From patchwork Mon Jun 12 19:14:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= X-Patchwork-Id: 13277180 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00EA3C88CB2 for ; Mon, 12 Jun 2023 19:15:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238145AbjFLTPH (ORCPT ); Mon, 12 Jun 2023 15:15:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46356 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238010AbjFLTOp (ORCPT ); Mon, 12 Jun 2023 15:14:45 -0400 Received: from smtp-8faa.mail.infomaniak.ch (smtp-8faa.mail.infomaniak.ch [IPv6:2001:1600:4:17::8faa]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7081BE54 for ; Mon, 12 Jun 2023 12:14:43 -0700 (PDT) Received: from smtp-2-0000.mail.infomaniak.ch (unknown [10.5.36.107]) by smtp-3-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4Qg1b23pH8zMq94q; Mon, 12 Jun 2023 19:14:38 +0000 (UTC) Received: from unknown by smtp-2-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4Qg1b12W4MzMqmsh; Mon, 12 Jun 2023 21:14:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digikod.net; s=20191114; t=1686597278; bh=IyGVL/IDfihrZ3aEmE9iwusUGzsJURKRriLT2zxWZro=; h=From:To:Cc:Subject:Date:From; b=e3g9IqhKw1rGaPe68hX+Rw5YNj1RnNxL/Vjdw6KjhQnt6JRteAcyfr8t0+nm5Qy7l EWO1ML1nD0yHNjfeENmIWHjkBweHDdMqouRltkE5PwslyW1nacJ8yD+8oKW/DGeKeM 0f9bXfRiKckLQOkzzsojx8g85/jhF1LobJ5QoTvU= From: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= To: Anton Ivanov , Johannes Berg , Richard Weinberger Cc: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Christopher Obbard , Guenter Roeck , =?utf-8?q?G=C3=BCnther_Noack?= , Jakub Kicinski , James Morris , Jeff Xu , Kees Cook , Paul Moore , Ritesh Raj Sarraf , Roberto Sassu , "Serge E . Hallyn" , Shuah Khan , Sjoerd Simons , Willem de Bruijn , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 0/6] Landlock support for UML Date: Mon, 12 Jun 2023 21:14:24 +0200 Message-ID: <20230612191430.339153-1-mic@digikod.net> MIME-Version: 1.0 X-Infomaniak-Routing: alpha Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Hi, Commit cb2c7d1a1776 ("landlock: Support filesystem access-control") introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for User-Mode Linux. The reason was that UML's hostfs managed inodes in an ephemeral way: from the kernel point of view, the same inode struct could be created several times while being used by user space because the kernel didn't hold references to inodes. Because Landlock (and probably other subsystems) ties properties (i.e. access rights) to inode objects, it wasn't possible to create rules that match inodes and then allow specific accesses. This patch series fixes the way UML manages inodes according to the underlying filesystem. They are now properly handles as for other filesystems, which enables to support Landlock (and probably other features). Changes since v1: https://lore.kernel.org/r/20230309165455.175131-1-mic@digikod.net - Remove Cc stable@ (suggested by Richard). - Add Acked-by: Richard Weinberger to the first patch. - Split the test patch into two patches: one for the common pseudo-filesystems, and another patch dedicated to hostfs. - Remove CONFIG_SECURITY_PATH because it is useless for merge_config.sh - Move CONFIG_HOSTFS to a new config.um file. - Fix commit message spelling and test warnings. - Improve prepare_layout_opt() with remove_path() call to avoid cascading errors when some tested filesystems are not supported. - Remove cgroup-v1 tests because this filesystem cannot really be mounted several times. - Add test coverage with and without kernel debug code, according to GCC 12 and GCC 13. Regards, Mickaël Salaün (6): hostfs: Fix ephemeral inodes selftests/landlock: Don't create useless file layouts selftests/landlock: Add supports_filesystem() helper selftests/landlock: Make mounts configurable selftests/landlock: Add tests for pseudo filesystems selftests/landlock: Add hostfs tests arch/Kconfig | 7 - arch/um/Kconfig | 1 - fs/hostfs/hostfs.h | 1 + fs/hostfs/hostfs_kern.c | 213 ++++++------ fs/hostfs/hostfs_user.c | 1 + security/landlock/Kconfig | 2 +- tools/testing/selftests/landlock/config | 9 +- tools/testing/selftests/landlock/config.um | 1 + tools/testing/selftests/landlock/fs_test.c | 387 +++++++++++++++++++-- 9 files changed, 478 insertions(+), 144 deletions(-) create mode 100644 tools/testing/selftests/landlock/config.um base-commit: 858fd168a95c5b9669aac8db6c14a9aeab446375