[PATCH v2 00/25] fs: use type-safe uid representation for filesystem capabilities

Wed Feb 21 21:24:31 UTC 2024

This series converts filesystem capabilities from passing around raw
xattr data to using a kernel-internal representation with type safe
uids, similar to the conversion done previously for posix ACLs.
Currently fscaps representations in the kernel have two different
instances of unclear or confused types:

- fscaps are generally passed around in the raw xattr form, with the
  rootid sometimes containing the user uid value and at other times
  containing the filesystem value.
- The existing kernel-internal representation of fscaps,
  cpu_vfs_cap_data, uses the kuid_t type, but the value stored is
  actually a vfsuid.

This series eliminates this confusion by converting the xattr data to
the kernel representation near the userspace and filesystem boundaries,
using the kernel representation within the vfs and commoncap code. The
internal representation is renamed to vfs_caps to reflect this broader
use, and the rootid is changed to a vfsuid_t to correctly identify the
type of uid which it contains.

New vfs interfaces are added to allow for getting and setting fscaps
using the kernel representation. This requires the addition of new inode
operations to allow overlayfs to handle fscaps properly; all other
filesystems fall back to a generic implementation. The top-level vfs
xattr interfaces will now reject fscaps xattrs, though the lower-level
interfaces continue to accept them for reading and writing the raw xattr
data.

Based on previous feedback, new security hooks are added for fscaps
operations. These are really only needed for EVM, and the selinux and
smack implementations just peform the same operations that the
equivalent xattr hooks would have done. Note too that this has not yet
been updated based on the changes to make EVM into an LSM.

The remainder of the changes are preparatory work, addition of helpers
for converting between the xattr and kernel fscaps representation, and
various updates to use the kernel representation and new interfaces.

I have tested this code with xfstests, ltp, libcap2, and libcap-ng with
no regressions found.

To: Christian Brauner <brauner at kernel.org>
To: Serge Hallyn <serge at hallyn.com>
To: Paul Moore <paul at paul-moore.com>
To: Eric Paris <eparis at redhat.com>
To: James Morris <jmorris at namei.org>
To: Alexander Viro <viro at zeniv.linux.org.uk>
To: Miklos Szeredi <miklos at szeredi.hu>
To: Amir Goldstein <amir73il at gmail.com>
Cc:  <linux-kernel at vger.kernel.org>
Cc:  <linux-fsdevel at vger.kernel.org>
Cc:  <linux-security-module at vger.kernel.org>
Cc:  <audit at vger.kernel.org>
Cc:  <linux-unionfs at vger.kernel.org>
Signed-off-by: Seth Forshee (DigitalOcean) <sforshee at kernel.org>

--- Changes in v2:
- Documented new inode operations in
  Documentation/filesystems/{vfs,locking}.rst.
- Changed types for sizes in function arguments and return values to
  size_t/ssize_t.
- Renamed flags arguments to setxattr_flags for clarity.
- Removed memory allocation when reading fscaps xattrs.
- Updated get_vfs_caps_from_disk() to use vfs_get_fscaps() and updated
  comments to explain how these functions are different.
- Updates/fixes to kernel-doc comments.
- Remove unnecessary type cast.
- Rename __vfs_{get,remove}_fscaps() to vfs_{get,remove}_fscaps_nosec().
- Add missing fsnotify_xattr() call in vfs_set_fscaps().
- Add fscaps security hooks along with appropriate handlers in selinux,
  smack, and evm.
- Remove remove_fscaps inode op in favor of passing NULL to set_fscaps.
- Added static asserts for compatibility of vfs_cap_data and
  vfs_ns_cap_data.
- ovl: remove unnecessary check around ovl_copy_up(), and add check
  before copyint up fscaps for removal that the fscaps actually exist on
  the lower inode.
- ovl: install fscaps handlers for all inode types
- Add is_fscaps_xattr() helper and use it in place of open-coded strcmps
- Link to v1: https://lore.kernel.org/r/20231129-idmap-fscap-refactor-v1-0-da5a26058a5b@kernel.org

---
Seth Forshee (DigitalOcean) (25):
      mnt_idmapping: split out core vfs[ug]id_t definitions into vfsid.h
      mnt_idmapping: include cred.h
      capability: add static asserts for comapatibility of vfs_cap_data and vfs_ns_cap_data
      capability: rename cpu_vfs_cap_data to vfs_caps
      capability: use vfsuid_t for vfs_caps rootids
      capability: provide helpers for converting between xattrs and vfs_caps
      capability: provide a helper for converting vfs_caps to xattr for userspace
      xattr: add is_fscaps_xattr() helper
      commoncap: use is_fscaps_xattr()
      xattr: use is_fscaps_xattr()
      security: add hooks for set/get/remove of fscaps
      selinux: add hooks for fscaps operations
      smack: add hooks for fscaps operations
      evm: add support for fscaps security hooks
      security: call evm fscaps hooks from generic security hooks
      fs: add inode operations to get/set/remove fscaps
      fs: add vfs_get_fscaps()
      fs: add vfs_set_fscaps()
      fs: add vfs_remove_fscaps()
      ovl: add fscaps handlers
      ovl: use vfs_{get,set}_fscaps() for copy-up
      fs: use vfs interfaces for capabilities xattrs
      commoncap: remove cap_inode_getsecurity()
      commoncap: use vfs fscaps interfaces
      vfs: return -EOPNOTSUPP for fscaps from vfs_*xattr()

 Documentation/filesystems/locking.rst |   4 +
 Documentation/filesystems/vfs.rst     |  17 ++
 MAINTAINERS                           |   1 +
 fs/overlayfs/copy_up.c                |  72 ++---
 fs/overlayfs/dir.c                    |   2 +
 fs/overlayfs/inode.c                  |  72 +++++
 fs/overlayfs/overlayfs.h              |   5 +
 fs/xattr.c                            | 280 +++++++++++++++++-
 include/linux/capability.h            |  23 +-
 include/linux/evm.h                   |  39 +++
 include/linux/fs.h                    |  12 +
 include/linux/lsm_hook_defs.h         |   7 +
 include/linux/mnt_idmapping.h         |  67 +----
 include/linux/security.h              |  38 ++-
 include/linux/vfsid.h                 |  74 +++++
 include/linux/xattr.h                 |   5 +
 include/uapi/linux/capability.h       |  13 +
 kernel/auditsc.c                      |   9 +-
 security/commoncap.c                  | 529 ++++++++++++++++++----------------
 security/integrity/evm/evm_main.c     |  60 ++++
 security/security.c                   |  80 +++++
 security/selinux/hooks.c              |  26 ++
 security/smack/smack_lsm.c            |  71 +++++
 23 files changed, 1144 insertions(+), 362 deletions(-)
---
base-commit: 841c35169323cd833294798e58b9bf63fa4fa1de
change-id: 20230512-idmap-fscap-refactor-63b61fa0a36f

Best regards,
-- 
Seth Forshee (DigitalOcean) <sforshee at kernel.org>