xfs
[Top] [All Lists]

Re: [PATCH 6/9] xfs: XFS_IOCTL_SETXATTR can run in user namespaces

To: Dave Chinner <david@xxxxxxxxxxxxx>
Subject: Re: [PATCH 6/9] xfs: XFS_IOCTL_SETXATTR can run in user namespaces
From: Brian Foster <bfoster@xxxxxxxxxx>
Date: Thu, 29 Jan 2015 22:04:11 -0500
Cc: xfs@xxxxxxxxxxx, iustin@xxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20150129235315.GG6282@dastard>
References: <1422328486-24661-1-git-send-email-david@xxxxxxxxxxxxx> <1422328486-24661-7-git-send-email-david@xxxxxxxxxxxxx> <20150129153515.GF17652@xxxxxxxxxxxxxx> <20150129235315.GG6282@dastard>
User-agent: Mutt/1.5.23 (2014-03-12)
On Fri, Jan 30, 2015 at 10:53:15AM +1100, Dave Chinner wrote:
> On Thu, Jan 29, 2015 at 10:35:15AM -0500, Brian Foster wrote:
> > On Tue, Jan 27, 2015 at 02:14:43PM +1100, Dave Chinner wrote:
> > > From: Dave Chinner <dchinner@xxxxxxxxxx>
> > > 
> > > Currently XFS_IOCTL_SETXATTR will fail if run in a user namespace as
> > > it it not allowed to change project IDs. The current code, however,
> > > also prevents any other change being made as well, so things like
> > > extent size hints cannot be set in user namespaces. This is wrong,
> > > so only disallow access to project IDs and related flags from inside
> > > the init namespace.
> > > 
> > > Signed-off-by: Dave Chinner <dchinner@xxxxxxxxxx>
> > > ---
> > >  fs/xfs/xfs_ioctl.c | 22 +++++++++++++---------
> > >  1 file changed, 13 insertions(+), 9 deletions(-)
> > > 
> > > diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> > > index 563d2b4..ae6e1e3 100644
> > > --- a/fs/xfs/xfs_ioctl.c
> > > +++ b/fs/xfs/xfs_ioctl.c
> > > @@ -1120,6 +1120,19 @@ xfs_ioctl_setattr(
> > >           return -EINVAL;
> > >  
> > >   /*
> > > +  * Project Quota ID state is only allowed to change from within the init
> > > +  * namespace. Enforce that restriction only if we are trying to change
> > > +  * the quota ID state. Everything else is allowed in user namespaces.
> > > +  */
> > > + if (current_user_ns() != &init_user_ns) {
> > > +         if (xfs_get_projid(ip) != fa->fsx_projid)
> > > +                 return -EINVAL;
> > > +         if ((fa->fsx_xflags & XFS_XFLAG_PROJINHERIT) ^
> > > +             (ip->i_d.di_flags & XFS_DIFLAG_PROJINHERIT))
> > 
> > Why not use != here? Looks fine, anyways:
> 
> Because ^ has an implicit cast of the variables to boolean (i.e flag
> set or not), whereas != will only work if XFS_XFLAG_PROJINHERIT =
> XFS_DIFLAG_PROJINHERIT. Given that the moment we add more DIFLAGs to
> the xfs inode, the current "XFLAG value must match DIFLAG value"
> rule is going to be broken, I think that logical evaluation is a
> much safer practice for these types of comparisons.
> 

Hrm, I'm not following how a boolean cast occurs here. Isn't ^ a bitwise
operation? If I tweak the DIFLAG_PROJINHERIT to bit 15 (rather than 9)
and regenerate assembly for the code above, I end up with something like
this:

        /* -EINVAL */
        movl    $-22, %eax      #, D.54727

        ...

        /* load up the flags vars */
        movzwl  354(%rdi), %ecx # ip_5(D)->i_d.di_flags,ip_5(D)->i_d.di_flags
        movl    (%rsi), %edx    # fa_3(D)->fsx_xflags, D.54728

        ...

        /* grab the associated bits and cmp */
        andl    $512, %edx      #, D.54728
        andl    $32768, %ecx    #, D.54728
        cmpl    %edx, %ecx      # D.54728, D.54728

        /* ret 0 if values are equal */
        movl    $0, %edx        #, tmp99
        cmove   %edx, %eax      # tmp99,, D.54727
        ret

So it seems like this breaks just the same if the bit meaning doesn't
match between fields..?

Brian

> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@xxxxxxxxxxxxx

<Prev in Thread] Current Thread [Next in Thread>