Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 432434

Summary: sys-kernel/hardened-sources: tmpfs does not support user space xttars
Product: Gentoo Linux Reporter: Anthony Basile <blueness>
Component: [OLD] Core systemAssignee: Anthony Basile <blueness>
Status: RESOLVED FIXED    
Severity: normal CC: alexander, genkernel, kernel, nikoli, pageexec, spender
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 427888    
Attachments: Add user namespace to tmpfs xattr

Description Anthony Basile gentoo-dev 2012-08-23 14:22:57 UTC
While tmpfs filesystem does support trusted.* and security.* namespaces, it does not support user.*.  The latter is needed for xattr pax support on a gentoo system.
Comment 1 Anthony Basile gentoo-dev 2012-08-23 14:23:50 UTC
I'm going to start working on a patch, but it could usefully go into all gentoo kernels and should probably be pushed upstream.
Comment 2 Sebastian Pipping gentoo-dev 2012-08-24 18:11:13 UTC
(In reply to comment #1)
> I'm going to start working on a patch, but it could usefully go into all
> gentoo kernels and should probably be pushed upstream.

Sounds great (really), but please do not patch this in Gentoo before upstream has at least acked (if not made a released including that) patch.
Comment 3 Anthony Basile gentoo-dev 2012-08-24 20:57:04 UTC
(In reply to comment #2)
> (In reply to comment #1)
> > I'm going to start working on a patch, but it could usefully go into all
> > gentoo kernels and should probably be pushed upstream.
> 
> Sounds great (really), but please do not patch this in Gentoo before
> upstream has at least acked (if not made a released including that) patch.

I'm going to get it reviewed by pipacs and spender for sure, the authors of the grsecurity patches.  Now that I think about it, it might make more sense as part of that patchsets since it is for xattr based pax.
Comment 4 PaX Team 2012-09-18 09:10:04 UTC
(In reply to comment #3)
> I'm going to get it reviewed by pipacs and spender for sure, the authors of
> the grsecurity patches.  Now that I think about it, it might make more sense
> as part of that patchsets since it is for xattr based pax.

i think Sebastian meant lkml and not us as upstream ;), something i also agree with (and of course i'll help with the code if you have questions, just keep in mind that i'm not really a filesystem guy). you may also want to talk to Eric Paris and Miklos Szeredi who wrote the original tmpfs xattr patch.
Comment 5 Anthony Basile gentoo-dev 2012-09-18 12:30:16 UTC
(In reply to comment #4)
> (In reply to comment #3)
> > I'm going to get it reviewed by pipacs and spender for sure, the authors of
> > the grsecurity patches.  Now that I think about it, it might make more sense
> > as part of that patchsets since it is for xattr based pax.
> 
> i think Sebastian meant lkml and not us as upstream ;), something i also
> agree with (and of course i'll help with the code if you have questions,
> just keep in mind that i'm not really a filesystem guy). you may also want
> to talk to Eric Paris and Miklos Szeredi who wrote the original tmpfs xattr
> patch.

It doesn't hurt to email them, but I'm not sure anyone outside the PaX community is intersted.  That's why I just assumed include it in the grsec patches.
Comment 6 Anthony Basile gentoo-dev 2012-11-09 12:35:59 UTC
Created attachment 329006 [details]
Add user namespace to tmpfs xattr

This simple patch is really all you need, ie. just accept XATTR_USER_PREFIX in shmem_xattr_validate().  The hard part was convincing myself that this is all you need.

Can people look at it and test before I upstream it.  I'll also email Paris and Szeredi to look.  Even if its right, upstream may not want user namespace on xattrs for other reasons, whereas we do.  As long as its correct, I'm happy to start including it in hardened-sources.
Comment 7 iGentoo 2012-11-14 05:15:22 UTC
XATTR_USER_PREFIX namespace is too large.
Could you use a smaller one? Ex: XATTR_PAX_PREFIX...
Comment 8 PaX Team 2012-11-14 11:17:32 UTC
(In reply to comment #7)
> XATTR_USER_PREFIX namespace is too large.

too large for what? ;)

> Could you use a smaller one? Ex: XATTR_PAX_PREFIX...

what for? the user namespace was created for storing user tweakable attrs, a perfect match for the PaX flags. also creating an entirely new top level namespace requires way too many changes everywhere for zero gain.
Comment 9 Anthony Basile gentoo-dev 2012-11-14 11:42:09 UTC
This patch is now in the tree for testing.  Note 2.6.32.x will not have XATTR_PAX support unless someone wants to backport that machinary.  I think we'll drop in Gentoo.

*hardened-sources-3.6.6-r1 (14 Nov 2012)

  14 Nov 2012; Anthony G. Basile <blueness@gentoo.org>
  +hardened-sources-3.6.6-r1.ebuild:
  vanilla-3.6.6 + genpatches-3.6-8 + grsecurity-2.9.1-3.6.6-201211122213, adds
  user namespace xttars on tmpfs, bug #432434

*hardened-sources-3.2.33-r2 (14 Nov 2012)

  14 Nov 2012; Anthony G. Basile <blueness@gentoo.org>
  +hardened-sources-3.2.33-r2.ebuild:
  vanilla-3.2.33 + genpatches-3.2-16 + grsecurity-2.9.1-3.2.33-201211122213,
  adds user namespace xttars on tmpfs, bug #432434
Comment 10 PaX Team 2012-11-18 02:52:08 UTC
FYI, i put this into the latest PaX now with a slightly changed logic, only user.pax.flags is allowed and is limited to 8 bytes only and i'll wait for upstream to implement the generic user namespace support on tmpfs (the hard part is to limit the amount of kernel memory that users can have the kernel allocate).
Comment 11 Anthony Basile gentoo-dev 2012-12-29 22:16:53 UTC
As of >=hardened-sources-3.7.1 and >=hardened-sources-3.2.35-r1, this is fixed.