Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-31 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > On Fri, Jan 29, 2021 at 04:55:29PM -0600, Eric W. Biederman wrote: >> "Serge E. Hallyn" writes: >> >> > On Thu, Jan 28, 2021 at 02:19:13PM -0600, Eric W. Biederman wrote: >> >> "Serge E. Hallyn" writes: >> >> >> >> > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-30 Thread Serge E. Hallyn
On Fri, Jan 29, 2021 at 04:55:29PM -0600, Eric W. Biederman wrote: > "Serge E. Hallyn" writes: > > > On Thu, Jan 28, 2021 at 02:19:13PM -0600, Eric W. Biederman wrote: > >> "Serge E. Hallyn" writes: > >> > >> > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederman wrote: > >> >> Miklos Sz

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-29 Thread Serge E. Hallyn
On Fri, Jan 29, 2021 at 05:11:53PM -0600, Eric W. Biederman wrote: > "Serge E. Hallyn" writes: > > > On Thu, Jan 28, 2021 at 08:44:26PM +0100, Miklos Szeredi wrote: > >> On Thu, Jan 28, 2021 at 6:09 PM Serge E. Hallyn wrote: > >> > > >> > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederm

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-29 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > On Thu, Jan 28, 2021 at 08:44:26PM +0100, Miklos Szeredi wrote: >> On Thu, Jan 28, 2021 at 6:09 PM Serge E. Hallyn wrote: >> > >> > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederman wrote: >> > > Miklos Szeredi writes: >> > > >> > > > if (!rootid_owns_c

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-29 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > On Thu, Jan 28, 2021 at 02:19:13PM -0600, Eric W. Biederman wrote: >> "Serge E. Hallyn" writes: >> >> > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederman wrote: >> >> Miklos Szeredi writes: >> >> >> >> > If a capability is stored on disk in v2 format cap_

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-28 Thread Eric W. Biederman
Miklos Szeredi writes: > On Thu, Jan 28, 2021 at 9:24 PM Eric W. Biederman > wrote: > >> >> From our previous discussions I would also argue it would be good >> if there was a bypass that skipped all conversions if the reader >> and the filesystem are in the same user namespace. >> > > That's

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-28 Thread Miklos Szeredi
On Thu, Jan 28, 2021 at 9:24 PM Eric W. Biederman wrote: > > From our previous discussions I would also argue it would be good > if there was a bypass that skipped all conversions if the reader > and the filesystem are in the same user namespace. > That's however just an optimization (AFAICS)

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-28 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederman wrote: >> Miklos Szeredi writes: >> >> > If a capability is stored on disk in v2 format cap_inode_getsecurity() will >> > currently return in v2 format unconditionally. >> > >> > This is wrong: v2 cap should

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-28 Thread Serge E. Hallyn
On Tue, Jan 19, 2021 at 07:34:49PM -0600, Eric W. Biederman wrote: > Miklos Szeredi writes: > > > If a capability is stored on disk in v2 format cap_inode_getsecurity() will > > currently return in v2 format unconditionally. > > > > This is wrong: v2 cap should be equivalent to a v3 cap with zero

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-20 Thread kernel test robot
Hi Miklos, I love your patch! Perhaps something to improve: [auto build test WARNING on security/next-testing] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch]

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-20 Thread kernel test robot
Hi Miklos, I love your patch! Perhaps something to improve: [auto build test WARNING on security/next-testing] [also build test WARNING on linux/master linus/master v5.11-rc4 next-20210120] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we sugge

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-20 Thread Miklos Szeredi
On Wed, Jan 20, 2021 at 2:39 AM Eric W. Biederman wrote: > > Miklos Szeredi writes: > > > If a capability is stored on disk in v2 format cap_inode_getsecurity() will > > currently return in v2 format unconditionally. > > > > This is wrong: v2 cap should be equivalent to a v3 cap with zero rootid,

Re: [PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-19 Thread Eric W. Biederman
Miklos Szeredi writes: > If a capability is stored on disk in v2 format cap_inode_getsecurity() will > currently return in v2 format unconditionally. > > This is wrong: v2 cap should be equivalent to a v3 cap with zero rootid, > and so the same conversions performed on it. > > If the rootid canno

[PATCH 2/2] security.capability: fix conversions on getxattr

2021-01-19 Thread Miklos Szeredi
If a capability is stored on disk in v2 format cap_inode_getsecurity() will currently return in v2 format unconditionally. This is wrong: v2 cap should be equivalent to a v3 cap with zero rootid, and so the same conversions performed on it. If the rootid cannot be mapped v3 is returned unconverte