyZtaboWBNS/X65OmkhjT6zCOHf9BKPPHQ3ALtX2SuKAcZxSGIN/C5v1l4oohbjlDkf7jLoW7Nmss= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Apr 24, 2025 at 9:53=E2=80=AFAM Stephen Smalley wrote: > > On Thu, Apr 24, 2025 at 9:12=E2=80=AFAM Greg Kroah-Hartman > wrote: > > > > On Thu, Apr 24, 2025 at 08:46:43AM -0400, Stephen Smalley wrote: > > > The vfs has long had a fallback to obtain the security.* xattrs from = the > > > LSM when the filesystem does not implement its own listxattr, but > > > shmem/tmpfs and kernfs later gained their own xattr handlers to suppo= rt > > > other xattrs. Unfortunately, as a side effect, tmpfs and kernfs-based > > > filesystems like sysfs no longer return the synthetic security.* xatt= r > > > names via listxattr unless they are explicitly set by userspace or > > > initially set upon inode creation after policy load. coreutils has > > > recently switched from unconditionally invoking getxattr for security= .* > > > for ls -Z via libselinux to only doing so if listxattr returns the xa= ttr > > > name, breaking ls -Z of such inodes. > > > > > > Before: > > > $ getfattr -m.* /run/initramfs > > > > > > $ getfattr -m.* /sys/kernel/fscaps > > > > > > > > > After: > > > $ getfattr -m.* /run/initramfs > > > security.selinux > > > $ getfattr -m.* /sys/kernel/fscaps > > > security.selinux > > > > > > Link: https://lore.kernel.org/selinux/CAFqZXNtF8wDyQajPCdGn=3DiOawX4y= 77ph0EcfcqcUUj+T87FKyA@mail.gmail.com/ > > > Link: https://lore.kernel.org/selinux/20250423175728.3185-2-stephen.s= malley.work@gmail.com/ > > > Signed-off-by: Stephen Smalley > > > > As this "changed" in the past, shouldn't it have a "Fixes:" tag? > > Yes, I'll add that on v2. Also appears that it doesn't quite correctly > handle the case where listxattr() is called with size =3D=3D 0 to probe > for the required size. And doesn't correctly handle the case where the list size exceeds the original buffer size. On second look, this can be done more simply and safely in simple_xattr_list() itself, avoiding the need to modify shmem/tmpfs and kernfs. I'll submit an updated patch.