All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v6 0/7] Count rlimits in each user namespace
@ 2021-02-15 12:41 ` Alexey Gladkov
  0 siblings, 0 replies; 41+ messages in thread
From: Alexey Gladkov @ 2021-02-15 12:41 UTC (permalink / raw)
  To: LKML, io-uring, Kernel Hardening, Linux Containers, linux-mm
  Cc: Jens Axboe, Kees Cook, Jann Horn, Linus Torvalds, Oleg Nesterov,
	Eric W . Biederman, Andrew Morton, Alexey Gladkov

[-- Attachment #1: Type: text/plain, Size: 1547 bytes --]

Spam detection software, running on the system "smtp3.osuosl.org",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Preface ------- These patches are for binding the rlimit counters
   to a user in user namespace. This patch set can be applied on top of: git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
   v5.11 

Content analysis details:   (5.2 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.8 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                            [score: 0.4674]
 1.0 FORGED_GMAIL_RCVD      'From' gmail.com does not match 'Received'
                            headers
 0.7 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
                            provider (gladkov.alexey[at]gmail.com)
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                             CUSTOM_MED
 0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing
                            list
 1.9 SPOOFED_FREEMAIL       No description available.
 0.0 SPOOF_GMAIL_MID        From Gmail but it doesn't seem to be...



[-- Attachment #2: original message before SpamAssassin --]
[-- Type: message/rfc822, Size: 7507 bytes --]

From: Alexey Gladkov <gladkov.alexey@gmail.com>
To: LKML <linux-kernel@vger.kernel.org>, io-uring@vger.kernel.org, Kernel Hardening <kernel-hardening@lists.openwall.com>, Linux Containers <containers@lists.linux-foundation.org>, linux-mm@kvack.org
Cc: Alexey Gladkov <legion@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Christian Brauner <christian.brauner@ubuntu.com>, "Eric W . Biederman" <ebiederm@xmission.com>, Jann Horn <jannh@google.com>, Jens Axboe <axboe@kernel.dk>, Kees Cook <keescook@chromium.org>, Linus Torvalds <torvalds@linux-foundation.org>, Oleg Nesterov <oleg@redhat.com>
Subject: [PATCH v6 0/7] Count rlimits in each user namespace
Date: Mon, 15 Feb 2021 13:41:07 +0100
Message-ID: <cover.1613392826.git.gladkov.alexey@gmail.com>

Preface
-------
These patches are for binding the rlimit counters to a user in user namespace.
This patch set can be applied on top of:

git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.11

Problem
-------
The RLIMIT_NPROC, RLIMIT_MEMLOCK, RLIMIT_SIGPENDING, RLIMIT_MSGQUEUE rlimits
implementation places the counters in user_struct [1]. These limits are global
between processes and persists for the lifetime of the process, even if
processes are in different user namespaces.

To illustrate the impact of rlimits, let's say there is a program that does not
fork. Some service-A wants to run this program as user X in multiple containers.
Since the program never fork the service wants to set RLIMIT_NPROC=1.

service-A
 \- program (uid=1000, container1, rlimit_nproc=1)
 \- program (uid=1000, container2, rlimit_nproc=1)

The service-A sets RLIMIT_NPROC=1 and runs the program in container1. When the
service-A tries to run a program with RLIMIT_NPROC=1 in container2 it fails
since user X already has one running process.

The problem is not that the limit from container1 affects container2. The
problem is that limit is verified against the global counter that reflects
the number of processes in all containers.

This problem can be worked around by using different users for each container
but in this case we face a different problem of uid mapping when transferring
files from one container to another.

Eric W. Biederman mentioned this issue [2][3].

Introduced changes
------------------
To address the problem, we bind rlimit counters to user namespace. Each counter
reflects the number of processes in a given uid in a given user namespace. The
result is a tree of rlimit counters with the biggest value at the root (aka
init_user_ns). The limit is considered exceeded if it's exceeded up in the tree.

[1] https://lore.kernel.org/containers/87imd2incs.fsf@x220.int.ebiederm.org/
[2] https://lists.linuxfoundation.org/pipermail/containers/2020-August/042096.html
[3] https://lists.linuxfoundation.org/pipermail/containers/2020-October/042524.html

Changelog
---------
v6:
* Fixed issues found by lkp-tests project.
* Rebased onto v5.11.

v5:
* Split the first commit into two commits: change ucounts.count type to atomic_long_t
  and add ucounts to cred. These commits were merged by mistake during the rebase.
* The __get_ucounts() renamed to alloc_ucounts().
* The cred.ucounts update has been moved from commit_creds() as it did not allow
  to handle errors.
* Added error handling of set_cred_ucounts().

v4:
* Reverted the type change of ucounts.count to refcount_t.
* Fixed typo in the kernel/cred.c

v3:
* Added get_ucounts() function to increase the reference count. The existing
  get_counts() function renamed to __get_ucounts().
* The type of ucounts.count changed from atomic_t to refcount_t.
* Dropped 'const' from set_cred_ucounts() arguments.
* Fixed a bug with freeing the cred structure after calling cred_alloc_blank().
* Commit messages have been updated.
* Added selftest.

v2:
* RLIMIT_MEMLOCK, RLIMIT_SIGPENDING and RLIMIT_MSGQUEUE are migrated to ucounts.
* Added ucounts for pair uid and user namespace into cred.
* Added the ability to increase ucount by more than 1.

v1:
* After discussion with Eric W. Biederman, I increased the size of ucounts to
  atomic_long_t.
* Added ucount_max to avoid the fork bomb.

--

Alexey Gladkov (7):
  Increase size of ucounts to atomic_long_t
  Add a reference to ucounts for each cred
  Reimplement RLIMIT_NPROC on top of ucounts
  Reimplement RLIMIT_MSGQUEUE on top of ucounts
  Reimplement RLIMIT_SIGPENDING on top of ucounts
  Reimplement RLIMIT_MEMLOCK on top of ucounts
  kselftests: Add test to check for rlimit changes in different user
    namespaces

 fs/exec.c                                     |   6 +-
 fs/hugetlbfs/inode.c                          |  16 +-
 fs/io-wq.c                                    |  22 ++-
 fs/io-wq.h                                    |   2 +-
 fs/io_uring.c                                 |   2 +-
 fs/proc/array.c                               |   2 +-
 include/linux/cred.h                          |   4 +
 include/linux/hugetlb.h                       |   4 +-
 include/linux/mm.h                            |   4 +-
 include/linux/sched/user.h                    |   7 -
 include/linux/shmem_fs.h                      |   2 +-
 include/linux/signal_types.h                  |   4 +-
 include/linux/user_namespace.h                |  24 ++-
 ipc/mqueue.c                                  |  29 ++--
 ipc/shm.c                                     |  30 ++--
 kernel/cred.c                                 |  50 +++++-
 kernel/exit.c                                 |   2 +-
 kernel/fork.c                                 |  18 +-
 kernel/signal.c                               |  53 +++---
 kernel/sys.c                                  |  14 +-
 kernel/ucount.c                               | 120 +++++++++++--
 kernel/user.c                                 |   3 -
 kernel/user_namespace.c                       |   9 +-
 mm/memfd.c                                    |   5 +-
 mm/mlock.c                                    |  35 ++--
 mm/mmap.c                                     |   4 +-
 mm/shmem.c                                    |   8 +-
 tools/testing/selftests/Makefile              |   1 +
 tools/testing/selftests/rlimits/.gitignore    |   2 +
 tools/testing/selftests/rlimits/Makefile      |   6 +
 tools/testing/selftests/rlimits/config        |   1 +
 .../selftests/rlimits/rlimits-per-userns.c    | 161 ++++++++++++++++++
 32 files changed, 495 insertions(+), 155 deletions(-)
 create mode 100644 tools/testing/selftests/rlimits/.gitignore
 create mode 100644 tools/testing/selftests/rlimits/Makefile
 create mode 100644 tools/testing/selftests/rlimits/config
 create mode 100644 tools/testing/selftests/rlimits/rlimits-per-userns.c

-- 
2.29.2


[-- Attachment #3: Type: text/plain, Size: 171 bytes --]

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers

^ permalink raw reply	[flat|nested] 41+ messages in thread

end of thread, other threads:[~2021-02-23  5:31 UTC | newest]

Thread overview: 41+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-15 12:41 [PATCH v6 0/7] Count rlimits in each user namespace Alexey Gladkov
2021-02-15 12:41 ` Alexey Gladkov
2021-02-15 12:41 ` [PATCH v6 1/7] Increase size of ucounts to atomic_long_t Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-15 12:41 ` [PATCH v6 2/7] Add a reference to ucounts for each cred Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-15 12:41 ` [PATCH v6 3/7] Reimplement RLIMIT_NPROC on top of ucounts Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-21 23:38   ` Jens Axboe
2021-02-21 23:38     ` Jens Axboe
2021-02-22 10:11     ` Alexey Gladkov
2021-02-22 10:11       ` Alexey Gladkov
2021-02-22 14:09       ` Jens Axboe
2021-02-22 14:09         ` Jens Axboe
2021-02-15 12:41 ` [PATCH v6 4/7] Reimplement RLIMIT_MSGQUEUE " Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-15 12:41 ` [PATCH v6 5/7] Reimplement RLIMIT_SIGPENDING " Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-15 12:41 ` [PATCH v6 6/7] Reimplement RLIMIT_MEMLOCK " Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-15 15:09   ` kernel test robot
2021-02-15 15:09     ` kernel test robot
2021-02-15 15:09     ` kernel test robot
2021-02-15 17:49   ` kernel test robot
2021-02-15 17:49     ` kernel test robot
2021-02-15 17:49     ` kernel test robot
2021-02-16 11:12   ` [PATCH v7 " Alexey Gladkov
2021-02-16 11:12     ` Alexey Gladkov
2021-02-17 16:07   ` f009495a8d: BUG:KASAN:use-after-free_in_user_shm_unlock kernel test robot
2021-02-17 16:07     ` kernel test robot
2021-02-17 16:07     ` kernel test robot
2021-02-15 12:41 ` [PATCH v6 7/7] kselftests: Add test to check for rlimit changes in different user namespaces Alexey Gladkov
2021-02-15 12:41   ` Alexey Gladkov
2021-02-21 22:20 ` [PATCH v6 0/7] Count rlimits in each user namespace Linus Torvalds
2021-02-21 22:20   ` Linus Torvalds
2021-02-21 22:20   ` Linus Torvalds
2021-02-22 10:27   ` Alexey Gladkov
2021-02-22 10:27     ` Alexey Gladkov
2021-02-23  5:30   ` Eric W. Biederman
2021-02-23  5:30     ` Eric W. Biederman
2021-02-23  5:30     ` Eric W. Biederman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.