Hello Nayna,
On 22/11/09 03:10PM, Nayna wrote:
On 11/9/22 08:46, Greg Kroah-Hartman wrote:I am also curious to know on why not use securityfs, given the similarity
On Sun, Nov 06, 2022 at 04:07:42PM -0500, Nayna Jain wrote:
securityfs is meant for Linux security subsystems to expose policies/logsWhy not juset use securityfs in /sys/security/firmware/ instead? Then
or any other information. However, there are various firmware security
features which expose their variables for user management via the kernel.
There is currently no single place to expose these variables. Different
platforms use sysfs/platform specific filesystem(efivarfs)/securityfs
interface as they find it appropriate. Thus, there is a gap in kernel
interfaces to expose variables for security features.
Define a firmware security filesystem (fwsecurityfs) to be used by
security features enabled by the firmware. These variables are platform
specific. This filesystem provides platforms a way to implement their
own underlying semantics by defining own inode and file operations.
Similar to securityfs, the firmware security filesystem is recommended
to be exposed on a well known mount point /sys/firmware/security.
Platforms can define their own directory or file structure under this path.
Example:
# mount -t fwsecurityfs fwsecurityfs /sys/firmware/security
you don't have to create a new filesystem and convince userspace to
mount it in a specific location?
between the two. :)
More specifics on that below...
From man 5 sysfs page:That's ok. As I see it users of securityfs can define their own fileops
/sys/firmware: This subdirectory contains interfaces for viewing and
manipulating firmware-specific objects and attributes.
/sys/kernel: This subdirectory contains various files and subdirectories
that provide information about the running kernel.
The security variables which are being exposed via fwsecurityfs are managed
by firmware, stored in firmware managed space and also often consumed by
firmware for enabling various security features.
(like how you are doing in fwsecurityfs).
See securityfs_create_file() & securityfs_create_symlink(), can accept the fops
& iops. Except maybe securityfs_create_dir(), that could be since there might
not be a usecase for it. But do you also need it in your case is the question to
ask.
From git commit b67dbf9d4c1987c370fd18fdc4cf9d8aaea604c2, the purpose ofWhich was then seperated out by commit,
securityfs(/sys/kernel/security) is to provide a common place for all kernel
LSMs. The idea of
da31894ed7b654e2 ("securityfs: do not depend on CONFIG_SECURITY").
securityfs now has a seperate CONFIG_SECURITYFS config option. In fact I was even
thinking of why shouldn't we move security/inode.c into fs/securityfs/inode.c .
fs/* is a common place for all filesystems. Users of securityfs can call it's
exported kernel APIs to create files/dirs/symlinks.
If we move security/inode.c to fs/security/inode.c, then...
...below call within securityfs_init() should be moved into some lsm sepecific
file.
#ifdef CONFIG_SECURITY
static struct dentry *lsm_dentry;
static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
loff_t *ppos)
{
return simple_read_from_buffer(buf, count, ppos, lsm_names,
strlen(lsm_names));
}
static const struct file_operations lsm_ops = {
.read = lsm_read,
.llseek = generic_file_llseek,
};
#endif
securityfs_init()
#ifdef CONFIG_SECURITY
lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
&lsm_ops);
#endif
So why not move it? Maybe others, can comment more on whether it's a good idea
to move security/inode.c into fs/security/inode.c?
This should then help others identify securityfs filesystem in fs/security/
for everyone to notice and utilize for their use?
fwsecurityfs(/sys/firmware/security) is to similarly provide a common placeWe can also think of it this way that, all security related exports should
for all firmware security objects.
/sys/firmware already exists. The patch now defines a new /security
directory in it for firmware security features. Using /sys/kernel/security
would mean scattering firmware objects in multiple places and confusing the
purpose of /sys/kernel and /sys/firmware.
happen via /sys/kernel/security/. Then /sys/kernel/security/firmware/ becomes
the security related firmware exports.
If you see find /sys -iname firmware, I am sure you will find other firmware
specifics directories related to other specific subsystems
(e.g.
root@qemu:/home/qemu# find /sys -iname firmware
/sys/devices/ndbus0/nmem0/firmware
/sys/devices/ndbus0/firmware
/sys/firmware
)
But it could be, I am not an expert here, although I was thinking a good
Documentation might solve this problem.
Even though fwsecurityfs code is based on securityfs, since the twoSorry could you please elaborate how? both securityfs & fwsecurityfs
filesystems expose different types of objects and have different
requirements, there are distinctions:
1. fwsecurityfs lets users create files in userspace, securityfs only allows
kernel subsystems to create files.
calls simple_fill_super() which uses the same inode (i_op) and inode file
operations (i_fop) from fs/libfs.c for their root inode. So how it is enabling
user (as in userspace) to create a file in this filesystem?
So am I missing anything?
2. firmware and kernel objects may have different requirements. For example,It "currently" doesn't need it. But can it in future? Then why not go with
consideration of namespacing. As per my understanding, namespacing is
applied to kernel resources and not firmware resources. That's why it makes
sense to add support for namespacing in securityfs, but we concluded that
fwsecurityfs currently doesn't need it. Another but similar example of it
securityfs which has an additional namespacing feature available?
That's actually also the point of utilizing an existing FS which can get
features like this in future. As long as it doesn't affect the functionality
of your use case, we simply need not reject securityfs, no?