[v2,0/6] Landlock support for UML

Message

Mickaël Salaün June 12, 2023, 7:14 p.m. UTC

Hi,

Commit cb2c7d1a1776 ("landlock: Support filesystem access-control")
introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for
User-Mode Linux.  The reason was that UML's hostfs managed inodes in an
ephemeral way: from the kernel point of view, the same inode struct
could be created several times while being used by user space because
the kernel didn't hold references to inodes.  Because Landlock (and
probably other subsystems) ties properties (i.e. access rights) to inode
objects, it wasn't possible to create rules that match inodes and then
allow specific accesses.

This patch series fixes the way UML manages inodes according to the
underlying filesystem.  They are now properly handles as for other
filesystems, which enables to support Landlock (and probably other
features).

Changes since v1:
https://lore.kernel.org/r/[e-mail]
- Remove Cc stable@ (suggested by Richard).
- Add Acked-by: Richard Weinberger to the first patch.
- Split the test patch into two patches: one for the common
  pseudo-filesystems, and another patch dedicated to hostfs.
- Remove CONFIG_SECURITY_PATH because it is useless for merge_config.sh
- Move CONFIG_HOSTFS to a new config.um file.
- Fix commit message spelling and test warnings.
- Improve prepare_layout_opt() with remove_path() call to avoid
  cascading errors when some tested filesystems are not supported.
- Remove cgroup-v1 tests because this filesystem cannot really be
  mounted several times.
- Add test coverage with and without kernel debug code, according to
  GCC 12 and GCC 13.

Regards,

Mickaël Salaün (6):
  hostfs: Fix ephemeral inodes
  selftests/landlock: Don't create useless file layouts
  selftests/landlock: Add supports_filesystem() helper
  selftests/landlock: Make mounts configurable
  selftests/landlock: Add tests for pseudo filesystems
  selftests/landlock: Add hostfs tests

 arch/Kconfig                               |   7 -
 arch/um/Kconfig                            |   1 -
 fs/hostfs/hostfs.h                         |   1 +
 fs/hostfs/hostfs_kern.c                    | 213 ++++++------
 fs/hostfs/hostfs_user.c                    |   1 +
 security/landlock/Kconfig                  |   2 +-
 tools/testing/selftests/landlock/config    |   9 +-
 tools/testing/selftests/landlock/config.um |   1 +
 tools/testing/selftests/landlock/fs_test.c | 387 +++++++++++++++++++--
 9 files changed, 478 insertions(+), 144 deletions(-)
 create mode 100644 tools/testing/selftests/landlock/config.um


base-commit: 858fd168a95c5b9669aac8db6c14a9aeab446375

Comments

Mickaël Salaün June 12, 2023, 7:31 p.m. UTC | #1

I've push this series into -next. Thanks Richard!

On 12/06/2023 21:14, Mickaël Salaün wrote:
> Hi,
> 
> Commit cb2c7d1a1776 ("landlock: Support filesystem access-control")
> introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for
> User-Mode Linux.  The reason was that UML's hostfs managed inodes in an
> ephemeral way: from the kernel point of view, the same inode struct
> could be created several times while being used by user space because
> the kernel didn't hold references to inodes.  Because Landlock (and
> probably other subsystems) ties properties (i.e. access rights) to inode
> objects, it wasn't possible to create rules that match inodes and then
> allow specific accesses.
> 
> This patch series fixes the way UML manages inodes according to the
> underlying filesystem.  They are now properly handles as for other
> filesystems, which enables to support Landlock (and probably other
> features).
> 
> Changes since v1:
> https://lore.kernel.org/r/[e-mail]
> - Remove Cc stable@ (suggested by Richard).
> - Add Acked-by: Richard Weinberger to the first patch.
> - Split the test patch into two patches: one for the common
>    pseudo-filesystems, and another patch dedicated to hostfs.
> - Remove CONFIG_SECURITY_PATH because it is useless for merge_config.sh
> - Move CONFIG_HOSTFS to a new config.um file.
> - Fix commit message spelling and test warnings.
> - Improve prepare_layout_opt() with remove_path() call to avoid
>    cascading errors when some tested filesystems are not supported.
> - Remove cgroup-v1 tests because this filesystem cannot really be
>    mounted several times.
> - Add test coverage with and without kernel debug code, according to
>    GCC 12 and GCC 13.
> 
> Regards,
> 
> Mickaël Salaün (6):
>    hostfs: Fix ephemeral inodes
>    selftests/landlock: Don't create useless file layouts
>    selftests/landlock: Add supports_filesystem() helper
>    selftests/landlock: Make mounts configurable
>    selftests/landlock: Add tests for pseudo filesystems
>    selftests/landlock: Add hostfs tests
> 
>   arch/Kconfig                               |   7 -
>   arch/um/Kconfig                            |   1 -
>   fs/hostfs/hostfs.h                         |   1 +
>   fs/hostfs/hostfs_kern.c                    | 213 ++++++------
>   fs/hostfs/hostfs_user.c                    |   1 +
>   security/landlock/Kconfig                  |   2 +-
>   tools/testing/selftests/landlock/config    |   9 +-
>   tools/testing/selftests/landlock/config.um |   1 +
>   tools/testing/selftests/landlock/fs_test.c | 387 +++++++++++++++++++--
>   9 files changed, 478 insertions(+), 144 deletions(-)
>   create mode 100644 tools/testing/selftests/landlock/config.um
> 
> 
> base-commit: 858fd168a95c5b9669aac8db6c14a9aeab446375