f_modown and LSM inconsistency (was [PATCH v2 1/4] Landlock: Add signal control)
From: Mickaël Salaün
Date: Fri Aug 09 2024 - 09:18:21 EST
Talking about f_modown() and security_file_set_fowner(), it looks like
there are some issues:
On Fri, Aug 09, 2024 at 02:44:06PM +0200, Jann Horn wrote:
> On Fri, Aug 9, 2024 at 12:59 PM Mickaël Salaün <mic@xxxxxxxxxxx> wrote:
[...]
> > BTW, I don't understand why neither SELinux nor Smack use (explicit)
> > atomic operations nor lock.
>
> Yeah, I think they're sloppy and kinda wrong - but it sorta works in
> practice mostly because they don't have to do any refcounting around
> this?
>
> > And it looks weird that
> > security_file_set_fowner() isn't called by f_modown() with the same
> > locking to avoid races.
>
> True. I imagine maybe the thought behind this design could have been
> that LSMs should have their own locking, and that calling an LSM hook
> with IRQs off is a little weird? But the way the LSMs actually use the
> hook now, it might make sense to call the LSM with the lock held and
> IRQs off...
>
Would it be OK (for VFS, SELinux, and Smack maintainers) to move the
security_file_set_fowner() call into f_modown(), especially where
UID/EUID are populated. That would only call security_file_set_fowner()
when the fown is actually set, which I think could also fix a bug for
SELinux and Smack.
Could we replace the uid and euid fields with a pointer to the current
credentials? This would enables LSMs to not copy the same kind of
credential informations and save some memory, simplify credential
management, and improve consistency.