[v2,00/25] fs: use type-safe uid representation for filesystem capabilities

Message

Seth Forshee (DigitalOcean) Feb. 21, 2024, 9:24 p.m. UTC

This series converts filesystem capabilities from passing around raw
xattr data to using a kernel-internal representation with type safe
uids, similar to the conversion done previously for posix ACLs.
Currently fscaps representations in the kernel have two different
instances of unclear or confused types:

- fscaps are generally passed around in the raw xattr form, with the
  rootid sometimes containing the user uid value and at other times
  containing the filesystem value.
- The existing kernel-internal representation of fscaps,
  cpu_vfs_cap_data, uses the kuid_t type, but the value stored is
  actually a vfsuid.

This series eliminates this confusion by converting the xattr data to
the kernel representation near the userspace and filesystem boundaries,
using the kernel representation within the vfs and commoncap code. The
internal representation is renamed to vfs_caps to reflect this broader
use, and the rootid is changed to a vfsuid_t to correctly identify the
type of uid which it contains.

New vfs interfaces are added to allow for getting and setting fscaps
using the kernel representation. This requires the addition of new inode
operations to allow overlayfs to handle fscaps properly; all other
filesystems fall back to a generic implementation. The top-level vfs
xattr interfaces will now reject fscaps xattrs, though the lower-level
interfaces continue to accept them for reading and writing the raw xattr
data.

Based on previous feedback, new security hooks are added for fscaps
operations. These are really only needed for EVM, and the selinux and
smack implementations just peform the same operations that the
equivalent xattr hooks would have done. Note too that this has not yet
been updated based on the changes to make EVM into an LSM.

The remainder of the changes are preparatory work, addition of helpers
for converting between the xattr and kernel fscaps representation, and
various updates to use the kernel representation and new interfaces.

I have tested this code with xfstests, ltp, libcap2, and libcap-ng with
no regressions found.

To: Christian Brauner <[e-mail]>
To: Serge Hallyn <[e-mail]>
To: Paul Moore <[e-mail]>
To: Eric Paris <[e-mail]>
To: James Morris <[e-mail]>
To: Alexander Viro <[e-mail]>
To: Miklos Szeredi <[e-mail]>
To: Amir Goldstein <[e-mail]>
Cc:  <[e-mail]>
Cc:  <[e-mail]>
Cc:  <[e-mail]>
Cc:  <[e-mail]>
Cc:  <[e-mail]>
Signed-off-by: Seth Forshee (DigitalOcean) <[e-mail]>

--- Changes in v2:
- Documented new inode operations in
  Documentation/filesystems/{vfs,locking}.rst.
- Changed types for sizes in function arguments and return values to
  size_t/ssize_t.
- Renamed flags arguments to setxattr_flags for clarity.
- Removed memory allocation when reading fscaps xattrs.
- Updated get_vfs_caps_from_disk() to use vfs_get_fscaps() and updated
  comments to explain how these functions are different.
- Updates/fixes to kernel-doc comments.
- Remove unnecessary type cast.
- Rename __vfs_{get,remove}_fscaps() to vfs_{get,remove}_fscaps_nosec().
- Add missing fsnotify_xattr() call in vfs_set_fscaps().
- Add fscaps security hooks along with appropriate handlers in selinux,
  smack, and evm.
- Remove remove_fscaps inode op in favor of passing NULL to set_fscaps.
- Added static asserts for compatibility of vfs_cap_data and
  vfs_ns_cap_data.
- ovl: remove unnecessary check around ovl_copy_up(), and add check
  before copyint up fscaps for removal that the fscaps actually exist on
  the lower inode.
- ovl: install fscaps handlers for all inode types
- Add is_fscaps_xattr() helper and use it in place of open-coded strcmps
- Link to v1: https://lore.kernel.org/r/[e-mail]

---
Seth Forshee (DigitalOcean) (25):
      mnt_idmapping: split out core vfs[ug]id_t definitions into vfsid.h
      mnt_idmapping: include cred.h
      capability: add static asserts for comapatibility of vfs_cap_data and vfs_ns_cap_data
      capability: rename cpu_vfs_cap_data to vfs_caps
      capability: use vfsuid_t for vfs_caps rootids
      capability: provide helpers for converting between xattrs and vfs_caps
      capability: provide a helper for converting vfs_caps to xattr for userspace
      xattr: add is_fscaps_xattr() helper
      commoncap: use is_fscaps_xattr()
      xattr: use is_fscaps_xattr()
      security: add hooks for set/get/remove of fscaps
      selinux: add hooks for fscaps operations
      smack: add hooks for fscaps operations
      evm: add support for fscaps security hooks
      security: call evm fscaps hooks from generic security hooks
      fs: add inode operations to get/set/remove fscaps
      fs: add vfs_get_fscaps()
      fs: add vfs_set_fscaps()
      fs: add vfs_remove_fscaps()
      ovl: add fscaps handlers
      ovl: use vfs_{get,set}_fscaps() for copy-up
      fs: use vfs interfaces for capabilities xattrs
      commoncap: remove cap_inode_getsecurity()
      commoncap: use vfs fscaps interfaces
      vfs: return -EOPNOTSUPP for fscaps from vfs_*xattr()

 Documentation/filesystems/locking.rst |   4 +
 Documentation/filesystems/vfs.rst     |  17 ++
 MAINTAINERS                           |   1 +
 fs/overlayfs/copy_up.c                |  72 ++---
 fs/overlayfs/dir.c                    |   2 +
 fs/overlayfs/inode.c                  |  72 +++++
 fs/overlayfs/overlayfs.h              |   5 +
 fs/xattr.c                            | 280 +++++++++++++++++-
 include/linux/capability.h            |  23 +-
 include/linux/evm.h                   |  39 +++
 include/linux/fs.h                    |  12 +
 include/linux/lsm_hook_defs.h         |   7 +
 include/linux/mnt_idmapping.h         |  67 +----
 include/linux/security.h              |  38 ++-
 include/linux/vfsid.h                 |  74 +++++
 include/linux/xattr.h                 |   5 +
 include/uapi/linux/capability.h       |  13 +
 kernel/auditsc.c                      |   9 +-
 security/commoncap.c                  | 529 ++++++++++++++++++----------------
 security/integrity/evm/evm_main.c     |  60 ++++
 security/security.c                   |  80 +++++
 security/selinux/hooks.c              |  26 ++
 security/smack/smack_lsm.c            |  71 +++++
 23 files changed, 1144 insertions(+), 362 deletions(-)
---
base-commit: 841c35169323cd833294798e58b9bf63fa4fa1de
change-id: 20230512-idmap-fscap-refactor-63b61fa0a36f

Best regards,

Comments

Christian Brauner Feb. 22, 2024, 3:27 p.m. UTC | #1

On Wed, Feb 21, 2024 at 03:24:31PM -0600, Seth Forshee (DigitalOcean) wrote:
> This series converts filesystem capabilities from passing around raw
> xattr data to using a kernel-internal representation with type safe
> uids, similar to the conversion done previously for posix ACLs.
> Currently fscaps representations in the kernel have two different
> instances of unclear or confused types:
> 
> - fscaps are generally passed around in the raw xattr form, with the
>   rootid sometimes containing the user uid value and at other times
>   containing the filesystem value.
> - The existing kernel-internal representation of fscaps,
>   cpu_vfs_cap_data, uses the kuid_t type, but the value stored is
>   actually a vfsuid.
> 
> This series eliminates this confusion by converting the xattr data to
> the kernel representation near the userspace and filesystem boundaries,
> using the kernel representation within the vfs and commoncap code. The
> internal representation is renamed to vfs_caps to reflect this broader
> use, and the rootid is changed to a vfsuid_t to correctly identify the
> type of uid which it contains.
> 
> New vfs interfaces are added to allow for getting and setting fscaps
> using the kernel representation. This requires the addition of new inode
> operations to allow overlayfs to handle fscaps properly; all other
> filesystems fall back to a generic implementation. The top-level vfs
> xattr interfaces will now reject fscaps xattrs, though the lower-level
> interfaces continue to accept them for reading and writing the raw xattr
> data.
> 
> Based on previous feedback, new security hooks are added for fscaps
> operations. These are really only needed for EVM, and the selinux and
> smack implementations just peform the same operations that the
> equivalent xattr hooks would have done. Note too that this has not yet
> been updated based on the changes to make EVM into an LSM.
> 
> The remainder of the changes are preparatory work, addition of helpers
> for converting between the xattr and kernel fscaps representation, and
> various updates to use the kernel representation and new interfaces.

I still think that the generic_{get,set,remove}_fscaps() helpers falling
back to plain *vfs_*xattr() calls is a hackish. So ideally I'd like to
see this killed in a follow-up series and make all fses that support
them use the inode operation.

> 
> I have tested this code with xfstests, ltp, libcap2, and libcap-ng with
> no regressions found.

+1

Seth Forshee (DigitalOcean) Feb. 22, 2024, 4:28 p.m. UTC | #2

On Thu, Feb 22, 2024 at 04:27:50PM +0100, Christian Brauner wrote:
> I still think that the generic_{get,set,remove}_fscaps() helpers falling
> back to plain *vfs_*xattr() calls is a hackish. So ideally I'd like to
> see this killed in a follow-up series and make all fses that support
> them use the inode operation.

Right, you brought this up last time, and I probably should have
mentioned it in the cover letter. I haven't seriously looked at doing
this yet, in large part because I got interrupted from working on this
and felt like v2 patches were long overdue (and you said you were fine
with doing it as a follow-up series anyway). But I will have a look to
see if it makes sense to change that in the next version of this series.