diff mbox series

[RFC,v12,12/20] dm verity: set DM_TARGET_SINGLETON feature flag

Message ID 1706654228-17180-13-git-send-email-wufan@linux.microsoft.com
State New
Headers
Series Integrity Policy Enforcement LSM (IPE) |

Commit Message

Fan Wu Jan. 30, 2024, 10:37 p.m. UTC 
  The device-mapper has a flag to mark targets as singleton, which is a
required flag for immutable targets. Without this flag, multiple
dm-verity targets can be added to a mapped device, which has no
practical use cases and will let dm_table_get_immutable_target return
NULL. This patch adds the missing flag, restricting only one
dm-verity target per mapped device.

Signed-off-by: Fan Wu <wufan@linux.microsoft.com>

---
v1-v10:
  + Not present

v11:
  + Introduced

v12:
  + No changes
---
 drivers/md/dm-verity-target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Mike Snitzer Feb. 2, 2024, 6:51 p.m. UTC | #1 
On Tue, Jan 30 2024 at  5:37P -0500,
Fan Wu <wufan@linux.microsoft.com> wrote:

> The device-mapper has a flag to mark targets as singleton, which is a
> required flag for immutable targets. Without this flag, multiple
> dm-verity targets can be added to a mapped device, which has no
> practical use cases and will let dm_table_get_immutable_target return
> NULL. This patch adds the missing flag, restricting only one
> dm-verity target per mapped device.
> 
> Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
> 
> ---
> v1-v10:
>   + Not present
> 
> v11:
>   + Introduced
> 
> v12:
>   + No changes
> ---
>  drivers/md/dm-verity-target.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
> index 14e58ae70521..66a850c02be4 100644
> --- a/drivers/md/dm-verity-target.c
> +++ b/drivers/md/dm-verity-target.c
> @@ -1507,7 +1507,7 @@ int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i
>  
>  static struct target_type verity_target = {
>  	.name		= "verity",
> -	.features	= DM_TARGET_IMMUTABLE,
> +	.features	= DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
>  	.version	= {1, 9, 0},
>  	.module		= THIS_MODULE,
>  	.ctr		= verity_ctr,
> -- 
> 2.43.0
> 
> 

It is true this change will cause dm_table_get_immutable_target() to
not return NULL, but: I'm curious how that is meaningful in the
context of dm-verity? (given the only caller of
dm_table_get_immutable_target() is request-based DM code in DM core.)

Thanks,
Mike
Fan Wu Feb. 3, 2024, 3:56 a.m. UTC | #2 
On 2/2/2024 10:51 AM, Mike Snitzer wrote:
> On Tue, Jan 30 2024 at  5:37P -0500,
> Fan Wu <wufan@linux.microsoft.com> wrote:
> 
>> The device-mapper has a flag to mark targets as singleton, which is a
>> required flag for immutable targets. Without this flag, multiple
>> dm-verity targets can be added to a mapped device, which has no
>> practical use cases and will let dm_table_get_immutable_target return
>> NULL. This patch adds the missing flag, restricting only one
>> dm-verity target per mapped device.
>>
>> Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
>>
>> ---
>> v1-v10:
>>    + Not present
>>
>> v11:
>>    + Introduced
>>
>> v12:
>>    + No changes
>> ---
>>   drivers/md/dm-verity-target.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
>> index 14e58ae70521..66a850c02be4 100644
>> --- a/drivers/md/dm-verity-target.c
>> +++ b/drivers/md/dm-verity-target.c
>> @@ -1507,7 +1507,7 @@ int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i
>>   
>>   static struct target_type verity_target = {
>>   	.name		= "verity",
>> -	.features	= DM_TARGET_IMMUTABLE,
>> +	.features	= DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
>>   	.version	= {1, 9, 0},
>>   	.module		= THIS_MODULE,
>>   	.ctr		= verity_ctr,
>> -- 
>> 2.43.0
>>
>>
> 
> It is true this change will cause dm_table_get_immutable_target() to
> not return NULL, but: I'm curious how that is meaningful in the
> context of dm-verity? (given the only caller of
> dm_table_get_immutable_target() is request-based DM code in DM core.)
> 
> Thanks,
> Mike

Sorry for the confusion. The reference of 
dm_table_get_immutable_target() is only to justify an immutable target 
should also be a 
singleton(https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/md/dm-table.c#n982). 
It is not directly related to dm-verity.

In the context of dm-verity. I found although veritysetup does ensure 
the dm-verity target as a singleton, users can still use dmsetup to 
configure multiple dm-verity targets within a single map table. This 
leads to a situation where only the first target can be accessed. 
Therefore to prevent this and similar misuse, I propose introducing 
DM_TARGET_SINGLETON to allow the kernel to enforce dm-verity targets as 
singletons.

Thanks,
Fan
diff mbox series

Patch

diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 14e58ae70521..66a850c02be4 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -1507,7 +1507,7 @@  int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i
 
 static struct target_type verity_target = {
 	.name		= "verity",
-	.features	= DM_TARGET_IMMUTABLE,
+	.features	= DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
 	.version	= {1, 9, 0},
 	.module		= THIS_MODULE,
 	.ctr		= verity_ctr,