Resurrect [PATCH v4 0/3] initramfs: add support for xattrs in the initial ram disk

[mimizohar]

Background: CPIO does not support extended attributes

Multiple versions of augmenting CPIO to include extended attributes were proposed, but none were upstreamed. Roberto's version was really close to being upstreamed, which stores the xattrs in an associated file [1].

[1] https://lore.kernel.org/linux-fsdevel/20190523121803.21638-1-roberto.sassu@huawei.com/

[robertosassu]

First version of the patches:

Kernel: https://github.com/linux-integrity/linux/tree/initramfs-xattr-v1-devel-v1
cpio: https://github.com/robertosassu/cpio/tree/initramfs-xattr-v1-devel-v1
dracut: https://github.com/robertosassu/dracut/tree/initramfs-xattr-v1-devel-v1

[robertosassu]

Instructions to test:

In order to switch rootfs from ramfs to tmpfs, root=, roofstype= and rootflags= must be removed from the kernel command line.

For now, edit /boot/grub2/grub.cfg and remove them manually (before, annotate them to copy in dracut later).

In order to make the system boot, move root=, rootfstype= and rootflags= parameters to dracut command line. Create a file named /etc/dracut.conf.d/00-kernel_cmdline.conf with the content:

kernel_cmdline="root=<your value> roofstype=<your value> rootflags=<your value>"

Finally, after installing the patched kernel, cpio and dracut, execute:

dracut -f -e xattr

Confirm that the xattrs are copied, by adding rd.break in the kernel command line and inspecting the xattrs (use/sysroot/usr/bin/getfattr).

[robertosassu]

I had to comment this to avoid a deadlock:

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 5149ff4fd50d..c1922fe8311a 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -796,9 +796,9 @@ static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
                        return -EINVAL;
 
-               err = validate_hash_algo(dentry, xvalue, xattr_value_len);
-               if (err)
-                       return err;
+//             err = validate_hash_algo(dentry, xvalue, xattr_value_len);
+//             if (err)
+//                     return err;

The problem is that now that the initramfs code is doing a setxattr, ima_inode_setxattr() is probing the supported kernel algorithm, which results in the same deadlock prevented by ima_kernel_module_request(). However, in this case, the latter function does not prevent it because the module requested is a hash algorithm, while the denied one is crypto-pkcs1(rsa,...