From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S947359AbcJaVzX (ORCPT ); Mon, 31 Oct 2016 17:55:23 -0400 Received: from nm11-vm5.bullet.mail.ne1.yahoo.com ([98.138.91.233]:42293 "EHLO nm11-vm5.bullet.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S947328AbcJaVzV (ORCPT ); Mon, 31 Oct 2016 17:55:21 -0400 X-Yahoo-Newman-Id: 531391.23770.bm@smtp215.mail.ne1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: rSaseNUVM1l0JZVkLuEPatqZJ7Zm6wjc.sp0FByio1ndfeF ID4e4vwJYH_tvcoHO2KQlgM.2Eujs9CZxcj1zrPE.OPuXFtZZdzGnaOFr9I9 jfiQzI.YPQLlfOpthIy2tLr_glnV9UrnDZTn8k3SvdBZf.Ha6IGEFRs5xgle xWQ.sgxUqzA8QmfeBS3foc4Asw_1K78dT98.180Hx6q8f8NOJZQc1WGfE.jY j._nsJW.7N6UYBOWkeTvHrk13CV5S_CoIv02B.cYc2CHRp6Wji2GeCXyMtH5 rARPoFXGumdZ37ZJbs09sgsIKcCkf0TucrMg2bdWwFU83aIGqJTbOcox0UN3 0ZYLt.v.zdsv_jdbq3TJ8hOBM9KKyMI5d946Qf.g37xNhRdrL0QfFMV5l2H_ rfs4ek_1V5AX8uHSBA0BFlWKs1WawTApEkWB0Q1k91WW_a74EgLQyNsAur1B 6Tj6t3rZkiigM_ny1.D4FPZMC.j1ORKAkY9leaILmSylx5vxjJP1Mkv5KDIp 4ulesTSHnxOm.y6mLgXPBAJq2d5ibo3KhMz6CeviqTu15WK487GVMitw- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- To: Andreas Gruenbacher , Al Viro From: Casey Schaufler Subject: Problem with setxattr on sockfs with Smack after 971df15bd54ad46e907046ff33750a137b2f0096 Cc: LKLM , LSM , Casey Schaufler Message-ID: Date: Mon, 31 Oct 2016 14:55:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Smack has always used extended attributes to identify the security information used to make access control decisions on packet delivery. The two attributes security.SMACK64_IPIN and security.SMACK64_IPOUT contain the label used for inbound and outbound checks respectively. A process with CAP_MAC_ADMIN can change these values using fsetxattr() to allow a privileged service to communicate more openly than is allowed under the strict Smack policy. After the xattr rework the fsetxattr() call still sets the Smack attribute correctly, because the smack_inode_setxattr() hook is still getting called, but it returns EOPNOTSUPP. I believe that this is either a result of the attribute name being unknown to sockfs (as mentioned in the commit message) or one of the other changes made in the process of the xattr rework. I haven't finished the bisect yet, but I'm reasonably certain the issue arises here. Should I add the Smack attributes to the list of attributes sockfs acknowledges? Is there a better approach? Thank you.