From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84BDAC433ED for ; Wed, 21 Apr 2021 20:38:35 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E8FAE61403 for ; Wed, 21 Apr 2021 20:38:34 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E8FAE61403 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=paul-moore.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0C7816B0036; Wed, 21 Apr 2021 16:38:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 079276B006E; Wed, 21 Apr 2021 16:38:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E5BA26B0070; Wed, 21 Apr 2021 16:38:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0225.hostedemail.com [216.40.44.225]) by kanga.kvack.org (Postfix) with ESMTP id C206E6B0036 for ; Wed, 21 Apr 2021 16:38:33 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 80F371802BE14 for ; Wed, 21 Apr 2021 20:38:33 +0000 (UTC) X-FDA: 78057537306.17.6A94D0C Received: from mail-ej1-f43.google.com (mail-ej1-f43.google.com [209.85.218.43]) by imf23.hostedemail.com (Postfix) with ESMTP id 23F22A000390 for ; Wed, 21 Apr 2021 20:38:30 +0000 (UTC) Received: by mail-ej1-f43.google.com with SMTP id l4so65379497ejc.10 for ; Wed, 21 Apr 2021 13:38:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=md3o4p7n3hM5uE+5WCGNtClm3RdZoyFagq0E7NLsAic=; b=jluoif0LUeWyHw6yXRzDm293OaeL1Gvzfs7lwWkF0kZ9iIB1xqqXcZBZzzI/nHk04R RJ5g0rXOaZVzvBmrxkjLX1UL2uAcE44TgBlZMGHdPQ6nibpmb/ZZgNzdIwqQWeaE4jwe X7GwFGRmJn4teKMZEas+gWWYQ6GPcmOqBAE1TKE0ELsYa+UL1L3STWfI7955RsmXxtZX iN3VPpRYPPbQVHaaquw/NaB2MZk+e1rO98iDD8P0RBMTASUUMSwY0li2YrNwYWvfizuR kW4otWYEy08FXf46qc1KQr9JcddGNgHgqd88tjlw3lYZDryYu2WR5b576MwjjpTbBKrI +Arw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=md3o4p7n3hM5uE+5WCGNtClm3RdZoyFagq0E7NLsAic=; b=H9xjamSDlc6J7syg52iWQyVZkHrep8ZLpxYoSCOWV3zGijezD80/mLwpymfpARIurL O3LEMjzPWI0mMIILzdBnsjmkuPdw76T1zV+OzS33xAg9MXKiRPHMmXYlMmWp4z2hKkez 3P6J/PCzu6d1Oo9GJ9ws4h4VOXvzdAlyGh2EhoQt/+QxbUo2g3F6sB3+oE6VP1WeC2Bf Uh+RXs0hpwvfLylz6LWtd50bb2R2m6qBkl+gBucWqUrppIGEj5IvSgT8GHgILiszVRnU joSIPjnvfTapeVbCXy+ncZepwvQ9AKLlMEJX5X6Kg3focUTgLw793vxsXlvioRAOG+S1 cOLw== X-Gm-Message-State: AOAM531EpsAOWt/zNIawEwkpCPTRLzWV0aGdswFEew2mftPQDFLa9QOd LaxwYJ9C0fNzpYu+wjHPgy3hvK+kuWXLYXbWE2Fv X-Google-Smtp-Source: ABdhPJyFe9bNzV6/bc99zAfaqrVO1DebH0rgqEH8+mOVAiJ8K6bc6MFkmZrpd827WzqVo1ofdZuRb3cNGC3u1dwSFpY= X-Received: by 2002:a17:906:f1cb:: with SMTP id gx11mr35468706ejb.106.1619037511266; Wed, 21 Apr 2021 13:38:31 -0700 (PDT) MIME-Version: 1.0 References: <20210421171446.785507-1-omosnace@redhat.com> In-Reply-To: <20210421171446.785507-1-omosnace@redhat.com> From: Paul Moore Date: Wed, 21 Apr 2021 16:38:20 -0400 Message-ID: Subject: Re: [RFC PATCH 0/2] selinux,anon_inodes: Use a separate SELinux class for each type of anon inode To: Ondrej Mosnacek Cc: selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Lokesh Gidra , Stephen Smalley Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 23F22A000390 X-Stat-Signature: ygkqu6r4d5p15dksk6xcakzuxboh3iwy X-Rspamd-Server: rspam02 Received-SPF: none (paul-moore.com>: No applicable sender policy available) receiver=imf23; identity=mailfrom; envelope-from=""; helo=mail-ej1-f43.google.com; client-ip=209.85.218.43 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1619037510-554956 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000009, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Apr 21, 2021 at 1:14 PM Ondrej Mosnacek wrote: > > This series aims to correct a design flaw in the original anon_inode > SELinux support that would make it hard to write policies for anonymous > inodes once more types of them are supported (currently only userfaultfd > inodes are). A more detailed rationale is provided in the second patch. > > The first patch extends the anon_inode_getfd_secure() function to accept > an additional numeric identifier that represents the type of the > anonymous inode being created, which is passed to the LSMs via > security_inode_init_security_anon(). > > The second patch then introduces a new SELinux policy capability that > allow policies to opt-in to have a separate class used for each type of > anon inode. That means that the "old way" will still ... will what? :) I think it would be a very good idea if you could provide some concrete examples of actual policy problems encountered using the current approach. I haven't looked at these patches very seriously yet, but my initial reaction is not "oh yes, we definitely need this". > I wish I had realized the practical consequences earlier, while the > patches were still under review, but it only started to sink in after > the authors themselves later raised the issue in an off-list > conversation. Even then, I still hoped it wouldn't be that bad, but the > more I thought about how to apply this in an actual policy, the more I > realized how much pain it would be to work with the current design, so > I decided to propose these changes. > > I hope this will be an acceptable solution. > > A selinux-testsuite patch that adapts the userfaultfd test to work also > with the new policy capability enabled will follow. > > Ondrej Mosnacek (2): > LSM,anon_inodes: explicitly distinguish anon inode types > selinux: add capability to map anon inode types to separate classes > > fs/anon_inodes.c | 42 +++++++++++++--------- > fs/userfaultfd.c | 6 ++-- > include/linux/anon_inodes.h | 4 ++- > include/linux/lsm_hook_defs.h | 3 +- > include/linux/security.h | 19 ++++++++++ > security/security.c | 3 +- > security/selinux/hooks.c | 28 ++++++++++++++- > security/selinux/include/classmap.h | 2 ++ > security/selinux/include/policycap.h | 1 + > security/selinux/include/policycap_names.h | 3 +- > security/selinux/include/security.h | 7 ++++ > 11 files changed, 95 insertions(+), 23 deletions(-) > > -- > 2.30.2 -- paul moore www.paul-moore.com