From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09839C433EF for ; Fri, 27 May 2022 20:05:40 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6CCDA8D0005; Fri, 27 May 2022 16:05:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 67B5B8D0001; Fri, 27 May 2022 16:05:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 51AA78D0005; Fri, 27 May 2022 16:05:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 400118D0001 for ; Fri, 27 May 2022 16:05:40 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id DA1AF21729 for ; Fri, 27 May 2022 20:05:39 +0000 (UTC) X-FDA: 79512603198.07.8CC7738 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by imf05.hostedemail.com (Postfix) with ESMTP id 739BA100057 for ; Fri, 27 May 2022 20:05:08 +0000 (UTC) Received: by mail-wm1-f41.google.com with SMTP id z17so3241481wmf.1 for ; Fri, 27 May 2022 13:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20210112.gappssmtp.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3hDs5pMehEzS9JtBcciO3du/140ZEedg4Xg+u6dsQZw=; b=oihAaWbcG7Yr9p0y5ULTKT7tU46NohvPTW+4VGetJ03GHSZRqq4LU+CPKg0Z2PrH5R b7AoPxPSIySEEsBuGcjzbeg273gPzUDiuDgPQe8t+O97X7MaFFmZxPWkqR1LY9W4beoO n00RsO520VB1zU12ITOAw5pKWroS+wVFZbCpC2euQgZwg2TwOVdcJe/hm29p06XZbpk9 Sux3vMrXw4iwBHlCbOLNQjWoRtlyXEU5R6srtHjt5qRoh4UhA0D6F4jCnsUI6KqRNPOo yBXjUTB2xOyeoHGBTQdQEu/248CfGEyYoUye03xA0p2HIRWz4ulUElW6T5at8G4x+QOH iljg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3hDs5pMehEzS9JtBcciO3du/140ZEedg4Xg+u6dsQZw=; b=B7o91xtGHJAYeeVP1Qqxy/eMbvmX4mxChXemO5Z6oMwkiYoGH7iGOZTNiu6k0dgHjs isRCnoZ3rNpk8b7a8rm0rgAy20IK8qlx2657p1AdQDaJiMf2E4mIC/f2b688z0eivt8d uz6ALigIR85W8byU04z2OtaA5JC7G79yJhUFJYHz3BVtUFpQAUoQ7CHigH59I9fwO5nL KJ+yKqmZnhyTVQLBvIqsAbvKUw9CnXmqpZehs7d3LMo+GrWFK4e/jAcJfCM1KkOVhVTP klOfOpK+rmtoLqg3pxH1ChQrXMze0xFfkzPPvSGzIVF7peNWjwFEWawbYRuTmRZJj2pM wFxA== X-Gm-Message-State: AOAM530ne6B7EAGGHurR5iMWQkpo0QguDpVjY4xlVcK1ASzNHCjT6zyc oNq/M5Vjcs95QMlKYBKswcVKo3gDJZLgW+Smqabt X-Google-Smtp-Source: ABdhPJzSQiwbwdo8FqZ111McYTLFv4bwIxxTTbHCjxtpHRnG+P00gPgVzRWa/5Bdb55lusFwlbu3a5oOnOFQ3+tgAU8= X-Received: by 2002:a05:600c:3b05:b0:397:54ce:896 with SMTP id m5-20020a05600c3b0500b0039754ce0896mr8458182wms.3.1653681937794; Fri, 27 May 2022 13:05:37 -0700 (PDT) MIME-Version: 1.0 References: <20220525183703.466936-1-fred@cloudflare.com> In-Reply-To: <20220525183703.466936-1-fred@cloudflare.com> From: Paul Moore Date: Fri, 27 May 2022 16:05:26 -0400 Message-ID: Subject: Re: [PATCH v2] cred: Propagate security_prepare_creds() error code To: Frederick Lawler Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-aio@kvack.org, linux-fsdevel@vger.kernel.org, linux-cachefs@redhat.com, linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-mm@kvack.org, linux-nfs@vger.kernel.org, linux-unionfs@vger.kernel.org, linux-security-module@vger.kernel.org, netdev@vger.kernel.org, keyrings@vger.kernel.org, selinux@vger.kernel.org, serge@hallyn.com, amir73il@gmail.com, kernel-team@cloudflare.com Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: eyqgehk4kk7kworzq8arjd8ixwno7q3g Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=paul-moore-com.20210112.gappssmtp.com header.s=20210112 header.b=oihAaWbc; dmarc=none; spf=none (imf05.hostedemail.com: domain of paul@paul-moore.com has no SPF policy when checking 209.85.128.41) smtp.mailfrom=paul@paul-moore.com X-Rspam-User: X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 739BA100057 X-HE-Tag: 1653681908-776534 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000001, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 25, 2022 at 2:37 PM Frederick Lawler wrote: > > While experimenting with the security_prepare_creds() LSM hook, we > noticed that our EPERM error code was not propagated up the callstack. > Instead ENOMEM is always returned. As a result, some tools may send a > confusing error message to the user: > > $ unshare -rU > unshare: unshare failed: Cannot allocate memory > > A user would think that the system didn't have enough memory, when > instead the action was denied. > > This problem occurs because prepare_creds() and prepare_kernel_cred() > return NULL when security_prepare_creds() returns an error code. Later, > functions calling prepare_creds() and prepare_kernel_cred() return > ENOMEM because they assume that a NULL meant there was no memory > allocated. > > Fix this by propagating an error code from security_prepare_creds() up > the callstack. > > Signed-off-by: Frederick Lawler > > --- > Changes since v1: > - Revert style churn in ovl_create_or_link() noted by Amir > - Revert style churn in prepare_nsset() noted by Serge > - Update documentation for prepare_creds() > - Set ofs->creator_cred in ovl_fill_super() and req->creds in aio_fsync() > to NULL on error noted by Amir > --- > Documentation/security/credentials.rst | 6 +++--- > fs/aio.c | 9 +++++++-- > fs/cachefiles/security.c | 8 ++++---- > fs/cifs/cifs_spnego.c | 4 ++-- > fs/cifs/cifsacl.c | 4 ++-- > fs/coredump.c | 2 +- > fs/exec.c | 14 ++++++++----- > fs/ksmbd/smb_common.c | 4 ++-- > fs/nfs/flexfilelayout/flexfilelayout.c | 7 +++++-- > fs/nfs/nfs4idmap.c | 4 ++-- > fs/nfsd/auth.c | 4 ++-- > fs/nfsd/nfs4callback.c | 10 ++++----- > fs/nfsd/nfs4recover.c | 4 ++-- > fs/nfsd/nfsfh.c | 4 ++-- > fs/open.c | 8 ++++---- > fs/overlayfs/dir.c | 6 ++++-- > fs/overlayfs/super.c | 6 ++++-- > kernel/capability.c | 4 ++-- > kernel/cred.c | 28 +++++++++++++++----------- > kernel/groups.c | 4 ++-- > kernel/nsproxy.c | 9 ++++++++- > kernel/sys.c | 28 +++++++++++++------------- > kernel/trace/trace_events_user.c | 4 ++-- > kernel/umh.c | 5 +++-- > kernel/user_namespace.c | 6 ++++-- > net/dns_resolver/dns_key.c | 4 ++-- > security/apparmor/task.c | 12 +++++------ > security/commoncap.c | 20 +++++++++--------- > security/keys/keyctl.c | 8 ++++---- > security/keys/process_keys.c | 16 +++++++-------- > security/landlock/syscalls.c | 4 ++-- > security/selinux/hooks.c | 8 ++++---- > security/smack/smack_lsm.c | 8 ++++---- > security/smack/smackfs.c | 4 ++-- > 34 files changed, 153 insertions(+), 123 deletions(-) The SELinux bits look fine to me. Acked-by: Paul Moore (SELinux) -- paul-moore.com