Re: [RFC 1/1] shiftfs: uid/gid shifting bind mount

On Sun, Feb 05, 2017 at 05:18:11PM -0800, James Bottomley wrote: [..] > > shiftfs is going to miss out on overlayfs bug fixes related to user > > credentials differ from mounter credentials, like fd3220d ("ovl: > > update S_ISGID when setting posix ACLs"). I am not sure that this > > specific

Re: [RFC 1/1] shiftfs: uid/gid shifting bind mount

On Sun, Feb 05, 2017 at 05:18:11PM -0800, James Bottomley wrote: [..] > > shiftfs is going to miss out on overlayfs bug fixes related to user > > credentials differ from mounter credentials, like fd3220d ("ovl: > > update S_ISGID when setting posix ACLs"). I am not sure that this > > specific

Re: [PATCH v2] ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials

ng file system in > mounter's context") > Cc: Vivek Goyal <vgo...@redhat.com> > Cc: Miklos Szeredi <mszer...@redhat.com> > --- > fs/overlayfs/super.c |9 +++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/fs/overlayfs/supe

Re: [PATCH v2] ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials

uld be allowed to use reserved space on underlying filesystem when doing overlay. It should not be overlay's job to prevent that? May be it is just me Vivek > Signed-off-by: Konstantin Khlebnikov > Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in > mounter'

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

On Tue, Jan 10, 2017 at 11:06:47AM -0500, Vivek Goyal wrote: > On Tue, Jan 10, 2017 at 02:26:48PM +0300, Konstantin Khlebnikov wrote: > > If overlay was mounted by root then quota set for upper layer does not work > > because overlay now always use mounter's credentials

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

On Tue, Jan 10, 2017 at 11:06:47AM -0500, Vivek Goyal wrote: > On Tue, Jan 10, 2017 at 02:26:48PM +0300, Konstantin Khlebnikov wrote: > > If overlay was mounted by root then quota set for upper layer does not work > > because overlay now always use mounter's credentials

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

capability CAP_SYS_RESOURCE in root user namespace. > > Signed-off-by: Konstantin Khlebnikov <khlebni...@yandex-team.ru> > Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in > mounter's context") > Cc: Vivek Goyal <vgo...@redhat.com>

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

capability CAP_SYS_RESOURCE in root user namespace. > > Signed-off-by: Konstantin Khlebnikov > Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in > mounter's context") > Cc: Vivek Goyal > Cc: Miklos Szeredi > --- > fs/overl

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

ce. This makes sense to me. I too would like quota to take effect for containers on overlay. I will test it. Vivek > > Signed-off-by: Konstantin Khlebnikov <khlebni...@yandex-team.ru> > Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in > mounter's co

Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged

ce. This makes sense to me. I too would like quota to take effect for containers on overlay. I will test it. Vivek > > Signed-off-by: Konstantin Khlebnikov > Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in > mounter's context") > Cc: Vive

Re: [PATCH RFC V2] purgatory: fix up declarations

On Fri, Dec 23, 2016 at 12:43:07PM +0100, Nicholas Mc Guire wrote: > Add the missing declarations of basic purgatory functions and variables > used with kexec_purgatory_get_set_symbol() to allow a clean build. > > Fixes: commit 8fc5b4d4121c ("purgatory: core purgatory functionality") >

Re: [PATCH RFC V2] purgatory: fix up declarations

On Fri, Dec 23, 2016 at 12:43:07PM +0100, Nicholas Mc Guire wrote: > Add the missing declarations of basic purgatory functions and variables > used with kexec_purgatory_get_set_symbol() to allow a clean build. > > Fixes: commit 8fc5b4d4121c ("purgatory: core purgatory functionality") >

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Fri, Oct 21, 2016 at 11:53:41AM +0300, Amir Goldstein wrote: > On Thu, Oct 20, 2016 at 11:54 PM, Vivek Goyal <vgo...@redhat.com> wrote: > > On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: > > > > [..] > >> > +static ssize_t ovl_read_i

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Fri, Oct 21, 2016 at 11:53:41AM +0300, Amir Goldstein wrote: > On Thu, Oct 20, 2016 at 11:54 PM, Vivek Goyal wrote: > > On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: > > > > [..] > >> > +static ssize_t ovl_read_iter(st

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Fri, Oct 21, 2016 at 11:12:11AM +0200, Miklos Szeredi wrote: > On Thu, Oct 20, 2016 at 04:54:08PM -0400, Vivek Goyal wrote: > > On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: > > > > [..] > > > > +static ssize_t ovl_read_iter(st

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Fri, Oct 21, 2016 at 11:12:11AM +0200, Miklos Szeredi wrote: > On Thu, Oct 20, 2016 at 04:54:08PM -0400, Vivek Goyal wrote: > > On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: > > > > [..] > > > > +static ssize_t ovl_read_iter(st

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: [..] > > +static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *to) > > +{ > > + struct file *file = iocb->ki_filp; > > + bool isupper = OVL_TYPE_UPPER(ovl_path_type(file->f_path.dentry));

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Thu, Oct 20, 2016 at 04:46:30PM -0400, Vivek Goyal wrote: [..] > > +static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *to) > > +{ > > + struct file *file = iocb->ki_filp; > > + bool isupper = OVL_TYPE_UPPER(ovl_path_type(file->f_path.dentry));

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Wed, Oct 12, 2016 at 03:33:26PM +0200, Miklos Szeredi wrote: > This is a proof of concept patch to fix the following. > > /ovl is in overlay mount and /ovl/foo exists on the lower layer only. > > rofd = open("/ovl/foo", O_RDONLY); > rwfd = open("/ovl/foo", O_WRONLY); /* this causes copy up

Re: [POC/RFC PATCH] overlayfs: fix data inconsistency at copy up

On Wed, Oct 12, 2016 at 03:33:26PM +0200, Miklos Szeredi wrote: > This is a proof of concept patch to fix the following. > > /ovl is in overlay mount and /ovl/foo exists on the lower layer only. > > rofd = open("/ovl/foo", O_RDONLY); > rwfd = open("/ovl/foo", O_WRONLY); /* this causes copy up

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Thu, Oct 06, 2016 at 08:01:42PM +0200, Paolo Valente wrote: > > > Il giorno 06 ott 2016, alle ore 19:49, Vivek Goyal <vgo...@redhat.com> ha > > scritto: > > > > On Thu, Oct 06, 2016 at 03:15:50PM +0200, Paolo Valente wrote: > > > > [..] &

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Thu, Oct 06, 2016 at 08:01:42PM +0200, Paolo Valente wrote: > > > Il giorno 06 ott 2016, alle ore 19:49, Vivek Goyal ha > > scritto: > > > > On Thu, Oct 06, 2016 at 03:15:50PM +0200, Paolo Valente wrote: > > > > [..] > >> Shaohua, I have

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Thu, Oct 06, 2016 at 03:15:50PM +0200, Paolo Valente wrote: [..] > Shaohua, I have just realized that I have unconsciously defended a > wrong argument. Although all the facts that I have reported are > evidently true, I have argued as if the question was: "do we need to > throw away

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Thu, Oct 06, 2016 at 03:15:50PM +0200, Paolo Valente wrote: [..] > Shaohua, I have just realized that I have unconsciously defended a > wrong argument. Although all the facts that I have reported are > evidently true, I have argued as if the question was: "do we need to > throw away

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Wed, Oct 05, 2016 at 02:37:00PM +0200, Paolo Valente wrote: [..] > Anyway, to avoid going on with trying speculations and arguments, let > me retry with a practical proposal. BFQ is out there, free. Let's > just test, measure and check whether we have already a solution to > the problems

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Wed, Oct 05, 2016 at 02:37:00PM +0200, Paolo Valente wrote: [..] > Anyway, to avoid going on with trying speculations and arguments, let > me retry with a practical proposal. BFQ is out there, free. Let's > just test, measure and check whether we have already a solution to > the problems

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Tue, Oct 04, 2016 at 11:56:16AM -0400, Tejun Heo wrote: > Hello, Vivek. > > On Tue, Oct 04, 2016 at 09:28:05AM -0400, Vivek Goyal wrote: > > On Mon, Oct 03, 2016 at 02:20:19PM -0700, Shaohua Li wrote: > > > Hi, > > > > > > The background is we don't

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Tue, Oct 04, 2016 at 11:56:16AM -0400, Tejun Heo wrote: > Hello, Vivek. > > On Tue, Oct 04, 2016 at 09:28:05AM -0400, Vivek Goyal wrote: > > On Mon, Oct 03, 2016 at 02:20:19PM -0700, Shaohua Li wrote: > > > Hi, > > > > > > The background is we don't

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Mon, Oct 03, 2016 at 02:20:19PM -0700, Shaohua Li wrote: > Hi, > > The background is we don't have an ioscheduler for blk-mq yet, so we can't > prioritize processes/cgroups. So this is an interim solution till we have ioscheduler for blk-mq? > This patch set tries to add basic arbitration >

Re: [PATCH V3 00/11] block-throttle: add .high limit

On Mon, Oct 03, 2016 at 02:20:19PM -0700, Shaohua Li wrote: > Hi, > > The background is we don't have an ioscheduler for blk-mq yet, so we can't > prioritize processes/cgroups. So this is an interim solution till we have ioscheduler for blk-mq? > This patch set tries to add basic arbitration >

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Tue, Sep 27, 2016 at 08:57:22AM -0400, Vivek Goyal wrote: > On Mon, Sep 19, 2016 at 03:11:10PM -0600, Jens Axboe wrote: > > On 09/19/2016 03:06 PM, Vivek Goyal wrote: > > > On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > > > > > > &g

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Tue, Sep 27, 2016 at 08:57:22AM -0400, Vivek Goyal wrote: > On Mon, Sep 19, 2016 at 03:11:10PM -0600, Jens Axboe wrote: > > On 09/19/2016 03:06 PM, Vivek Goyal wrote: > > > On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > > > > > > &g

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Mon, Sep 19, 2016 at 03:11:10PM -0600, Jens Axboe wrote: > On 09/19/2016 03:06 PM, Vivek Goyal wrote: > > On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > > > > > Hi Hou Tao, > > > > > > [ CC Tejun and Thomas ] > > >

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Mon, Sep 19, 2016 at 03:11:10PM -0600, Jens Axboe wrote: > On 09/19/2016 03:06 PM, Vivek Goyal wrote: > > On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > > > > > Hi Hou Tao, > > > > > > [ CC Tejun and Thomas ] > > >

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > Hi Hou Tao, > > [ CC Tejun and Thomas ] > > Thanks for the patch. I can reproduce it. I am wondering that why are you > doing so many checks. Can't we just check if throttle group is empty or > not. If i

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

On Tue, Sep 13, 2016 at 09:46:46AM -0400, Vivek Goyal wrote: > > Hi Hou Tao, > > [ CC Tejun and Thomas ] > > Thanks for the patch. I can reproduce it. I am wondering that why are you > doing so many checks. Can't we just check if throttle group is empty or > not. If i

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

timer function to wait. And when that timer expires, same process will repeat and we will wait again and this can easily be an infinite loop. Solve this issue by starting a new slice only if throttle gropup is empty. If it is not empty, that means there should be an active slice going on. Ideally

Re: [PATCH] blk-throttle: fix infinite throttling caused by non-cascading timer wheel

ait. And when that timer expires, same process will repeat and we will wait again and this can easily be an infinite loop. Solve this issue by starting a new slice only if throttle gropup is empty. If it is not empty, that means there should be an active slice going on. Ideally it should not be expire

[PATCH] lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE

5 scontext=unconfined_u:unconfined_r:test_overlay_client_t:s0:c10,c20 tcontext=unconfined_u:object_r:test_overlay_files_ro_t:s0 tclass=file permissive=0 Notice that now dev information points to "dm-0" device instead of "overlay" device. This makes it clear that check failed on underlying inode and not

[PATCH] lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE

5 scontext=unconfined_u:unconfined_r:test_overlay_client_t:s0:c10,c20 tcontext=unconfined_u:object_r:test_overlay_files_ro_t:s0 tclass=file permissive=0 Notice that now dev information points to "dm-0" device instead of "overlay" device. This makes it clear that check failed on underlying in

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 20, 2016 at 09:35:30AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 20, 2016 at 01:45:42PM +1000, Balbir Singh wrote: > > > IOW, if your kernel forced signature verification, you should not be > > > able to do sig_enforce=0. If you kernel did not have > > >

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 20, 2016 at 09:35:30AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 20, 2016 at 01:45:42PM +1000, Balbir Singh wrote: > > > IOW, if your kernel forced signature verification, you should not be > > > able to do sig_enforce=0. If you kernel did not have > > >

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 20, 2016 at 01:45:42PM +1000, Balbir Singh wrote: > > > > Command line options are not signed. I thought idea behind secureboot > > was to execute only trusted code and command line options don't enforce > > you to execute unsigned code. > > > >> > >> You can

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 20, 2016 at 01:45:42PM +1000, Balbir Singh wrote: > > > > Command line options are not signed. I thought idea behind secureboot > > was to execute only trusted code and command line options don't enforce > > you to execute unsigned code. > > > >> > >> You can

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 19, 2016 at 01:47:28PM +0100, Mark Rutland wrote: > On Tue, Jul 19, 2016 at 08:24:06AM -0400, Vivek Goyal wrote: > > On Tue, Jul 19, 2016 at 11:52:00AM +0100, Mark Rutland wrote: > > > Regardless, this extended syscall changes some underlying assumptions > > >

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 19, 2016 at 01:47:28PM +0100, Mark Rutland wrote: > On Tue, Jul 19, 2016 at 08:24:06AM -0400, Vivek Goyal wrote: > > On Tue, Jul 19, 2016 at 11:52:00AM +0100, Mark Rutland wrote: > > > Regardless, this extended syscall changes some underlying assumptions > > >

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 19, 2016 at 11:52:00AM +0100, Mark Rutland wrote: > On Tue, Jul 19, 2016 at 08:55:56AM +0800, Dave Young wrote: > > On 07/18/16 at 11:07am, Mark Rutland wrote: > > > On Mon, Jul 18, 2016 at 10:30:24AM +0800, Dave Young wrote: > > > > I do not think it is worth to add another syscall

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 19, 2016 at 11:52:00AM +0100, Mark Rutland wrote: > On Tue, Jul 19, 2016 at 08:55:56AM +0800, Dave Young wrote: > > On 07/18/16 at 11:07am, Mark Rutland wrote: > > > On Mon, Jul 18, 2016 at 10:30:24AM +0800, Dave Young wrote: > > > > I do not think it is worth to add another syscall

Re: [RFC 0/3] extend kexec_file_load system call

On Mon, Jul 18, 2016 at 09:26:29AM -0400, Vivek Goyal wrote: > On Mon, Jul 18, 2016 at 10:46:04PM +1000, Balbir Singh wrote: > > On Wed, 2016-07-13 at 14:22 -0400, Vivek Goyal wrote: > > > On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > > >

Re: [RFC 0/3] extend kexec_file_load system call

On Mon, Jul 18, 2016 at 09:26:29AM -0400, Vivek Goyal wrote: > On Mon, Jul 18, 2016 at 10:46:04PM +1000, Balbir Singh wrote: > > On Wed, 2016-07-13 at 14:22 -0400, Vivek Goyal wrote: > > > On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > > >

Re: [RFC 0/3] extend kexec_file_load system call

On Mon, Jul 18, 2016 at 10:46:04PM +1000, Balbir Singh wrote: > On Wed, 2016-07-13 at 14:22 -0400, Vivek Goyal wrote: > > On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > > >  > > > On Wed, Jul 13, 2016 at 09:03:38AM -0400, Vivek Goyal wrote: &

Re: [RFC 0/3] extend kexec_file_load system call

On Mon, Jul 18, 2016 at 10:46:04PM +1000, Balbir Singh wrote: > On Wed, 2016-07-13 at 14:22 -0400, Vivek Goyal wrote: > > On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > > >  > > > On Wed, Jul 13, 2016 at 09:03:38AM -0400, Vivek Goyal wrote: &

Re: [RFC 0/3] extend kexec_file_load system call

On Fri, Jul 15, 2016 at 09:31:02AM +0200, Arnd Bergmann wrote: > On Thursday, July 14, 2016 10:44:14 PM CEST Thiago Jung Bauermann wrote: > > Am Donnerstag, 14 Juli 2016, 10:29:11 schrieb Arnd Bergmann: > > > > > > > Right, but the question remains whether this helps while you allow the > > >

Re: [RFC 0/3] extend kexec_file_load system call

On Fri, Jul 15, 2016 at 09:31:02AM +0200, Arnd Bergmann wrote: > On Thursday, July 14, 2016 10:44:14 PM CEST Thiago Jung Bauermann wrote: > > Am Donnerstag, 14 Juli 2016, 10:29:11 schrieb Arnd Bergmann: > > > > > > > Right, but the question remains whether this helps while you allow the > > >

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 12, 2016 at 10:42:01AM +0900, AKASHI Takahiro wrote: [..] > -SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, > +SYSCALL_DEFINE6(kexec_file_load, int, kernel_fd, int, initrd_fd, > unsigned long, cmdline_len, const char __user *, cmdline_ptr, > -

Re: [RFC 3/3] kexec: extend kexec_file_load system call

On Tue, Jul 12, 2016 at 10:42:01AM +0900, AKASHI Takahiro wrote: [..] > -SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, > +SYSCALL_DEFINE6(kexec_file_load, int, kernel_fd, int, initrd_fd, > unsigned long, cmdline_len, const char __user *, cmdline_ptr, > -

Re: [RFC 0/3] extend kexec_file_load system call

On Fri, Jul 15, 2016 at 09:49:25AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 03:13:42PM +0200, Arnd Bergmann wrote: > > On Wednesday, July 13, 2016 10:41:28 AM CEST Mark Rutland wrote: > > > The big question is whether this is a realistic case on a secure boot > > > system.

Re: [RFC 0/3] extend kexec_file_load system call

On Fri, Jul 15, 2016 at 09:49:25AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 03:13:42PM +0200, Arnd Bergmann wrote: > > On Wednesday, July 13, 2016 10:41:28 AM CEST Mark Rutland wrote: > > > The big question is whether this is a realistic case on a secure boot > > > system.

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 09:03:38AM -0400, Vivek Goyal wrote: > > On Wed, Jul 13, 2016 at 09:26:39AM +0100, Russell King - ARM Linux wrote: > > > Indeed - maybe Eric knows better, but I can't see a

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 06:40:10PM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 09:03:38AM -0400, Vivek Goyal wrote: > > On Wed, Jul 13, 2016 at 09:26:39AM +0100, Russell King - ARM Linux wrote: > > > Indeed - maybe Eric knows better, but I can't see a

Re: [PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

creds to create file and then revert back to old creds and release new creds. Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- fs/overlayfs/copy_up.c| 15 +++ include/linux/lsm_hooks.h | 11 +++ include/linux/security.h | 6 ++ security/security.c

Re: [PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

creds to create file and then revert back to old creds and release new creds. Signed-off-by: Vivek Goyal --- fs/overlayfs/copy_up.c| 15 +++ include/linux/lsm_hooks.h | 11 +++ include/linux/security.h | 6 ++ security/security.c | 8 4 files changed

Re: [PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

On Wed, Jul 13, 2016 at 10:52:34AM -0400, Stephen Smalley wrote: > On 07/13/2016 10:44 AM, Vivek Goyal wrote: > > Provide a security hook to label new file correctly when a file is copied > > up from lower layer to upper layer of a overlay/union mount. > > > > This

Re: [PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

On Wed, Jul 13, 2016 at 10:52:34AM -0400, Stephen Smalley wrote: > On 07/13/2016 10:44 AM, Vivek Goyal wrote: > > Provide a security hook to label new file correctly when a file is copied > > up from lower layer to upper layer of a overlay/union mount. > > > > This

[PATCH 4/9] selinux: Implementation for inode_copy_up_xattr() hook

. Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- security/selinux/hooks.c | 16 1 file changed, 16 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c82ee54..4fda548 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/h

[PATCH 4/9] selinux: Implementation for inode_copy_up_xattr() hook

. Signed-off-by: Vivek Goyal --- security/selinux/hooks.c | 16 1 file changed, 16 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c82ee54..4fda548 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3290,6 +3290,21

[PATCH 5/9] selinux: Pass security pointer to determine_inode_label()

Right now selinux_determine_inode_label() works on security pointer of current task. Soon I need this to work on a security pointer retrieved from a set of creds. So start passing in a pointer and caller can decide where to fetch security pointer from. Signed-off-by: Vivek Goyal <

[PATCH 2/9] selinux: Implementation for inode_copy_up() hook

the label of lower file and in case of context mount, overlay inode will have the label from context= mount option. Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- security/selinux/hooks.c | 21 + 1 file changed, 21 insertions(+) diff --git a/security/selinux/hooks.c b/se

[PATCH 5/9] selinux: Pass security pointer to determine_inode_label()

Right now selinux_determine_inode_label() works on security pointer of current task. Soon I need this to work on a security pointer retrieved from a set of creds. So start passing in a pointer and caller can decide where to fetch security pointer from. Signed-off-by: Vivek Goyal --- security

[PATCH 2/9] selinux: Implementation for inode_copy_up() hook

the label of lower file and in case of context mount, overlay inode will have the label from context= mount option. Signed-off-by: Vivek Goyal --- security/selinux/hooks.c | 21 + 1 file changed, 21 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c

[RFC PATCH 0/9][V3] Overlayfs SELinux Support

med into upper/, and it might get label based on work/ dir. So this hooks helps avoiding all these issues. When a new file is created in upper/, it gets its label based on transition rules. For the case of context mount, it gets the label from context= option. Any feedback is welcome. Vi

[RFC PATCH 0/9][V3] Overlayfs SELinux Support

med into upper/, and it might get label based on work/ dir. So this hooks helps avoiding all these issues. When a new file is created in upper/, it gets its label based on transition rules. For the case of context mount, it gets the label from context= option. Any feedback is welcome. Vi

[PATCH 3/9] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

module does not handle/manage the xattr, or a -errno upon an error. Signed-off-by: David Howells <dhowe...@redhat.com> Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- fs/overlayfs/copy_up.c| 7 +++ include/linux/lsm_hooks.h | 10 ++ include/linux/secu

[PATCH 3/9] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

module does not handle/manage the xattr, or a -errno upon an error. Signed-off-by: David Howells Signed-off-by: Vivek Goyal --- fs/overlayfs/copy_up.c| 7 +++ include/linux/lsm_hooks.h | 10 ++ include/linux/security.h | 6 ++ security/security.c | 8 4

[PATCH 8/9] overlayfs: Dilute permission checks on lower only if not special file

-by: Dan Walsh <dwa...@redhat.com> Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- fs/overlayfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index 66f42f5..6d9d86e 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overl

[PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

to old creds and release new creds. Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- fs/overlayfs/copy_up.c| 18 ++ include/linux/lsm_hooks.h | 11 +++ include/linux/security.h | 6 ++ security/security.c | 8 4 files changed, 43 inse

[PATCH 8/9] overlayfs: Dilute permission checks on lower only if not special file

-by: Dan Walsh Signed-off-by: Vivek Goyal --- fs/overlayfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index 66f42f5..6d9d86e 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -140,7 +140,7 @@ int

[PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files

to old creds and release new creds. Signed-off-by: Vivek Goyal --- fs/overlayfs/copy_up.c| 18 ++ include/linux/lsm_hooks.h | 11 +++ include/linux/security.h | 6 ++ security/security.c | 8 4 files changed, 43 insertions(+) diff --git a/fs

[PATCH 6/9] security, overlayfs: Provide hook to correctly label newly created files

of creds appropriately. Caller makes use of these new creds for file creation. Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- fs/overlayfs/dir.c| 10 ++ include/linux/lsm_hooks.h | 15 +++ include/linux/security.h | 12 security/security.c

[PATCH 6/9] security, overlayfs: Provide hook to correctly label newly created files

of creds appropriately. Caller makes use of these new creds for file creation. Signed-off-by: Vivek Goyal --- fs/overlayfs/dir.c| 10 ++ include/linux/lsm_hooks.h | 15 +++ include/linux/security.h | 12 security/security.c | 11 +++ 4

[PATCH 7/9] selinux: Implement dentry_create_files_as() hook

Calculate what would be the label of newly created file and set that secid in the passed creds. Context of the task which is actually creating file is retrieved from set of creds passed in. (old->security). Signed-off-by: Vivek Goyal <vgo...@redhat.com> --- security/selinux/hoo

[PATCH 9/9] overlayfs: Append MAY_READ when diluting write checks

. Dan Walsh noticed this when he did access(lowerfile, W_OK) and it returned True (context mounts) but when he tried to actually write to file, it failed as mounter did not have permission on lower file. Reported-by: Dan Walsh <dwa...@redhat.com> Signed-off-by: Vivek Goyal <vgo...@r

[PATCH 9/9] overlayfs: Append MAY_READ when diluting write checks

. Dan Walsh noticed this when he did access(lowerfile, W_OK) and it returned True (context mounts) but when he tried to actually write to file, it failed as mounter did not have permission on lower file. Reported-by: Dan Walsh Signed-off-by: Vivek Goyal --- fs/overlayfs/inode.c | 9 +++-- 1

[PATCH 7/9] selinux: Implement dentry_create_files_as() hook

Calculate what would be the label of newly created file and set that secid in the passed creds. Context of the task which is actually creating file is retrieved from set of creds passed in. (old->security). Signed-off-by: Vivek Goyal --- security/selinux/hooks.c | 22 ++

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:41:39AM +1000, Stewart Smith wrote: > Petr Tesarik writes: > > On Tue, 12 Jul 2016 13:25:11 -0300 > > Thiago Jung Bauermann wrote: > > > >> Hi Eric, > >> > >> I'm trying to understand your concerns leading to your nack. I

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:45:22AM +1000, Stewart Smith wrote: > Vivek Goyal <vgo...@redhat.com> writes: > > On Tue, Jul 12, 2016 at 10:58:09AM -0300, Thiago Jung Bauermann wrote: > >> Hello Eric, > >> > >> Am Dienstag, 12 Juli 2016, 08:25:48 schrieb

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:41:39AM +1000, Stewart Smith wrote: > Petr Tesarik writes: > > On Tue, 12 Jul 2016 13:25:11 -0300 > > Thiago Jung Bauermann wrote: > > > >> Hi Eric, > >> > >> I'm trying to understand your concerns leading to your nack. I hope you > >> don't mind expanding your

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:45:22AM +1000, Stewart Smith wrote: > Vivek Goyal writes: > > On Tue, Jul 12, 2016 at 10:58:09AM -0300, Thiago Jung Bauermann wrote: > >> Hello Eric, > >> > >> Am Dienstag, 12 Juli 2016, 08:25:48 schrieb Eric W. Biede

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:26:39AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 05:55:33PM +1000, Stewart Smith wrote: > > Russell King - ARM Linux writes: > > > On Wed, Jul 13, 2016 at 02:59:51PM +1000, Stewart Smith wrote: > > >> Russell King - ARM

Re: [RFC 0/3] extend kexec_file_load system call

On Wed, Jul 13, 2016 at 09:26:39AM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 13, 2016 at 05:55:33PM +1000, Stewart Smith wrote: > > Russell King - ARM Linux writes: > > > On Wed, Jul 13, 2016 at 02:59:51PM +1000, Stewart Smith wrote: > > >> Russell King - ARM Linux writes: > > >> > On

Re: [RFC 0/3] extend kexec_file_load system call

On Tue, Jul 12, 2016 at 04:02:46PM +0200, Arnd Bergmann wrote: > On Tuesday, July 12, 2016 8:25:48 AM CEST Eric W. Biederman wrote: > > AKASHI Takahiro writes: > > > > > Device tree blob must be passed to a second kernel on DTB-capable > > > archs, like powerpc and

Re: [RFC 0/3] extend kexec_file_load system call

On Tue, Jul 12, 2016 at 04:02:46PM +0200, Arnd Bergmann wrote: > On Tuesday, July 12, 2016 8:25:48 AM CEST Eric W. Biederman wrote: > > AKASHI Takahiro writes: > > > > > Device tree blob must be passed to a second kernel on DTB-capable > > > archs, like powerpc and arm64, but the current kernel

Re: [RFC 0/3] extend kexec_file_load system call

On Tue, Jul 12, 2016 at 10:58:09AM -0300, Thiago Jung Bauermann wrote: > Hello Eric, > > Am Dienstag, 12 Juli 2016, 08:25:48 schrieb Eric W. Biederman: > > AKASHI Takahiro writes: > > > Device tree blob must be passed to a second kernel on DTB-capable > > > archs,

Re: [RFC 0/3] extend kexec_file_load system call

On Tue, Jul 12, 2016 at 10:58:09AM -0300, Thiago Jung Bauermann wrote: > Hello Eric, > > Am Dienstag, 12 Juli 2016, 08:25:48 schrieb Eric W. Biederman: > > AKASHI Takahiro writes: > > > Device tree blob must be passed to a second kernel on DTB-capable > > > archs, like powerpc and arm64, but the

Re: [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

On Mon, Jul 11, 2016 at 11:31:47AM -0400, Stephen Smalley wrote: [..] > > +static inline int security_inode_copy_up_xattr(const char *name) > > +{ > > + -EOPNOTSUPP; > > return? Yes, this one I fixed it in my patches now. kbuild also flagged this. Vivek

Re: [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

On Mon, Jul 11, 2016 at 11:31:47AM -0400, Stephen Smalley wrote: [..] > > +static inline int security_inode_copy_up_xattr(const char *name) > > +{ > > + -EOPNOTSUPP; > > return? Yes, this one I fixed it in my patches now. kbuild also flagged this. Vivek

Re: [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

On Mon, Jul 11, 2016 at 11:31:47AM -0400, Stephen Smalley wrote: > On 07/08/2016 12:19 PM, Vivek Goyal wrote: > > Provide a security hook which is called when xattrs of a file are being > > copied up. This hook is called once for each xattr and LSM can return 0 > > to access t

Re: [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file

On Mon, Jul 11, 2016 at 11:31:47AM -0400, Stephen Smalley wrote: > On 07/08/2016 12:19 PM, Vivek Goyal wrote: > > Provide a security hook which is called when xattrs of a file are being > > copied up. This hook is called once for each xattr and LSM can return 0 > > to access t

Re: [PATCH 1/7] security, overlayfs: provide copy up security hook for unioned files

On Mon, Jul 11, 2016 at 11:24:26AM -0400, Stephen Smalley wrote: > On 07/08/2016 12:19 PM, Vivek Goyal wrote: > > Provide a security hook to label new file correctly when a file is copied > > up from lower layer to upper layer of a overlay/union mount. > > > > This

Re: [PATCH 1/7] security, overlayfs: provide copy up security hook for unioned files

On Mon, Jul 11, 2016 at 11:24:26AM -0400, Stephen Smalley wrote: > On 07/08/2016 12:19 PM, Vivek Goyal wrote: > > Provide a security hook to label new file correctly when a file is copied > > up from lower layer to upper layer of a overlay/union mount. > > > > This

<    1   2   3   4   5   6   7   8   9   10   >