From: ebiederm@xmission.com (Eric W. Biederman)
To: Waiman Long <longman@redhat.com>
Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>,
Kees Cook <keescook@chromium.org>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
Andrew Morton <akpm@linux-foundation.org>,
Al Viro <viro@zeniv.linux.org.uk>,
Matthew Wilcox <willy@infradead.org>
Subject: Re: [PATCH v4 1/6] sysctl: Add flags to support min/max range clamping
Date: Tue, 13 Mar 2018 12:46:51 -0500 [thread overview]
Message-ID: <87r2onzx4k.fsf@xmission.com> (raw)
In-Reply-To: <1520885744-1546-2-git-send-email-longman@redhat.com> (Waiman Long's message of "Mon, 12 Mar 2018 16:15:39 -0400")
Waiman Long <longman@redhat.com> writes:
> When minimum/maximum values are specified for a sysctl parameter in
> the ctl_table structure with proc_dointvec_minmax() handler, update
> to that parameter will fail with error if the given value is outside
> of the required range.
>
> There are use cases where it may be better to clamp the value of
> the sysctl parameter to the given range without failing the update,
> especially if the users are not aware of the actual range limits.
> Reading the value back after the update will now be a good practice
> to see if the provided value exceeds the range limits.
What use cases? Who will break. Examples would be good.
> To provide this less restrictive form of range checking, a new flags
> field is added to the ctl_table structure.
>
> When the CTL_FLAGS_CLAMP_RANGE flag is set in the ctl_table
> entry, any update from the userspace will be clamped to the given
> range without error if either the proc_dointvec_minmax() or the
> proc_douintvec_minmax() handlers is used.
As this is constructed it will increase the size of ctl_table for
everyone. Better would be to add a new function that behaves similary
but differently than to burden struct ctl_table for the rest of time.
Nacked-by: "Eric W. Biederman" <ebiederm@xmission.com>
>
> Signed-off-by: Waiman Long <longman@redhat.com>
> ---
> include/linux/sysctl.h | 15 +++++++++++++++
> kernel/sysctl.c | 48 +++++++++++++++++++++++++++++++++++++++---------
> 2 files changed, 54 insertions(+), 9 deletions(-)
>
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> index b769ecf..963e363 100644
> --- a/include/linux/sysctl.h
> +++ b/include/linux/sysctl.h
> @@ -116,6 +116,7 @@ struct ctl_table
> void *data;
> int maxlen;
> umode_t mode;
> + unsigned int flags;
> struct ctl_table *child; /* Deprecated */
> proc_handler *proc_handler; /* Callback for text formatting */
> struct ctl_table_poll *poll;
> @@ -123,6 +124,20 @@ struct ctl_table
> void *extra2;
> } __randomize_layout;
>
> +/**
> + * enum ctl_table_flags - flags for the ctl table (struct ctl_table.flags)
> + *
> + * @CTL_FLAGS_CLAMP_RANGE: Set to indicate that the entry should be
> + * flexibly clamped to min/max range in case the user provided
> + * an incorrect value.
> + */
> +enum ctl_table_flags {
> + CTL_FLAGS_CLAMP_RANGE = BIT(0),
> + __CTL_FLAGS_MAX = BIT(1),
> +};
> +
> +#define CTL_TABLE_FLAGS_ALL (__CTL_FLAGS_MAX - 1)
> +
> struct ctl_node {
> struct rb_node node;
> struct ctl_table_header *header;
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index d2aa6b4..3d65f41 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2504,6 +2504,7 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
> * struct do_proc_dointvec_minmax_conv_param - proc_dointvec_minmax() range checking structure
> * @min: pointer to minimum allowable value
> * @max: pointer to maximum allowable value
> + * @flags: pointer to flags
> *
> * The do_proc_dointvec_minmax_conv_param structure provides the
> * minimum and maximum values for doing range checking for those sysctl
> @@ -2512,6 +2513,7 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
> struct do_proc_dointvec_minmax_conv_param {
> int *min;
> int *max;
> + unsigned int *flags;
> };
>
> static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
> @@ -2521,9 +2523,21 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
> struct do_proc_dointvec_minmax_conv_param *param = data;
> if (write) {
> int val = *negp ? -*lvalp : *lvalp;
> - if ((param->min && *param->min > val) ||
> - (param->max && *param->max < val))
> - return -EINVAL;
> + bool clamp = param->flags &&
> + (*param->flags & CTL_FLAGS_CLAMP_RANGE);
> +
> + if (param->min && *param->min > val) {
> + if (clamp)
> + val = *param->min;
> + else
> + return -EINVAL;
> + }
> + if (param->max && *param->max < val) {
> + if (clamp)
> + val = *param->max;
> + else
> + return -EINVAL;
> + }
> *valp = val;
> } else {
> int val = *valp;
> @@ -2552,7 +2566,8 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
> * This routine will ensure the values are within the range specified by
> * table->extra1 (min) and table->extra2 (max).
> *
> - * Returns 0 on success or -EINVAL on write when the range check fails.
> + * Returns 0 on success or -EINVAL on write when the range check fails
> + * without the CTL_FLAGS_CLAMP_RANGE flag.
> */
> int proc_dointvec_minmax(struct ctl_table *table, int write,
> void __user *buffer, size_t *lenp, loff_t *ppos)
> @@ -2560,6 +2575,7 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
> struct do_proc_dointvec_minmax_conv_param param = {
> .min = (int *) table->extra1,
> .max = (int *) table->extra2,
> + .flags = &table->flags,
> };
> return do_proc_dointvec(table, write, buffer, lenp, ppos,
> do_proc_dointvec_minmax_conv, ¶m);
> @@ -2569,6 +2585,7 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
> * struct do_proc_douintvec_minmax_conv_param - proc_douintvec_minmax() range checking structure
> * @min: pointer to minimum allowable value
> * @max: pointer to maximum allowable value
> + * @flags: pointer to flags
> *
> * The do_proc_douintvec_minmax_conv_param structure provides the
> * minimum and maximum values for doing range checking for those sysctl
> @@ -2577,6 +2594,7 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
> struct do_proc_douintvec_minmax_conv_param {
> unsigned int *min;
> unsigned int *max;
> + unsigned int *flags;
> };
>
> static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
> @@ -2587,14 +2605,24 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
>
> if (write) {
> unsigned int val = *lvalp;
> + bool clamp = param->flags &&
> + (*param->flags & CTL_FLAGS_CLAMP_RANGE);
>
> if (*lvalp > UINT_MAX)
> return -EINVAL;
>
> - if ((param->min && *param->min > val) ||
> - (param->max && *param->max < val))
> - return -ERANGE;
> -
> + if (param->min && *param->min > val) {
> + if (clamp)
> + val = *param->min;
> + else
> + return -ERANGE;
> + }
> + if (param->max && *param->max < val) {
> + if (clamp)
> + val = *param->max;
> + else
> + return -ERANGE;
> + }
> *valp = val;
> } else {
> unsigned int val = *valp;
> @@ -2621,7 +2649,8 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
> * check for UINT_MAX to avoid having to support wrap around uses from
> * userspace.
> *
> - * Returns 0 on success or -ERANGE on write when the range check fails.
> + * Returns 0 on success or -ERANGE on write when the range check fails
> + * without the CTL_FLAGS_CLAMP_RANGE flag.
> */
> int proc_douintvec_minmax(struct ctl_table *table, int write,
> void __user *buffer, size_t *lenp, loff_t *ppos)
> @@ -2629,6 +2658,7 @@ int proc_douintvec_minmax(struct ctl_table *table, int write,
> struct do_proc_douintvec_minmax_conv_param param = {
> .min = (unsigned int *) table->extra1,
> .max = (unsigned int *) table->extra2,
> + .flags = &table->flags,
> };
> return do_proc_douintvec(table, write, buffer, lenp, ppos,
> do_proc_douintvec_minmax_conv, ¶m);
next prev parent reply other threads:[~2018-03-13 17:47 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-12 20:15 [PATCH v4 0/6] ipc: Clamp *mni to the real IPCMNI limit Waiman Long
2018-03-12 20:15 ` [PATCH v4 1/6] sysctl: Add flags to support min/max range clamping Waiman Long
2018-03-12 20:44 ` Luis R. Rodriguez
2018-03-12 20:48 ` Waiman Long
2018-03-13 17:46 ` Eric W. Biederman [this message]
2018-03-13 18:49 ` Waiman Long
2018-03-12 20:15 ` [PATCH v4 2/6] proc/sysctl: Check for invalid flags bits Waiman Long
2018-03-12 20:46 ` Luis R. Rodriguez
2018-03-12 20:54 ` Waiman Long
2018-03-12 20:59 ` Luis R. Rodriguez
2018-03-12 21:02 ` Waiman Long
2018-03-12 20:52 ` Andrew Morton
2018-03-12 22:12 ` Waiman Long
2018-03-12 22:42 ` Andrew Morton
2018-03-12 20:15 ` [PATCH v4 3/6] sysctl: Warn when a clamped sysctl parameter is set out of range Waiman Long
2018-03-12 20:50 ` Luis R. Rodriguez
2018-03-12 21:07 ` Waiman Long
2018-03-12 21:00 ` Andrew Morton
2018-03-12 21:04 ` Waiman Long
2018-03-12 20:15 ` [PATCH v4 4/6] ipc: Clamp msgmni and shmmni to the real IPCMNI limit Waiman Long
2018-03-13 18:17 ` Eric W. Biederman
2018-03-13 18:39 ` Waiman Long
2018-03-13 20:29 ` Eric W. Biederman
2018-03-13 21:06 ` Waiman Long
2018-03-15 0:49 ` [RFC][PATCH] ipc: Remove IPCMNI Eric W. Biederman
2018-03-15 17:02 ` Waiman Long
2018-03-15 19:00 ` Eric W. Biederman
2018-03-15 21:46 ` Waiman Long
2018-03-29 2:14 ` Davidlohr Bueso
2018-03-29 8:47 ` Manfred Spraul
2018-03-29 10:56 ` Matthew Wilcox
2018-03-29 18:07 ` Manfred Spraul
2018-03-29 18:52 ` Eric W. Biederman
2018-03-29 19:32 ` Matthew Wilcox
2018-03-29 20:08 ` Eric W. Biederman
2018-03-15 19:45 ` Matthew Wilcox
2018-03-12 20:15 ` [PATCH v4 5/6] ipc: Clamp semmni to the real IPCMNI limit Waiman Long
2018-03-12 20:52 ` Luis R. Rodriguez
2018-03-12 20:59 ` Waiman Long
2018-03-12 20:15 ` [PATCH v4 6/6] test_sysctl: Add range clamping test Waiman Long
2018-03-12 20:53 ` Luis R. Rodriguez
2018-03-12 21:00 ` Waiman Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87r2onzx4k.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=akpm@linux-foundation.org \
--cc=keescook@chromium.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=longman@redhat.com \
--cc=mcgrof@kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).