fsverity: simplify initcall and move sysctl registration

PATCH Applied Eric Biggers 3 participants 6 messages Jul 5, 2023 – Sep 7, 2023

Subsystems (2)

Btrfs file system fs-verity: read-only file-based authenticity protection

lore

Share & tools

lore

Eric Biggers

author maintainer

2023-07-05 21:29 UTC #0 lore raw

cover fsverity: simplify initcall and move sysctl registration

This series simplifies handling of errors during the fsverity_init() initcall, and moves the sysctl registration out of signature.c so that it is not unnecessarily tied to the builtin signature feature.

Eric Biggers (2):
fsverity: simplify handling of errors during initcall
fsverity: move sysctl registration out of signature.c

 fs/verity/fsverity_private.h | 12 +++----
 fs/verity/init.c             | 56 ++++++++++++++++++++-------------
 fs/verity/open.c             | 18 +++--------
 fs/verity/signature.c        | 61 +++++-------------------------------
 fs/verity/verify.c           | 11 ++-----
 5 files changed, 55 insertions(+), 103 deletions(-)

base-commit: ace1ba1c9038b30f29c5759bc4726bbed7748f15

Signature · 1 line

2.41.0

Eric Biggers

author maintainer

2023-07-05 21:29 UTC #1 lore raw

PATCH 1/2 fsverity: simplify handling of errors during initcall

From: Eric Biggers <[email protected]>

Since CONFIG_FS_VERITY is a bool, not a tristate, fs/verity/ can only be builtin or absent entirely; it can't be a loadable module. Therefore, the error code that gets returned from the fsverity_init() initcall is never used. If any part of the initcall does fail, which should never happen, the kernel will be left in a bad state.

Following the usual convention for builtin code, just panic the kernel if any of part of the initcall fails.

Signed-off-by Eric Biggers <[email protected]>

---
 fs/verity/fsverity_private.h | 11 ++++------
 fs/verity/init.c             | 24 +++------------------
 fs/verity/open.c             | 18 +++++-----------
 fs/verity/signature.c        | 42 ++++++++++++------------------------
 fs/verity/verify.c           | 11 ++--------
 5 files changed, 28 insertions(+), 78 deletions(-)

fs/verity/fsverity_private.h +4 -7

index 49bf3a1eb2a02..c5ab9023dd2d3 100644
@@ -118,8 +118,7 @@ void fsverity_free_info(struct fsverity_info *vi);
 int fsverity_get_descriptor(struct inode *inode,
 			    struct fsverity_descriptor **desc_ret);
 
-int __init fsverity_init_info_cache(void);
-void __init fsverity_exit_info_cache(void);
+void __init fsverity_init_info_cache(void);
 
 /* signature.c */

@@ -127,7 +126,7 @@ void __init fsverity_exit_info_cache(void);
 int fsverity_verify_signature(const struct fsverity_info *vi,
 			      const u8 *signature, size_t sig_size);
 
-int __init fsverity_init_signature(void);
+void __init fsverity_init_signature(void);
 #else /* !CONFIG_FS_VERITY_BUILTIN_SIGNATURES */
 static inline int
 fsverity_verify_signature(const struct fsverity_info *vi,

@@ -136,15 +135,13 @@ fsverity_verify_signature(const struct fsverity_info *vi,
 	return 0;
 }
 
-static inline int fsverity_init_signature(void)
+static inline void fsverity_init_signature(void)
 {
-	return 0;
 }
 #endif /* !CONFIG_FS_VERITY_BUILTIN_SIGNATURES */
 
 /* verify.c */
 
-int __init fsverity_init_workqueue(void);
-void __init fsverity_exit_workqueue(void);
+void __init fsverity_init_workqueue(void);
 
 #endif /* _FSVERITY_PRIVATE_H */

fs/verity/init.c +3 ~~-21~~

index 0239051510355..bcd11d63eb1ca 100644
@@ -33,28 +33,10 @@ void fsverity_msg(const struct inode *inode, const char *level,
 
 static int __init fsverity_init(void)
 {
-	int err;
-
 	fsverity_check_hash_algs();
-
-	err = fsverity_init_info_cache();
-	if (err)
-		return err;
-
-	err = fsverity_init_workqueue();
-	if (err)
-		goto err_exit_info_cache;
-
-	err = fsverity_init_signature();
-	if (err)
-		goto err_exit_workqueue;
-
+	fsverity_init_info_cache();
+	fsverity_init_workqueue();
+	fsverity_init_signature();
 	return 0;
-
-err_exit_workqueue:
-	fsverity_exit_workqueue();
-err_exit_info_cache:
-	fsverity_exit_info_cache();
-	return err;
 }
 late_initcall(fsverity_init)

fs/verity/open.c +5 ~~-13~~

index 1db5106a9c385..6c31a871b84bc 100644
@@ -408,18 +408,10 @@ void __fsverity_cleanup_inode(struct inode *inode)
 }
 EXPORT_SYMBOL_GPL(__fsverity_cleanup_inode);
 
-int __init fsverity_init_info_cache(void)
+void __init fsverity_init_info_cache(void)
 {
-	fsverity_info_cachep = KMEM_CACHE_USERCOPY(fsverity_info,
-						   SLAB_RECLAIM_ACCOUNT,
-						   file_digest);
-	if (!fsverity_info_cachep)
-		return -ENOMEM;
-	return 0;
-}
-
-void __init fsverity_exit_info_cache(void)
-{
-	kmem_cache_destroy(fsverity_info_cachep);
-	fsverity_info_cachep = NULL;
+	fsverity_info_cachep = KMEM_CACHE_USERCOPY(
+					fsverity_info,
+					SLAB_RECLAIM_ACCOUNT | SLAB_PANIC,
+					file_digest);
 }

fs/verity/signature.c +14 ~~-28~~

57 lines not on this page · raw message

fs/verity/verify.c +2 -9

index 433cef51f5f6b..904ccd7e8e162 100644
@@ -346,7 +346,7 @@ void fsverity_enqueue_verify_work(struct work_struct *work)
 }
 EXPORT_SYMBOL_GPL(fsverity_enqueue_verify_work);
 
-int __init fsverity_init_workqueue(void)
+void __init fsverity_init_workqueue(void)
 {
 	/*
 	 * Use a high-priority workqueue to prioritize verification work, which

@@ -360,12 +360,5 @@ int __init fsverity_init_workqueue(void)
 						  WQ_HIGHPRI,
 						  num_online_cpus());
 	if (!fsverity_read_workqueue)
-		return -ENOMEM;
-	return 0;
-}
-
-void __init fsverity_exit_workqueue(void)
-{
-	destroy_workqueue(fsverity_read_workqueue);
-	fsverity_read_workqueue = NULL;
+		panic("failed to allocate fsverity_read_queue");
 }

base-commit: ace1ba1c9038b30f29c5759bc4726bbed7748f15

Signature · 1 line

2.41.0

Eric Biggers

author maintainer

2023-07-05 21:29 UTC #2 lore raw

PATCH 2/2 fsverity: move sysctl registration out of signature.c

In reply to Eric Biggers

From: Eric Biggers <[email protected]>

Currently the registration of the fsverity sysctls happens in signature.c, which couples it to CONFIG_FS_VERITY_BUILTIN_SIGNATURES.

This makes it hard to add new sysctls unrelated to builtin signatures.

Also, some users have started checking whether the directory /proc/sys/fs/verity exists as a way to tell whether fsverity is supported. This isn't the intended method; instead, the existence of /sys/fs/$fstype/features/verity should be checked, or users should just try to use the fsverity ioctls. Regardlesss, it should be made to work as expected without a dependency on CONFIG_FS_VERITY_BUILTIN_SIGNATURES.

Therefore, move the sysctl registration into init.c. With CONFIG_FS_VERITY_BUILTIN_SIGNATURES, nothing changes. Without it, but with CONFIG_FS_VERITY, an empty list of sysctls is now registered.

Signed-off-by Eric Biggers <[email protected]>

---
 fs/verity/fsverity_private.h |  1 +
 fs/verity/init.c             | 32 ++++++++++++++++++++++++++++++++
 fs/verity/signature.c        | 33 +--------------------------------
 3 files changed, 34 insertions(+), 32 deletions(-)

fs/verity/fsverity_private.h +1 -0

index c5ab9023dd2d3..d071a6e32581e 100644
@@ -123,6 +123,7 @@ void __init fsverity_init_info_cache(void);
 /* signature.c */
 
 #ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+extern int fsverity_require_signatures;
 int fsverity_verify_signature(const struct fsverity_info *vi,
 			      const u8 *signature, size_t sig_size);

fs/verity/init.c +32 -0

index bcd11d63eb1ca..a29f062f6047b 100644
@@ -9,6 +9,37 @@
 
 #include <linux/ratelimit.h>
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *fsverity_sysctl_header;
+
+static struct ctl_table fsverity_sysctl_table[] = {
+#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+	{
+		.procname       = "require_signatures",
+		.data           = &fsverity_require_signatures,
+		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = proc_dointvec_minmax,
+		.extra1         = SYSCTL_ZERO,
+		.extra2         = SYSCTL_ONE,
+	},
+#endif
+	{ }
+};
+
+static void __init fsverity_init_sysctl(void)
+{
+	fsverity_sysctl_header = register_sysctl("fs/verity",
+						 fsverity_sysctl_table);
+	if (!fsverity_sysctl_header)
+		panic("fsverity sysctl registration failed");
+}
+#else /* CONFIG_SYSCTL */
+static inline void fsverity_init_sysctl(void)
+{
+}
+#endif /* !CONFIG_SYSCTL */
+
 void fsverity_msg(const struct inode *inode, const char *level,
 		  const char *fmt, ...)
 {

@@ -36,6 +67,7 @@ static int __init fsverity_init(void)
 	fsverity_check_hash_algs();
 	fsverity_init_info_cache();
 	fsverity_init_workqueue();
+	fsverity_init_sysctl();
 	fsverity_init_signature();
 	return 0;
 }

fs/verity/signature.c +1 ~~-32~~

index ec75ffec069ed..b95acae64eac6 100644
@@ -24,7 +24,7 @@
  * /proc/sys/fs/verity/require_signatures
  * If 1, all verity files must have a valid builtin signature.
  */
-static int fsverity_require_signatures;
+int fsverity_require_signatures;
 
 /*
  * Keyring that contains the trusted X.509 certificates.

@@ -93,35 +93,6 @@ int fsverity_verify_signature(const struct fsverity_info *vi,
 	return 0;
 }
 
-#ifdef CONFIG_SYSCTL
-static struct ctl_table_header *fsverity_sysctl_header;
-
-static struct ctl_table fsverity_sysctl_table[] = {
-	{
-		.procname       = "require_signatures",
-		.data           = &fsverity_require_signatures,
-		.maxlen         = sizeof(int),
-		.mode           = 0644,
-		.proc_handler   = proc_dointvec_minmax,
-		.extra1         = SYSCTL_ZERO,
-		.extra2         = SYSCTL_ONE,
-	},
-	{ }
-};
-
-static void __init fsverity_sysctl_init(void)
-{
-	fsverity_sysctl_header = register_sysctl("fs/verity",
-						 fsverity_sysctl_table);
-	if (!fsverity_sysctl_header)
-		panic("fsverity sysctl registration failed");
-}
-#else /* !CONFIG_SYSCTL */
-static inline void fsverity_sysctl_init(void)
-{
-}
-#endif /* !CONFIG_SYSCTL */
-
 void __init fsverity_init_signature(void)
 {
 	fsverity_keyring =

@@ -132,6 +103,4 @@ void __init fsverity_init_signature(void)
 			      KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
 	if (IS_ERR(fsverity_keyring))
 		panic("failed to allocate \".fs-verity\" keyring");
-
-	fsverity_sysctl_init();
 }

Signature · 1 line

2.41.0

Joel Granados

2023-09-06 13:49 UTC #3 lore raw

Re: [PATCH 2/2] fsverity: move sysctl registration out of signature.c

Quoted 53 lines · Eric Biggers

From: Eric Biggers <[email protected]>
Currently the registration of the fsverity sysctls happens in signature.c, which couples it to CONFIG_FS_VERITY_BUILTIN_SIGNATURES.
This makes it hard to add new sysctls unrelated to builtin signatures.
Also, some users have started checking whether the directory /proc/sys/fs/verity exists as a way to tell whether fsverity is supported. This isn't the intended method; instead, the existence of /sys/fs/$fstype/features/verity should be checked, or users should just try to use the fsverity ioctls. Regardlesss, it should be made to work as expected without a dependency on CONFIG_FS_VERITY_BUILTIN_SIGNATURES.
Therefore, move the sysctl registration into init.c. With CONFIG_FS_VERITY_BUILTIN_SIGNATURES, nothing changes. Without it, but with CONFIG_FS_VERITY, an empty list of sysctls is now registered.
Signed-off-by Eric Biggers <[email protected]>
---
 fs/verity/fsverity_private.h |  1 +
 fs/verity/init.c             | 32 ++++++++++++++++++++++++++++++++
 fs/verity/signature.c        | 33 +--------------------------------
 3 files changed, 34 insertions(+), 32 deletions(-)
fs/verity/fsverity_private.h +1 -0
index c5ab9023dd2d3..d071a6e32581e 100644
@@ -123,6 +123,7 @@ void __init fsverity_init_info_cache(void);
 /* signature.c */
 
 #ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+extern int fsverity_require_signatures;
 int fsverity_verify_signature(const struct fsverity_info *vi,
 			      const u8 *signature, size_t sig_size);
 
fs/verity/init.c +8 -0
index bcd11d63eb1ca..a29f062f6047b 100644
@@ -9,6 +9,37 @@
 
 #include <linux/ratelimit.h>
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *fsverity_sysctl_header;
+
+static struct ctl_table fsverity_sysctl_table[] = {
+#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+	{
+		.procname       = "require_signatures",
+		.data           = &fsverity_require_signatures,

fs/verity/init.c line 29

Quoted 10 lines

fs/verity/init.c +10 -0

+		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = proc_dointvec_minmax,
+		.extra1         = SYSCTL_ZERO,
+		.extra2         = SYSCTL_ONE,
+	},
+#endif
+	{ }
+};
+

Just to double check: When CONFIG_FS_VERITY_BUILTIN_SIGNATURES is not defined then you expect an empty directory under "fs/verity". right?

I'm double checking as part of the ongoing "removing the sentinel" patch set. Latest patchset here
https://lore.kernel.org/all/20230906-jag-sysctl_remove_empty_elem_arch-v1-0-3935d4854248@samsung.com/.
The filesystem chunk has not yet been publish, but I'm making it ready for when that time comes.

Quoted 17 lines

fs/verity/init.c +13 -0

+static void __init fsverity_init_sysctl(void)
+{
+	fsverity_sysctl_header = register_sysctl("fs/verity",
+						 fsverity_sysctl_table);
+	if (!fsverity_sysctl_header)
+		panic("fsverity sysctl registration failed");
+}
+#else /* CONFIG_SYSCTL */
+static inline void fsverity_init_sysctl(void)
+{
+}
+#endif /* !CONFIG_SYSCTL */
+
 void fsverity_msg(const struct inode *inode, const char *level,
 		  const char *fmt, ...)
 {

fs/verity/init.c static int __init fsverity_init(void) · line 67

Quoted 1 line

fs/verity/init.c +0 -0

@@ -36,6 +67,7 @@ static int __init fsverity_init(void)
 	fsverity_check_hash_algs();

...

Best

Signature · 1 line

Joel Granados

Eric Biggers

author maintainer

2023-09-07 04:12 UTC #4 lore raw

Re: [PATCH 2/2] fsverity: move sysctl registration out of signature.c

Quoted 58 lines · Joel Granados

Quoted 57 lines · Eric Biggers
From: Eric Biggers <[email protected]>
Currently the registration of the fsverity sysctls happens in signature.c, which couples it to CONFIG_FS_VERITY_BUILTIN_SIGNATURES.
This makes it hard to add new sysctls unrelated to builtin signatures.
Also, some users have started checking whether the directory /proc/sys/fs/verity exists as a way to tell whether fsverity is supported. This isn't the intended method; instead, the existence of /sys/fs/$fstype/features/verity should be checked, or users should just try to use the fsverity ioctls. Regardlesss, it should be made to work as expected without a dependency on CONFIG_FS_VERITY_BUILTIN_SIGNATURES.
Therefore, move the sysctl registration into init.c. With CONFIG_FS_VERITY_BUILTIN_SIGNATURES, nothing changes. Without it, but with CONFIG_FS_VERITY, an empty list of sysctls is now registered.
Signed-off-by Eric Biggers <[email protected]>
---
 fs/verity/fsverity_private.h |  1 +
 fs/verity/init.c             | 32 ++++++++++++++++++++++++++++++++
 fs/verity/signature.c        | 33 +--------------------------------
 3 files changed, 34 insertions(+), 32 deletions(-)
fs/verity/fsverity_private.h +1 -0
index c5ab9023dd2d3..d071a6e32581e 100644
@@ -123,6 +123,7 @@ void __init fsverity_init_info_cache(void);
 /* signature.c */
 
 #ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+extern int fsverity_require_signatures;
 int fsverity_verify_signature(const struct fsverity_info *vi,
 			      const u8 *signature, size_t sig_size);
 
fs/verity/init.c +12 -0
index bcd11d63eb1ca..a29f062f6047b 100644
@@ -9,6 +9,37 @@
 
 #include <linux/ratelimit.h>
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *fsverity_sysctl_header;
+
+static struct ctl_table fsverity_sysctl_table[] = {
+#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+	{
+		.procname       = "require_signatures",
+		.data           = &fsverity_require_signatures,
+		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = proc_dointvec_minmax,
+		.extra1         = SYSCTL_ZERO,

Quoted 8 lines

fs/verity/init.c line 29
Quoted 6 lines
fs/verity/init.c +6 -0
+		.extra2         = SYSCTL_ONE,
+	},
+#endif
+	{ }
+};
+
Just to double check: When CONFIG_FS_VERITY_BUILTIN_SIGNATURES is not defined then you expect an empty directory under "fs/verity". right?

Yes, that's correct.

- Eric

[email protected]

CI Applied

2023-09-04 18:11 UTC #5 lore raw

In reply to Eric Biggers

This series was applied to jaegeuk/f2fs.git (dev) by Eric Biggers <[email protected]>:

Hello:

This series was applied to jaegeuk/f2fs.git (dev)
by Eric Biggers <[email protected]>:

Quoted 9 lines · On Wed, 5 Jul 2023 14:27:41 -0700 you wrote:

This series simplifies handling of errors during the fsverity_init() initcall, and moves the sysctl registration out of signature.c so that it is not unnecessarily tied to the builtin signature feature.
Eric Biggers (2):
fsverity: simplify handling of errors during initcall
fsverity: move sysctl registration out of signature.c
[...]

Here is the summary with links:
- [f2fs-dev,1/2] fsverity: simplify handling of errors during initcall

    https://git.kernel.org/jaegeuk/f2fs/c/e77000ccc531
  - [f2fs-dev,2/2] fsverity: move sysctl registration out of signature.c
    https://git.kernel.org/jaegeuk/f2fs/c/456ae5fe9b44

You are awesome, thank you!

Signature · 2 lines

Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html