tracefs/eventfs: Fix inconsistent permissions
Subsystems (2)
Steven Rostedt
maintainerv2 cover tracefs/eventfs: Fix inconsistent permissions
The tracefs and eventfs permissions are created dynamically based on what the mount point inode has or the instances directory inode has. But the way it worked had some inconsistencies that could lead to security issues as the file system is not behaving like admins would expect.
The files and directories could ignore the remount option that changes the gid or uid ownerships, leaving files susceptable to access that is not expected. This happens if a file had its value changed previously and then a remount changed all the files permissions. The one that was changed previously would not be affected.
This change set resolves these inconsistencies.
This also fixes the test_ownership.tc test as it would pass on the first time it is run, but fail on the second time, because of the inconsistant state of the permissions. Now you can run that test multiple times and it will always pass.
Changes since v1: https://lore.kernel.org/linux-trace-kernel/[email protected]/
- Testing showed that taking a mutex when freeing the tracefs_inode caused a lockdep splat as it can happen in the RCU softirq context. Convert the mutex to a spinlock for adding and removing the node from the link list, and free the node via call_rcu() so that the iteration of the list only needs to be protected by rcu_read_lock().
Steven Rostedt (Google) (5):
tracefs: Reset permissions on remount if permissions are options
tracefs: Still use mount point as default permissions for instances
eventfs: Do not differentiate the toplevel events directory
eventfs: Do not treat events directory different than other directories
eventfs: Have "events" directory get permissions from its parent
----
fs/tracefs/event_inode.c | 102 ++++++++++++++++++++++++++++------------------- fs/tracefs/inode.c | 77 +++++++++++++++++++++++++++++++++-- fs/tracefs/internal.h | 14 ++++--- 3 files changed, 144 insertions(+), 49 deletions(-)
Steven Rostedt
maintainerPATCH v2 1/5 tracefs: Reset permissions on remount if permissions are options
From: "Steven Rostedt (Google)" <[email protected]>
There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's permission if they were never set by the user. If the user sets the permissions, then a flag is set and the permissions are saved via the inode (for tracefs files) or an internal attribute field (for eventfs).
But if a remount happens that specify the permissions, all the files that were not changed by the user gets updated, but the ones that were are not. If the user were to remount the file system with a given permission, then all files and directories within that file system should be updated.
This can cause security issues if a file's permission was updated but the admin forgot about it. They could incorrectly think that remounting with permissions set would update all files, but miss some.
For example:
# cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root root 0 May 1 21:25 dynamic_events -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root root 0 May 1 21:25 enabled_functions
Where current_tracer now has group "lkp".
# mount -o remount,gid=1001 . # ls -l -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions
Everything changed but the "current_tracer".
Add a new link list that keeps track of all the tracefs_inodes which has the permission flags that tell if the file/dir should use the root inode's permission or not. Then on remount, clear all the flags so that the default behavior of using the root inode's permission is done for all files and directories.
--- fs/tracefs/event_inode.c | 29 +++++++++++++++++++++++ fs/tracefs/inode.c | 50 +++++++++++++++++++++++++++++++++++++++- fs/tracefs/internal.h | 7 +++++- 3 files changed, 84 insertions(+), 2 deletions(-)
fs/tracefs/event_inode.c +29 -0
@@ -301,6 +301,35 @@ static const struct file_operations eventfs_file_operations = { .llseek = generic_file_llseek, }; +/* +* On a remount of tracefs, if UID or GID options are set, then +* the mount point inode permissions should be used. +* Reset the saved permission flags appropriately. +*/ +void eventfs_remount (struct tracefs_inode *ti,bool update_uid,bool update_gid) +{ +struct eventfs_inode *ei = ti->private; + +if (!ei) +return ; + +if (update_uid) + ei->attr.mode &= ~EVENTFS_SAVE_UID ; + +if (update_gid) + ei->attr.mode &= ~EVENTFS_SAVE_GID ; + +if (!ei->entry_attrs) +return ; + +for (int i =0 ; i < ei->nr_entries; i++) { +if (update_uid) + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID ; +if (update_gid) + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID ; + } +} +/* Return the evenfs_inode of the "events" directory */ static struct eventfs_inode *eventfs_find_events (struct dentry *dentry) {
fs/tracefs/inode.c +49 -1
81 lines not on this page · raw message
fs/tracefs/internal.h +6 -1
@@ -11,8 +11,12 @@ enum { };struct tracefs_inode { -struct inode vfs_inode; +union { +struct inode vfs_inode; +struct rcu_head rcu; + };/* The below gets initialized with memset_after(ti, 0, vfs_inode) */ +struct list_head list;unsigned long flags;void *private; };
@@ -73,6 +77,7 @@ struct dentry *tracefs_end_creating(struct dentry *dentry);struct dentry *tracefs_failed_creating (struct dentry *dentry);struct inode *tracefs_get_inode (struct super_block *sb); +void eventfs_remount (struct tracefs_inode *ti,bool update_uid,bool update_gid);void eventfs_d_release (struct dentry *dentry);#endif /* _TRACEFS_INTERNAL_H */
Signature · 1 line
2.43.0
Steven Rostedt
maintainerRe: [PATCH v2 1/5] tracefs: Reset permissions on remount if permissions are options
fs/tracefs/event_inode.c static const struct file_operations eventfs_file_operations = { · line 311
Quoted 8 lines · On Thu, 02 May 2024 11:15:48 -0400 Steven Rostedt <[email protected]> wrote:
fs/tracefs/event_inode.c +8
-0+/* +* On a remount of tracefs, if UID or GID options are set, then +* the mount point inode permissions should be used. +* Reset the saved permission flags appropriately. +*/ +void eventfs_remount (struct tracefs_inode *ti,bool update_uid,bool update_gid) +{ +struct eventfs_inode *ei = ti->private;
And I just realized there's a race here too :-p
I need to set ti->private = NULL before freeing the ei, and probably free the ei via RCU.
-- Steve
Quoted 21 lines
fs/tracefs/event_inode.c +21
-0+ +if (!ei) +return ; + +if (update_uid) + ei->attr.mode &= ~EVENTFS_SAVE_UID ; + +if (update_gid) + ei->attr.mode &= ~EVENTFS_SAVE_GID ; + +if (!ei->entry_attrs) +return ; + +for (int i =0 ; i < ei->nr_entries; i++) { +if (update_uid) + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID ; +if (update_gid) + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID ; + } +} +
Steven Rostedt
maintainerPATCH v2 2/5 tracefs: Still use mount point as default permissions for instances
In reply to Steven RostedtFrom: "Steven Rostedt (Google)" <[email protected]>
If the instances directory's permissions were never change, then have it and its children use the mount point permissions as the default.
Currently, the permissions of instance directories are determined by the instance directory's permissions itself. But if the tracefs file system is remounted and changes the permissions, the instance directory and its children should use the new permission.
But because both the instance directory and its children use the instance directory's inode for permissions, it misses the update.
To demonstrate this:
# cd /sys/kernel/tracing/ # mkdir instances/foo # ls -ld instances/foo drwxr-x--- 5 root root 0 May 1 19:07 instances/foo # ls -ld instances drwxr-x--- 3 root root 0 May 1 18:57 instances # ls -ld current_tracer -rw-r----- 1 root root 0 May 1 18:57 current_tracer
# mount -o remount,gid=1002 . # ls -ld instances drwxr-x--- 3 root root 0 May 1 18:57 instances # ls -ld instances/foo/ drwxr-x--- 5 root root 0 May 1 19:07 instances/foo/ # ls -ld current_tracer -rw-r----- 1 root lkp 0 May 1 18:57 current_tracer
Notice that changing the group id to that of "lkp" did not affect the instances directory nor its children. It should have been:
# ls -ld current_tracer -rw-r----- 1 root root 0 May 1 19:19 current_tracer # ls -ld instances/foo/ drwxr-x--- 5 root root 0 May 1 19:25 instances/foo/ # ls -ld instances drwxr-x--- 3 root root 0 May 1 19:19 instances
# mount -o remount,gid=1002 . # ls -ld current_tracer -rw-r----- 1 root lkp 0 May 1 19:19 current_tracer # ls -ld instances drwxr-x--- 3 root lkp 0 May 1 19:19 instances # ls -ld instances/foo/ drwxr-x--- 5 root lkp 0 May 1 19:25 instances/foo/
Where all files were updated by the remount gid update.
--- fs/tracefs/inode.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-)
fs/tracefs/inode.c +25 -2
@@ -180,16 +180,39 @@ static void set_tracefs_inode_owner(struct inode *inode) {struct tracefs_inode *ti =get_tracefs (inode);struct inode *root_inode = ti->private; +kuid_t uid; +kgid_t gid; + + uid = root_inode->i_uid; + gid = root_inode->i_gid; + +/* +* If the root is not the mount point, then check the root's +* permissions. If it was never set, then default to the +* mount point. +*/ +if (root_inode !=d_inode (root_inode->i_sb->s_root)) { +struct tracefs_inode *rti; + + rti =get_tracefs (root_inode); + root_inode =d_inode (root_inode->i_sb->s_root); + +if (!(rti->flags &TRACEFS_UID_PERM_SET )) + uid = root_inode->i_uid; + +if (!(rti->flags &TRACEFS_GID_PERM_SET )) + gid = root_inode->i_gid; + }/* * If this inode has never been referenced, then update * the permissions to the superblock. */ if (!(ti->flags &TRACEFS_UID_PERM_SET )) - inode->i_uid = root_inode->i_uid; + inode->i_uid = uid;if (!(ti->flags &TRACEFS_GID_PERM_SET )) - inode->i_gid = root_inode->i_gid; + inode->i_gid = gid; } static int tracefs_permission(struct mnt_idmap *idmap,
Signature · 1 line
2.43.0
Steven Rostedt
maintainerPATCH v2 3/5 eventfs: Do not differentiate the toplevel events directory
In reply to Steven RostedtFrom: "Steven Rostedt (Google)" <[email protected]>
The toplevel events directory is really no different than the events directory of instances. Having the two be different caused inconsistencies and made it harder to fix the permissions bugs.
Make all events directories act the same.
--- fs/tracefs/event_inode.c | 29 ++++++++--------------------- fs/tracefs/internal.h | 7 +++---- 2 files changed, 11 insertions(+), 25 deletions(-)
fs/tracefs/event_inode.c +8 -21
@@ -68,7 +68,6 @@ enum {EVENTFS_SAVE_MODE =BIT (16 ),EVENTFS_SAVE_UID =BIT (17 ), EVENTFS_SAVE_GID = BIT(18), - EVENTFS_TOPLEVEL = BIT(19), };#define EVENTFS_MODE_MASK (EVENTFS_SAVE_MODE - 1)
@@ -232,14 +231,10 @@ static int eventfs_set_attr(struct mnt_idmap *idmap, struct dentry *dentry,return ret; } -static void update_top_events_attr (struct eventfs_inode *ei,struct super_block *sb) +static void update_events_attr (struct eventfs_inode *ei,struct super_block *sb) {struct inode *root; -/* Only update if the "events" was on the top level */ -if (!ei || !(ei->attr.mode &EVENTFS_TOPLEVEL )) -return ; -/* Get the tracefs root inode. */ root =d_inode (sb->s_root); ei->attr.uid = root->i_uid;
@@ -252,10 +247,10 @@ static void set_top_events_ownership(struct inode *inode)struct eventfs_inode *ei = ti->private;/* The top events directory doesn't get automatically updated */ -if (!ei || !ei->is_events || !(ei->attr.mode &EVENTFS_TOPLEVEL )) +if (!ei || !ei->is_events)return ; -update_top_events_attr (ei, inode->i_sb); +update_events_attr (ei, inode->i_sb);if (!(ei->attr.mode &EVENTFS_SAVE_UID )) inode->i_uid = ei->attr.uid;
@@ -284,7 +279,7 @@ static int eventfs_permission(struct mnt_idmap *idmap,return generic_permission (idmap, inode, mask); } -static const struct inode_operations eventfs_root_dir_inode_operations = { +static const struct inode_operations eventfs_dir_inode_operations = { .lookup = eventfs_root_lookup, .setattr = eventfs_set_attr, .getattr = eventfs_get_attr,
@@ -352,7 +347,7 @@ static struct eventfs_inode *eventfs_find_events(struct dentry *dentry)// Walk upwards until you find the events inode }while (!ei->is_events); -update_top_events_attr (ei, dentry->d_sb); +update_events_attr (ei, dentry->d_sb);return ei; }
@@ -458,7 +453,7 @@ static struct dentry *lookup_dir_entry(struct dentry *dentry,update_inode_attr (dentry, inode, &ei->attr,S_IFDIR |S_IRWXU |S_IRUGO |S_IXUGO ); - inode->i_op = &eventfs_root_dir_inode_operations; + inode->i_op = &eventfs_dir_inode_operations; inode->i_fop = &eventfs_file_operations;/* All directories will have the same inode number */
@@ -838,14 +833,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry uid =d_inode (dentry->d_parent)->i_uid; gid =d_inode (dentry->d_parent)->i_gid; -/* -* If the events directory is of the top instance, then parent -* is NULL. Set the attr.mode to reflect this and its permissions will -* default to the tracefs root dentry. -*/ -if (!parent) - ei->attr.mode =EVENTFS_TOPLEVEL ; -/* This is used as the default ownership of the files and directories */ ei->attr.uid = uid; ei->attr.gid = gid;
@@ -854,13 +841,13 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentryINIT_LIST_HEAD (&ei->list); ti =get_tracefs (inode); - ti->flags |=TRACEFS_EVENT_INODE |TRACEFS_EVENT_TOP_INODE ; + ti->flags |=TRACEFS_EVENT_INODE ; ti->private = ei; inode->i_mode =S_IFDIR |S_IRWXU |S_IRUGO |S_IXUGO ; inode->i_uid = uid; inode->i_gid = gid; - inode->i_op = &eventfs_root_dir_inode_operations; + inode->i_op = &eventfs_dir_inode_operations; inode->i_fop = &eventfs_file_operations; dentry->d_fsdata =get_ei (ei);
fs/tracefs/internal.h +3 -4
@@ -4,10 +4,9 @@enum {TRACEFS_EVENT_INODE =BIT (1 ), -TRACEFS_EVENT_TOP_INODE =BIT (2 ), -TRACEFS_GID_PERM_SET =BIT (3 ), -TRACEFS_UID_PERM_SET =BIT (4 ), -TRACEFS_INSTANCE_INODE =BIT (5 ), +TRACEFS_GID_PERM_SET =BIT (2 ), +TRACEFS_UID_PERM_SET =BIT (3 ), +TRACEFS_INSTANCE_INODE =BIT (4 ), };struct tracefs_inode {
Signature · 1 line
2.43.0
Steven Rostedt
maintainerPATCH v2 4/5 eventfs: Do not treat events directory different than other directories
In reply to Steven RostedtFrom: "Steven Rostedt (Google)" <[email protected]>
Treat the events directory the same as other directories when it comes to permissions. The events directory was considered different because it's dentry is persistent, whereas the other directory dentries are created when accessed. But the way tracefs now does its ownership by using the root dentry's permissions as the default permissions, the events directory can get out of sync when a remount is performed setting the group and user permissions.
Remove the special case for the events directory on setting the attributes. This allows the updates caused by remount to work properly as well as simplifies the code.
--- fs/tracefs/event_inode.c | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-)
fs/tracefs/event_inode.c +1 -15
@@ -199,21 +199,7 @@ static int eventfs_set_attr(struct mnt_idmap *idmap, struct dentry *dentry,* determined by the parent directory. */ if (dentry->d_inode->i_mode &S_IFDIR ) { -/* -* The events directory dentry is never freed, unless its -* part of an instance that is deleted. It's attr is the -* default for its child files and directories. -* Do not update it. It's not used for its own mode or ownership. -*/ -if (ei->is_events) { -/* But it still needs to know if it was modified */ -if (iattr->ia_valid &ATTR_UID ) - ei->attr.mode |=EVENTFS_SAVE_UID ; -if (iattr->ia_valid &ATTR_GID ) - ei->attr.mode |=EVENTFS_SAVE_GID ; - }else { -update_attr (&ei->attr, iattr); - } +update_attr (&ei->attr, iattr); }else { name = dentry->d_name.name;
Signature · 1 line
2.43.0
Steven Rostedt
maintainerPATCH v2 5/5 eventfs: Have "events" directory get permissions from its parent
In reply to Steven RostedtFrom: "Steven Rostedt (Google)" <[email protected]>
The events directory gets its permissions from the root inode. But this can cause an inconsistency if the instances directory changes its permissions, as the permissions of the created directories under it should inherit the permissions of the instances directory when directories under it are created.
Currently the behavior is:
# cd /sys/kernel/tracing # chgrp 1002 instances # mkdir instances/foo # ls -l instances/foo [..] -r--r----- 1 root lkp 0 May 1 18:55 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 18:55 current_tracer -rw-r----- 1 root lkp 0 May 1 18:55 error_log drwxr-xr-x 1 root root 0 May 1 18:55 events --w------- 1 root lkp 0 May 1 18:55 free_buffer drwxr-x--- 2 root lkp 0 May 1 18:55 options drwxr-x--- 10 root lkp 0 May 1 18:55 per_cpu -rw-r----- 1 root lkp 0 May 1 18:55 set_event
All the files and directories under "foo" has the "lkp" group except the "events" directory. That's because its getting its default value from the mount point instead of its parent.
Have the "events" directory make its default value based on its parent's permissions. That now gives:
# ls -l instances/foo [..] -rw-r----- 1 root lkp 0 May 1 21:16 buffer_subbuf_size_kb -r--r----- 1 root lkp 0 May 1 21:16 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:16 current_tracer -rw-r----- 1 root lkp 0 May 1 21:16 error_log drwxr-xr-x 1 root lkp 0 May 1 21:16 events --w------- 1 root lkp 0 May 1 21:16 free_buffer drwxr-x--- 2 root lkp 0 May 1 21:16 options drwxr-x--- 10 root lkp 0 May 1 21:16 per_cpu -rw-r----- 1 root lkp 0 May 1 21:16 set_event
--- fs/tracefs/event_inode.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-)
fs/tracefs/event_inode.c +24 -6
@@ -37,6 +37,7 @@ static DEFINE_MUTEX(eventfs_mutex);struct eventfs_root_inode {struct eventfs_inode ei; +struct inode *parent_inode;struct dentry *events_dir; };
@@ -219,12 +220,23 @@ static int eventfs_set_attr(struct mnt_idmap *idmap, struct dentry *dentry,static void update_events_attr (struct eventfs_inode *ei,struct super_block *sb) { -struct inode *root; +struct eventfs_root_inode *rei; +struct inode *parent; + + rei =get_root_inode (ei); + +/* Use the parent inode permissions unless root set its permissions */ + parent = rei->parent_inode; -/* Get the tracefs root inode. */ - root =d_inode (sb->s_root); - ei->attr.uid = root->i_uid; - ei->attr.gid = root->i_gid; +if (rei->ei.attr.mode &EVENTFS_SAVE_UID ) + ei->attr.uid = rei->ei.attr.uid; +else + ei->attr.uid = parent->i_uid; + +if (rei->ei.attr.mode &EVENTFS_SAVE_GID ) + ei->attr.gid = rei->ei.attr.gid; +else + ei->attr.gid = parent->i_gid; }static void set_top_events_ownership (struct inode *inode)
@@ -810,6 +822,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry// Note: we have a ref to the dentry from tracefs_start_creating() rei =get_root_inode (ei); rei->events_dir = dentry; + rei->parent_inode =d_inode (dentry->d_sb->s_root); ei->entries = entries; ei->nr_entries = size;
@@ -819,10 +832,15 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry uid =d_inode (dentry->d_parent)->i_uid; gid =d_inode (dentry->d_parent)->i_gid; -/* This is used as the default ownership of the files and directories */ ei->attr.uid = uid; ei->attr.gid = gid; +/* +* When the "events" directory is created, it takes on the +* permissions of its parent. But can be reset on remount. +*/ + ei->attr.mode |=EVENTFS_SAVE_UID |EVENTFS_SAVE_GID ; +INIT_LIST_HEAD (&ei->children);INIT_LIST_HEAD (&ei->list);
Signature · 1 line
2.43.0