aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2018-06-23 18:21:38 -0400
committerBertrand Jacquin <bertrand@jacquin.bzh>2018-10-05 00:54:53 +0200
commit8c9ba0abe9c7a285328047b5e031534f0a36f305 (patch)
tree42cdf902183c53945cd9a9171bde9d490dd672dc
parentDisable CONFIG_PROCESSOR_SELECT printk()'s (diff)
downloadlinux-8c9ba0abe9c7a285328047b5e031534f0a36f305.tar.gz
This patch adds support for a restricted user-controlled namespace on
tmpfs filesystem used to house PaX flags. The namespace must be of the form user.pax.* and its value cannot exceed a size of 8 bytes. This is needed even on all Gentoo systems so that XATTR_PAX flags are preserved for users who might build packages using portage on a tmpfs system with a non-hardened kernel and then switch to a hardened kernel with XATTR_PAX enabled. The namespace is added to any user with Extended Attribute support enabled for tmpfs. Users who do not enable xattrs will not have the XATTR_PAX flags preserved.
-rw-r--r--include/uapi/linux/xattr.h4
-rw-r--r--mm/shmem.c15
2 files changed, 19 insertions, 0 deletions
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index c1395b5bd432..bac6d48eca8e 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -77,5 +77,9 @@
#define XATTR_POSIX_ACL_DEFAULT "posix_acl_default"
#define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+/* User namespace */
+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
+#define XATTR_PAX_FLAGS_SUFFIX "flags"
+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
#endif /* _UAPI_LINUX_XATTR_H */
diff --git a/mm/shmem.c b/mm/shmem.c
index 8264bbdbb6a5..9d7ed164b595 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3153,6 +3153,14 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler,
struct shmem_inode_info *info = SHMEM_I(inode);
name = xattr_full_name(handler, name);
+
+ if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+ if (strcmp(name, XATTR_NAME_PAX_FLAGS))
+ return -EOPNOTSUPP;
+ if (size > 8)
+ return -EINVAL;
+ }
+
return simple_xattr_set(&info->xattrs, name, value, size, flags);
}
@@ -3168,6 +3176,12 @@ static const struct xattr_handler shmem_trusted_xattr_handler = {
.set = shmem_xattr_handler_set,
};
+static const struct xattr_handler shmem_user_xattr_handler = {
+ .prefix = XATTR_USER_PREFIX,
+ .get = shmem_xattr_handler_get,
+ .set = shmem_xattr_handler_set,
+};
+
static const struct xattr_handler *shmem_xattr_handlers[] = {
#ifdef CONFIG_TMPFS_POSIX_ACL
&posix_acl_access_xattr_handler,
@@ -3175,6 +3189,7 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
#endif
&shmem_security_xattr_handler,
&shmem_trusted_xattr_handler,
+ &shmem_user_xattr_handler,
NULL
};