vfs: fix mounting a filesystem with i_version

PATCH In review Mimi Zohar 3 participants 5 messages Oct 8, 2017 – Oct 11, 2017

Subsystems (3)

VFS Security (LSM) Keys-trusted

lore

Share & tools

lore

Mimi Zohar

author

2017-10-08 04:28 UTC #0 lore raw

PATCH 1/1 vfs: fix mounting a filesystem with i_version

The mount i_version flag is not enabled in the new sb_flags. This patch adds the missing SB_I_VERSION flag.

Fixes e462ec5 "VFS: Differentiate mount flags (MS_*) from internal

superblock flags"

Signed-off-by Mimi Zohar <[email protected]>

---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

fs/namespace.c +2 -1

index 3b601f115b6c..d18deb4c410b 100644
@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);
 
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&path, flags, sb_flags, mnt_flags,

Signature · 6 lines

2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Christoph Hellwig

2017-10-08 08:58 UTC #1 lore raw

Quoted 15 lines · Mimi Zohar

The mount i_version flag is not enabled in the new sb_flags. This patch adds the missing SB_I_VERSION flag.
Fixes e462ec5 "VFS: Differentiate mount flags (MS_*) from internal
superblock flags"
Signed-off-by Mimi Zohar <[email protected]>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +0 -0
index 3b601f115b6c..d18deb4c410b 100644

fs/namespace.c long do_mount(const char *dev_name, const char __user *dir_name, · line 2829

Quoted 6 lines

fs/namespace.c +2 -1

@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);

The problem is that the whole masking there is a piece of crap.

It assumes that MS_* and SB_* flags have the same numeric values, which is bound to create a major problem rather sooner than later.

What we need is a separate __bitwise type for SB_*, translated them here and treat them as a separate namespaces.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Mimi Zohar

author

2017-10-08 12:54 UTC #2 lore raw

Quoted 25 lines · Christoph Hellwig

Quoted 15 lines · Mimi Zohar
The mount i_version flag is not enabled in the new sb_flags. This patch adds the missing SB_I_VERSION flag.
Fixes e462ec5 "VFS: Differentiate mount flags (MS_*) from internal
superblock flags"
Signed-off-by Mimi Zohar <[email protected]>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +0 -0
index 3b601f115b6c..d18deb4c410b 100644
fs/namespace.c long do_mount(const char *dev_name, const char __user *dir_name, · line 2829
Quoted 6 lines
fs/namespace.c +2 -1
@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);
The problem is that the whole masking there is a piece of crap.

Quoted 2 lines

It assumes that MS_* and SB_* flags have the same numeric values, which is bound to create a major problem rather sooner than later.

According to the original commit, separating them is just the first step. ?This patch fixes that first step so that filesystems can be mounted with i_version.

Mimi

Quoted 3 lines

What we need is a separate __bitwise type for SB_*, translated them here and treat them as a separate namespaces.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

James Morris

maintainer

2017-10-08 22:24 UTC #3 lore raw

In reply to Mimi Zohar

cc Al Viro.

Quoted 25 lines · Mimi Zohar

The mount i_version flag is not enabled in the new sb_flags. This patch adds the missing SB_I_VERSION flag.
Fixes e462ec5 "VFS: Differentiate mount flags (MS_*) from internal
superblock flags"
Signed-off-by Mimi Zohar <[email protected]>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +2 -1
index 3b601f115b6c..d18deb4c410b 100644
@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);
 
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&path, flags, sb_flags, mnt_flags,

Signature · 7 lines

James Morris
<[email protected]>

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar

author

2017-10-11 12:28 UTC #4 lore raw

Hi Al,

This patch fixes a regression.??Without it, you can't mount a file system with i_version.??This obviously affects IMA.??Could you pick up this patch and forward it to Linus please?

Commit dd924ea17c0c "vfs: fix mounting a filesystem with i_version" can be found in my git repo.

thanks,

Mimi

Quoted 27 lines · James Morris

cc Al Viro.
Quoted 22 lines · Mimi Zohar
The mount i_version flag is not enabled in the new sb_flags. This patch adds the missing SB_I_VERSION flag.
Fixes e462ec5 "VFS: Differentiate mount flags (MS_*) from internal
superblock flags"
Signed-off-by Mimi Zohar <[email protected]>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +2 -1
index 3b601f115b6c..d18deb4c410b 100644
@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);
 

Quoted 4 lines

fs/namespace.c long do_mount(const char *dev_name, const char __user *dir_name, · line 2832
Quoted 3 lines
fs/namespace.c +0 -0
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&path, flags, sb_flags, mnt_flags,