From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f172.google.com (mail-oi1-f172.google.com [209.85.167.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86A4471 for ; Wed, 16 Jun 2021 05:15:27 +0000 (UTC) Received: by mail-oi1-f172.google.com with SMTP id u11so1257750oiv.1 for ; Tue, 15 Jun 2021 22:15:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=akhpjntg7HyXXTFsNY4Qr1MazMZPbD3dXpnqhhn5BUY=; b=LYTslNfz90SayNkSwh+aMWF4VQJQfLD+hSYDcZuM7HPJ9fi6vsX5kN8yRX5fmjBMsC e9qtWGnSxLM0WnXEWU/THFM7nC2hkJrVe0Pxxw62WN/ostoSetbupq2FktWYhE2ymDwF AB99NvDbGvE0TdekPuhafC1GsceSJBp8yDVeti+lyXu8gwi6885Nt44RcZ4gK/SoGD/I sVT2hIs3ax8c5IsZmjaXE0udFsWpFY4BVcIer0n0PyyYqwf/NlKS7AbaFsPQlZQChu87 O2Ji38ENQAU6PAbYtiyq6F1Cpx/ePJxY2i78VD+3UXbcFQgkIRAih6XLD1QUuMWfNwRL x0WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=akhpjntg7HyXXTFsNY4Qr1MazMZPbD3dXpnqhhn5BUY=; b=aP8RnysMJm1UrsrcqUP1Yt04/gxuYED8MpdoY0HxWCHkphUZyyaxKDPyzC6IR4TYQ4 KweRtJz4aiEX8fUqK5kKBaNFSiVDTejnhQNNIKnlJ4RzdmHedOuHbuw3gHJT4mEJsBE7 h6FlYXlzHOCqD/MrkuN/CC0+PsrR16hRPkBK4CL8ZoBstVqDfqVzPgMh7hdFcg8dZVlM 3HPWkvSF0bu4D+k92yKqkEWA0odthaWigtkS4+0pJ3gaUI3oKQGUZgWwvlSUfu9d0Y4L vhx+/ZVQ0KVIAP+0C6UrE9SoCRS6HgvwWCgeD55V7AAXDGFCN5Z3f7EjRU2pUhdWu54b mOmg== X-Gm-Message-State: AOAM530Qy4sYzXDtBOQSbUNt8BvfLDnnj5LPvC4oJuNCoGD1d9sZ2T/E uNlxA7/qF3pxlecvF9Tk7INDVOloQN9SyOxME3M= X-Google-Smtp-Source: ABdhPJz97d0gBuc+KpSED/behXJGVK0sxSohj7YjwUIIBCTpxjpt91hF8NiKTiW2ylqBXwIj0lB3qMZ6IzVGmAZC4Qs= X-Received: by 2002:aca:ab15:: with SMTP id u21mr5811888oie.50.1623820526635; Tue, 15 Jun 2021 22:15:26 -0700 (PDT) X-Mailing-List: regressions@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Received: by 2002:a9d:f03:0:0:0:0:0 with HTTP; Tue, 15 Jun 2021 22:15:25 -0700 (PDT) In-Reply-To: References: <20210608171221.276899-1-keescook@chromium.org> <20210614100234.12077-1-youling257@gmail.com> <202106140826.7912F27CD@keescook> <202106140941.7CE5AE64@keescook> <202106141503.B3144DFE@keescook> From: youling 257 Date: Wed, 16 Jun 2021 13:15:25 +0800 Message-ID: Subject: Re: [PATCH] proc: Track /proc/$pid/attr/ opener mm_struct To: Linus Torvalds Cc: Kees Cook , Christian Brauner , Andrea Righi , Linux Kernel Mailing List , stable , regressions@lists.linux.dev, LSM List , Paul Moore , Stephen Smalley , SElinux list Content-Type: text/plain; charset="UTF-8" I test "proc: only require mm_struct for writing" fixed my cm14.1 problem. 2021-06-16 2:19 GMT+08:00, Linus Torvalds : > On Mon, Jun 14, 2021 at 6:55 PM youling 257 wrote: >> >> if try to find problem on userspace, i used linux 5.13rc6 on old >> android 7 cm14.1, not aosp android 11. >> http://git.osdn.net/view?p=android-x86/system-core.git;a=blob;f=init/service.cpp;h=a5334f447fc2fc34453d2f6a37523bedccadc690;hb=refs/heads/cm-14.1-x86#l457 >> >> 457 if (!seclabel_.empty()) { >> 458 if (setexeccon(seclabel_.c_str()) < 0) { >> 459 ERROR("cannot setexeccon('%s'): %s\n", >> 460 seclabel_.c_str(), strerror(errno)); >> 461 _exit(127); >> 462 } >> 463 } > > I have no idea where the cm14.1 libraries are. Does anybody know where > the matching source code for setexeccon() would be? > > For me - obviously not on cm14.1 - all "setexeccon()" does is > > n = openat(AT_FDCWD, "/proc/thread-self/attr/exec", O_RDWR|O_CLOEXEC) > write(n, string, len) > close(n) > > and if that fails, it would seem to indicate that proc_mem_open() > failed. Which would be mm_access() failing. But I don't see how that > can be the case, because mm_access() explicitly allows "mm == > current->mm" (which the above clearly should be). > > youling, can you double-check with the current -git tree? But as far > as I can tell, my minimal patch is exactly the same as Kees' patch > (just smaller and simpler). > > Kees, do you see anything? > > Linus > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E0CAC49361 for ; Wed, 16 Jun 2021 05:15:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ED355613B9 for ; Wed, 16 Jun 2021 05:15:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231185AbhFPFRe (ORCPT ); Wed, 16 Jun 2021 01:17:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40640 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229476AbhFPFRd (ORCPT ); Wed, 16 Jun 2021 01:17:33 -0400 Received: from mail-oi1-x22f.google.com (mail-oi1-x22f.google.com [IPv6:2607:f8b0:4864:20::22f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E684C061574; Tue, 15 Jun 2021 22:15:27 -0700 (PDT) Received: by mail-oi1-x22f.google.com with SMTP id d19so1221656oic.7; Tue, 15 Jun 2021 22:15:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=akhpjntg7HyXXTFsNY4Qr1MazMZPbD3dXpnqhhn5BUY=; b=LYTslNfz90SayNkSwh+aMWF4VQJQfLD+hSYDcZuM7HPJ9fi6vsX5kN8yRX5fmjBMsC e9qtWGnSxLM0WnXEWU/THFM7nC2hkJrVe0Pxxw62WN/ostoSetbupq2FktWYhE2ymDwF AB99NvDbGvE0TdekPuhafC1GsceSJBp8yDVeti+lyXu8gwi6885Nt44RcZ4gK/SoGD/I sVT2hIs3ax8c5IsZmjaXE0udFsWpFY4BVcIer0n0PyyYqwf/NlKS7AbaFsPQlZQChu87 O2Ji38ENQAU6PAbYtiyq6F1Cpx/ePJxY2i78VD+3UXbcFQgkIRAih6XLD1QUuMWfNwRL x0WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=akhpjntg7HyXXTFsNY4Qr1MazMZPbD3dXpnqhhn5BUY=; b=EXrCLh/4LDnUwH8kRHGwkNoo2ktWk2n9TFkpPAITP1qaZH4vjH2NBGB0ko7+UMp31F NSHWWR0Q0TXBC++unftXq0KkwvojcUx4Slh0XYCPzPOQXuBDNjsc2HghaeJ02FCPJttJ WPBIjGvUo8S+bnsla/IsTsbo03HK6hkhvq1oV0LgDYK6idh9kaR764XZZUoyWuA6Shzd Vk7rCC2fwajlvanLnn9jnrqYKfDeXXtbfxOUeWIvZxKZAuoGrhe4DObaqVw8K6SyKvEf BuggIRqHZB+Qidk8S5ko8XCbS5TRvkbS8vsgm9RwNDGgJ8PMUSnGup1dVfENgVoUqWTX kOkA== X-Gm-Message-State: AOAM532M0QXnP1NKhSJgaP8edOr0hE1eHWloCFuCmgnTeS+BlZxxDdon RyLMVGxeOLeUSilpVBmBOSt1lpYzg5Tw7bZESV5h33hcqfnItQ== X-Google-Smtp-Source: ABdhPJz97d0gBuc+KpSED/behXJGVK0sxSohj7YjwUIIBCTpxjpt91hF8NiKTiW2ylqBXwIj0lB3qMZ6IzVGmAZC4Qs= X-Received: by 2002:aca:ab15:: with SMTP id u21mr5811888oie.50.1623820526635; Tue, 15 Jun 2021 22:15:26 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a9d:f03:0:0:0:0:0 with HTTP; Tue, 15 Jun 2021 22:15:25 -0700 (PDT) In-Reply-To: References: <20210608171221.276899-1-keescook@chromium.org> <20210614100234.12077-1-youling257@gmail.com> <202106140826.7912F27CD@keescook> <202106140941.7CE5AE64@keescook> <202106141503.B3144DFE@keescook> From: youling 257 Date: Wed, 16 Jun 2021 13:15:25 +0800 Message-ID: Subject: Re: [PATCH] proc: Track /proc/$pid/attr/ opener mm_struct To: Linus Torvalds Cc: Kees Cook , Christian Brauner , Andrea Righi , Linux Kernel Mailing List , stable , regressions@lists.linux.dev, LSM List , Paul Moore , Stephen Smalley , SElinux list Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I test "proc: only require mm_struct for writing" fixed my cm14.1 problem. 2021-06-16 2:19 GMT+08:00, Linus Torvalds : > On Mon, Jun 14, 2021 at 6:55 PM youling 257 wrote: >> >> if try to find problem on userspace, i used linux 5.13rc6 on old >> android 7 cm14.1, not aosp android 11. >> http://git.osdn.net/view?p=android-x86/system-core.git;a=blob;f=init/service.cpp;h=a5334f447fc2fc34453d2f6a37523bedccadc690;hb=refs/heads/cm-14.1-x86#l457 >> >> 457 if (!seclabel_.empty()) { >> 458 if (setexeccon(seclabel_.c_str()) < 0) { >> 459 ERROR("cannot setexeccon('%s'): %s\n", >> 460 seclabel_.c_str(), strerror(errno)); >> 461 _exit(127); >> 462 } >> 463 } > > I have no idea where the cm14.1 libraries are. Does anybody know where > the matching source code for setexeccon() would be? > > For me - obviously not on cm14.1 - all "setexeccon()" does is > > n = openat(AT_FDCWD, "/proc/thread-self/attr/exec", O_RDWR|O_CLOEXEC) > write(n, string, len) > close(n) > > and if that fails, it would seem to indicate that proc_mem_open() > failed. Which would be mm_access() failing. But I don't see how that > can be the case, because mm_access() explicitly allows "mm == > current->mm" (which the above clearly should be). > > youling, can you double-check with the current -git tree? But as far > as I can tell, my minimal patch is exactly the same as Kees' patch > (just smaller and simpler). > > Kees, do you see anything? > > Linus >