Messages in this thread | | | Date | Fri, 20 Mar 2015 15:39:30 +1100 | From | NeilBrown <> | Subject | Re: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link. |
| |
On Mon, 16 Mar 2015 21:00:35 +0000 Al Viro <viro@ZenIV.linux.org.uk> wrote:
> On Mon, Mar 16, 2015 at 03:43:19PM +1100, NeilBrown wrote: > > Some of dentry_has_perm() is not rcu-safe, so if LOOKUP_RCU > > is set in selinux_inode_follow_link(), give up with > > -ECHILD. > > > > It is possible that dentry_has_perm could sometimes complete > > in RCU more, in which case the flag could be propagated further > > down the stack... > > It bloody well can. Expand it a bit and you'll see - the nastiness > comes from avc_audit() doing > return slow_avc_audit(ssid, tsid, tclass, > requested, audited, denied, result, > a, 0); > and passing that 0 to slow_avc_audit(). Pass it MAY_NOT_BLOCK instead > and it'll bugger off with -ECHILD in blocking case. > > Call chain is dentry_has_perm -> inode_has_perm -> avc_has_perm -> avc_audit. > Expand those (including avc_audit()) and make slow_avc_audit() get > flags & LOOKUP_RCU ? MAY_NOT_BLOCK : 0.
There is more to it than that.
avc_has_perm calls avc_has_perm_noaudit which does:
rcu_read_lock(); ... if (unlikely(!node)) { node = avc_compute_av(ssid, tsid, tclass, avd); } else ...
... rcu_read_unlock();
and avc_compute_av() does
rcu_read_unlock(); security_compute_av(ssid, tsid, tclass, avd); rcu_read_lock();
(yes: unlock, and then lock). so avc_has_perm_noaudit needs to bail out of RCU-walk if node turns out to be NULL. So I either add another 'flags' arg to that, or replace the current one which is unused .... or leave it as someone else's problem :-)
NeilBrown [unhandled content-type:application/pgp-signature] | |