public inbox for [email protected]
 help / color / mirror / Atom feed
From: Luis Chamberlain <[email protected]>
To: Casey Schaufler <[email protected]>
Cc: Jens Axboe <[email protected]>, Paul Moore <[email protected]>,
	Kanchan Joshi <[email protected]>,
	[email protected], [email protected], [email protected],
	[email protected], [email protected], [email protected],
	[email protected], [email protected], [email protected],
	[email protected], [email protected],
	[email protected], [email protected], [email protected],
	[email protected], [email protected],
	[email protected], [email protected],
	[email protected], [email protected], [email protected],
	[email protected], [email protected],
	[email protected]
Subject: Re: [PATCH 03/17] io_uring: add infra and support for IORING_OP_URING_CMD
Date: Mon, 14 Mar 2022 12:40:12 -0700	[thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>

On Mon, Mar 14, 2022 at 11:05:41AM -0700, Casey Schaufler wrote:
> On 3/14/2022 9:32 AM, Luis Chamberlain wrote:
> > On Mon, Mar 14, 2022 at 09:25:35AM -0700, Casey Schaufler wrote:
> > > On 3/11/2022 9:11 AM, Luis Chamberlain wrote:
> > > > On Thu, Mar 10, 2022 at 07:43:04PM -0700, Jens Axboe wrote:
> > > > > On 3/10/22 6:51 PM, Luis Chamberlain wrote:
> > > > > > On Tue, Mar 08, 2022 at 08:50:51PM +0530, Kanchan Joshi wrote:
> > > > > > > From: Jens Axboe <[email protected]>
> > > > > > > 
> > > > > > > This is a file private kind of request. io_uring doesn't know what's
> > > > > > > in this command type, it's for the file_operations->async_cmd()
> > > > > > > handler to deal with.
> > > > > > > 
> > > > > > > Signed-off-by: Jens Axboe <[email protected]>
> > > > > > > Signed-off-by: Kanchan Joshi <[email protected]>
> > > > > > > ---
> > > > > > <-- snip -->
> > > > > > 
> > > > > > > +static int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags)
> > > > > > > +{
> > > > > > > +	struct file *file = req->file;
> > > > > > > +	int ret;
> > > > > > > +	struct io_uring_cmd *ioucmd = &req->uring_cmd;
> > > > > > > +
> > > > > > > +	ioucmd->flags |= issue_flags;
> > > > > > > +	ret = file->f_op->async_cmd(ioucmd);
> > > > > > I think we're going to have to add a security_file_async_cmd() check
> > > > > > before this call here. Because otherwise we're enabling to, for
> > > > > > example, bypass security_file_ioctl() for example using the new
> > > > > > iouring-cmd interface.
> > > > > > 
> > > > > > Or is this already thought out with the existing security_uring_*() stuff?
> > > > > Unless the request sets .audit_skip, it'll be included already in terms
> > > > > of logging.
> > > > Neat.
> > > > 
> > > > > But I'd prefer not to lodge this in with ioctls, unless
> > > > > we're going to be doing actual ioctls.
> > > > Oh sure, I have been an advocate to ensure folks don't conflate async_cmd
> > > > with ioctl. However it *can* enable subsystems to enable ioctl
> > > > passthrough, but each of those subsystems need to vet for this on their
> > > > own terms. I'd hate to see / hear some LSM surprises later.
> > > > 
> > > > > But definitely something to keep in mind and make sure that we're under
> > > > > the right umbrella in terms of auditing and security.
> > > > Paul, how about something like this for starters (and probably should
> > > > be squashed into this series so its not a separate commit) ?
> > > > 
> > > > >From f3ddbe822374cc1c7002bd795c1ae486d370cbd1 Mon Sep 17 00:00:00 2001
> > > > From: Luis Chamberlain <[email protected]>
> > > > Date: Fri, 11 Mar 2022 08:55:50 -0800
> > > > Subject: [PATCH] lsm,io_uring: add LSM hooks to for the new async_cmd file op
> > > > 
> > > > io-uring is extending the struct file_operations to allow a new
> > > > command which each subsystem can use to enable command passthrough.
> > > > Add an LSM specific for the command passthrough which enables LSMs
> > > > to inspect the command details.
> > > > 
> > > > Signed-off-by: Luis Chamberlain <[email protected]>
> > > > ---
> > > >    fs/io_uring.c                 | 5 +++++
> > > >    include/linux/lsm_hook_defs.h | 1 +
> > > >    include/linux/lsm_hooks.h     | 3 +++
> > > >    include/linux/security.h      | 5 +++++
> > > >    security/security.c           | 4 ++++
> > > >    5 files changed, 18 insertions(+)
> > > > 
> > > > diff --git a/fs/io_uring.c b/fs/io_uring.c
> > > > index 3f6eacc98e31..1c4e6b2cb61a 100644
> > > > --- a/fs/io_uring.c
> > > > +++ b/fs/io_uring.c
> > > > @@ -4190,6 +4190,11 @@ static int io_uring_cmd_prep(struct io_kiocb *req,
> > > >    	struct io_ring_ctx *ctx = req->ctx;
> > > >    	struct io_uring_cmd *ioucmd = &req->uring_cmd;
> > > >    	u32 ucmd_flags = READ_ONCE(sqe->uring_cmd_flags);
> > > > +	int ret;
> > > > +
> > > > +	ret = security_uring_async_cmd(ioucmd);
> > > > +	if (ret)
> > > > +		return ret;
> > > >    	if (!req->file->f_op->async_cmd)
> > > >    		return -EOPNOTSUPP;
> > > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> > > > index 819ec92dc2a8..4a20f8e6b295 100644
> > > > --- a/include/linux/lsm_hook_defs.h
> > > > +++ b/include/linux/lsm_hook_defs.h
> > > > @@ -404,4 +404,5 @@ LSM_HOOK(int, 0, perf_event_write, struct perf_event *event)
> > > >    #ifdef CONFIG_IO_URING
> > > >    LSM_HOOK(int, 0, uring_override_creds, const struct cred *new)
> > > >    LSM_HOOK(int, 0, uring_sqpoll, void)
> > > > +LSM_HOOK(int, 0, uring_async_cmd, struct io_uring_cmd *ioucmd)
> > > >    #endif /* CONFIG_IO_URING */
> > > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > > > index 3bf5c658bc44..21b18cf138c2 100644
> > > > --- a/include/linux/lsm_hooks.h
> > > > +++ b/include/linux/lsm_hooks.h
> > > > @@ -1569,6 +1569,9 @@
> > > >     *      Check whether the current task is allowed to spawn a io_uring polling
> > > >     *      thread (IORING_SETUP_SQPOLL).
> > > >     *
> > > > + * @uring_async_cmd:
> > > > + *      Check whether the file_operations async_cmd is allowed to run.
> > > > + *
> > > >     */
> > > >    union security_list_options {
> > > >    	#define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
> > > > diff --git a/include/linux/security.h b/include/linux/security.h
> > > > index 6d72772182c8..4d7f72813d75 100644
> > > > --- a/include/linux/security.h
> > > > +++ b/include/linux/security.h
> > > > @@ -2041,6 +2041,7 @@ static inline int security_perf_event_write(struct perf_event *event)
> > > >    #ifdef CONFIG_SECURITY
> > > >    extern int security_uring_override_creds(const struct cred *new);
> > > >    extern int security_uring_sqpoll(void);
> > > > +extern int security_uring_async_cmd(struct io_uring_cmd *ioucmd);
> > > >    #else
> > > >    static inline int security_uring_override_creds(const struct cred *new)
> > > >    {
> > > > @@ -2050,6 +2051,10 @@ static inline int security_uring_sqpoll(void)
> > > >    {
> > > >    	return 0;
> > > >    }
> > > > +static inline int security_uring_async_cmd(struct io_uring_cmd *ioucmd)
> > > > +{
> > > > +	return 0;
> > > > +}
> > > >    #endif /* CONFIG_SECURITY */
> > > >    #endif /* CONFIG_IO_URING */
> > > > diff --git a/security/security.c b/security/security.c
> > > > index 22261d79f333..ef96be2f953a 100644
> > > > --- a/security/security.c
> > > > +++ b/security/security.c
> > > > @@ -2640,4 +2640,8 @@ int security_uring_sqpoll(void)
> > > >    {
> > > >    	return call_int_hook(uring_sqpoll, 0);
> > > >    }
> > > > +int security_uring_async_cmd(struct io_uring_cmd *ioucmd)
> > > > +{
> > > > +	return call_int_hook(uring_async_cmd, 0, ioucmd);
> > > I don't have a good understanding of what information is in ioucmd.
> > > I am afraid that there may not be enough for a security module to
> > > make appropriate decisions in all cases. I am especially concerned
> > > about the modules that use path hooks, but based on the issues we've
> > > always had with ioctl and the like I fear for all cases.
> > As Paul pointed out, this particular LSM hook would not be needed if we can
> > somehow ensure users of the cmd path use their respective LSMs there. It
> > is not easy to force users to have the LSM hook to be used, one idea
> > might be to have a registration mechanism which allows users to also
> > specify the LSM hook, but these can vary in arguments, so perhaps then
> > what is needed is the LSM type in enum form, and internally we have a
> > mapping of these. That way we slowly itemize which cmds we *do* allow
> > for, thus vetting at the same time a respective LSM hook. Thoughts?
> 
> tl;dr - Yuck.
> 
> I don't see how your registration mechanism would be easier than
> getting "users of the cmd path" to use the LSM mechanism the way
> everyone else does. What it would do is pass responsibility for
> dealing with LSM to the io_uring core team.

Agreed, I was just trying to be proactive to help with the LSM stuff.
But indeed, that path would be complicated and I agree probably not
the most practical one.

> Experience has shown
> that dealing with the security issues after the fact is much
> harder than doing it up front, even when developers wail about
> the burden. Sure, LSM is an unpleasant interface/mechanism, but
> so is locking, and no one gets away without addressing that.
> My $0.02.

So putting the onus on those file_operations which embrace async_cmd to
take into account LSMs seems to be the way to go then, which seems to
align with what Paul was suggesting.

  Luis

  reply	other threads:[~2022-03-14 19:40 UTC|newest]

Thread overview: 122+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <CGME20220308152651epcas5p1ebd2dc7fa01db43dd587c228a3695696@epcas5p1.samsung.com>
2022-03-08 15:20 ` [PATCH 00/17] io_uring passthru over nvme Kanchan Joshi
     [not found]   ` <CGME20220308152653epcas5p10c31f58cf6bff125cc0baa176b4d4fac@epcas5p1.samsung.com>
2022-03-08 15:20     ` [PATCH 01/17] io_uring: add support for 128-byte SQEs Kanchan Joshi
     [not found]   ` <CGME20220308152655epcas5p4ae47d715e1c15069e97152dcd283fd40@epcas5p4.samsung.com>
2022-03-08 15:20     ` [PATCH 02/17] fs: add file_operations->async_cmd() Kanchan Joshi
     [not found]   ` <CGME20220308152658epcas5p3929bd1fcf75edc505fec71901158d1b5@epcas5p3.samsung.com>
2022-03-08 15:20     ` [PATCH 03/17] io_uring: add infra and support for IORING_OP_URING_CMD Kanchan Joshi
2022-03-11  1:51       ` Luis Chamberlain
2022-03-11  2:43         ` Jens Axboe
2022-03-11 17:11           ` Luis Chamberlain
2022-03-11 18:47             ` Paul Moore
2022-03-11 20:57               ` Luis Chamberlain
2022-03-11 21:03                 ` Paul Moore
2022-03-14 16:25             ` Casey Schaufler
2022-03-14 16:32               ` Luis Chamberlain
2022-03-14 18:05                 ` Casey Schaufler
2022-03-14 19:40                   ` Luis Chamberlain [this message]
     [not found]   ` <CGME20220308152700epcas5p4130d20119a3a250a2515217d6552f668@epcas5p4.samsung.com>
2022-03-08 15:20     ` [PATCH 04/17] nvme: modify nvme_alloc_request to take an additional parameter Kanchan Joshi
2022-03-11  6:38       ` Christoph Hellwig
     [not found]   ` <CGME20220308152702epcas5p1eb1880e024ac8b9531c85a82f31a4e78@epcas5p1.samsung.com>
2022-03-08 15:20     ` [PATCH 05/17] nvme: wire-up support for async-passthru on char-device Kanchan Joshi
2022-03-10  0:02       ` Clay Mayers
2022-03-10  8:32         ` Kanchan Joshi
2022-03-11  7:01       ` Christoph Hellwig
2022-03-14 16:23         ` Kanchan Joshi
2022-03-15  8:54           ` Christoph Hellwig
2022-03-16  7:27             ` Kanchan Joshi
2022-03-24  6:22               ` Christoph Hellwig
2022-03-24 17:45                 ` Kanchan Joshi
2022-03-11 17:56       ` Luis Chamberlain
2022-03-11 18:53         ` Paul Moore
2022-03-11 21:02           ` Luis Chamberlain
2022-03-13 21:53       ` Sagi Grimberg
2022-03-14 17:54         ` Kanchan Joshi
2022-03-15  9:02           ` Sagi Grimberg
2022-03-16  9:21             ` Kanchan Joshi
2022-03-16 10:56               ` Sagi Grimberg
2022-03-16 11:51                 ` Kanchan Joshi
2022-03-16 13:52                   ` Sagi Grimberg
2022-03-16 14:35                     ` Jens Axboe
2022-03-16 14:50                       ` Sagi Grimberg
2022-03-24  6:20                         ` Christoph Hellwig
2022-03-24 10:42                           ` Sagi Grimberg
2022-03-22 15:18       ` Clay Mayers
2022-03-22 16:57         ` Kanchan Joshi
     [not found]   ` <CGME20220308152704epcas5p16610e1f50672b25fa1df5f7c5c261bb5@epcas5p1.samsung.com>
2022-03-08 15:20     ` [PATCH 06/17] io_uring: prep for fixed-buffer enabled uring-cmd Kanchan Joshi
     [not found]   ` <CGME20220308152707epcas5p430127761a7fd4bf90c2501eabe9ee96e@epcas5p4.samsung.com>
2022-03-08 15:20     ` [PATCH 07/17] io_uring: add support for uring_cmd with fixed-buffer Kanchan Joshi
     [not found]   ` <CGME20220308152709epcas5p1f9d274a0214dc462c22c278a72d8697c@epcas5p1.samsung.com>
2022-03-08 15:20     ` [PATCH 08/17] nvme: enable passthrough " Kanchan Joshi
2022-03-10  8:32       ` Christoph Hellwig
2022-03-11  6:43       ` Christoph Hellwig
2022-03-14 13:06         ` Kanchan Joshi
2022-03-15  8:55           ` Christoph Hellwig
2022-03-14 12:18       ` Ming Lei
2022-03-14 13:09         ` Kanchan Joshi
     [not found]   ` <CGME20220308152711epcas5p31de5d63f5de91fae94e61e5c857c0f13@epcas5p3.samsung.com>
2022-03-08 15:20     ` [PATCH 09/17] io_uring: plug for async bypass Kanchan Joshi
2022-03-10  8:33       ` Christoph Hellwig
2022-03-14 14:33         ` Ming Lei
2022-03-15  8:56           ` Christoph Hellwig
2022-03-11 17:15       ` Luis Chamberlain
     [not found]   ` <CGME20220308152714epcas5p4c5a0d16512fd7054c9a713ee28ede492@epcas5p4.samsung.com>
2022-03-08 15:20     ` [PATCH 10/17] block: wire-up support for plugging Kanchan Joshi
2022-03-10  8:34       ` Christoph Hellwig
2022-03-10 12:40         ` Kanchan Joshi
2022-03-14 14:40           ` Ming Lei
2022-03-21  7:02             ` Kanchan Joshi
2022-03-23  1:27               ` Ming Lei
2022-03-23  1:41                 ` Jens Axboe
2022-03-23  1:58                   ` Jens Axboe
2022-03-23  2:10                     ` Ming Lei
2022-03-23  2:17                       ` Jens Axboe
     [not found]   ` <CGME20220308152716epcas5p3d38d2372c184259f1a10c969f7e4396f@epcas5p3.samsung.com>
2022-03-08 15:20     ` [PATCH 11/17] block: factor out helper for bio allocation from cache Kanchan Joshi
2022-03-10  8:35       ` Christoph Hellwig
2022-03-10 12:25         ` Kanchan Joshi
2022-03-24  6:30           ` Christoph Hellwig
2022-03-24 17:45             ` Kanchan Joshi
2022-03-25  5:38               ` Christoph Hellwig
     [not found]   ` <CGME20220308152718epcas5p3afd2c8a628f4e9733572cbb39270989d@epcas5p3.samsung.com>
2022-03-08 15:21     ` [PATCH 12/17] nvme: enable bio-cache for fixed-buffer passthru Kanchan Joshi
2022-03-11  6:48       ` Christoph Hellwig
2022-03-14 18:18         ` Kanchan Joshi
2022-03-15  8:57           ` Christoph Hellwig
     [not found]   ` <CGME20220308152720epcas5p19653942458e160714444942ddb8b8579@epcas5p1.samsung.com>
2022-03-08 15:21     ` [PATCH 13/17] nvme: allow user passthrough commands to poll Kanchan Joshi
2022-03-08 17:08       ` Keith Busch
2022-03-09  7:03         ` Kanchan Joshi
2022-03-11  6:49           ` Christoph Hellwig
     [not found]   ` <CGME20220308152723epcas5p34460b4af720e515317f88dbb78295f06@epcas5p3.samsung.com>
2022-03-08 15:21     ` [PATCH 14/17] io_uring: add polling support for uring-cmd Kanchan Joshi
2022-03-11  6:50       ` Christoph Hellwig
2022-03-14 10:16         ` Kanchan Joshi
2022-03-15  8:57           ` Christoph Hellwig
2022-03-16  5:09             ` Kanchan Joshi
2022-03-24  6:30               ` Christoph Hellwig
     [not found]   ` <CGME20220308152725epcas5p36d1ce3269a47c1c22cc0d66bdc2b9eb3@epcas5p3.samsung.com>
2022-03-08 15:21     ` [PATCH 15/17] nvme: wire-up polling for uring-passthru Kanchan Joshi
     [not found]   ` <CGME20220308152727epcas5p20e605718dd99e97c94f9232d40d04d95@epcas5p2.samsung.com>
2022-03-08 15:21     ` [PATCH 16/17] io_uring: add support for non-inline uring-cmd Kanchan Joshi
     [not found]   ` <CGME20220308152729epcas5p17e82d59c68076eb46b5ef658619d65e3@epcas5p1.samsung.com>
2022-03-08 15:21     ` [PATCH 17/17] nvme: enable non-inline passthru commands Kanchan Joshi
2022-03-10  8:36       ` Christoph Hellwig
2022-03-10 11:50         ` Kanchan Joshi
2022-03-10 14:19           ` Christoph Hellwig
2022-03-10 18:43             ` Kanchan Joshi
2022-03-11  6:27               ` Christoph Hellwig
2022-03-22 17:10                 ` Kanchan Joshi
2022-03-24  6:32                   ` Christoph Hellwig
2022-03-25 13:39                     ` Kanchan Joshi
2022-03-28  4:44                       ` Kanchan Joshi
2022-03-30 12:59                         ` Christoph Hellwig
2022-03-30 13:02                       ` Christoph Hellwig
2022-03-30 13:14                         ` Kanchan Joshi
2022-04-01  1:25                           ` Jens Axboe
2022-04-01  2:33                             ` Kanchan Joshi
2022-04-01  2:44                               ` Jens Axboe
2022-04-01  3:05                                 ` Jens Axboe
2022-04-01  6:32                                 ` Kanchan Joshi
2022-04-19 17:31                                 ` Kanchan Joshi
2022-04-19 18:19                                   ` Jens Axboe
     [not found]                                     ` <CGME20220420152003epcas5p3991e6941773690bcb425fd9d817105c3@epcas5p3.samsung.com>
2022-04-20 15:14                                       ` Kanchan Joshi
2022-04-20 15:28                                         ` Kanchan Joshi
2022-04-01  1:23                         ` Jens Axboe
2022-04-01  1:22                   ` Jens Axboe
2022-04-01  6:29                     ` Kanchan Joshi
2022-03-24 21:09       ` Clay Mayers
2022-03-24 23:36         ` Jens Axboe
2022-03-10  8:29   ` [PATCH 00/17] io_uring passthru over nvme Christoph Hellwig
2022-03-10 10:05     ` Kanchan Joshi
2022-03-11 16:43       ` Luis Chamberlain
2022-03-11 23:35         ` Adam Manzanares
2022-03-12  2:27           ` Adam Manzanares
2022-03-13  5:07             ` Kanchan Joshi
2022-03-14 20:30               ` Adam Manzanares
2022-03-13  5:10         ` Kanchan Joshi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox