archive mirror
 help / color / mirror / Atom feed
* [PATCH v2 0/1] userfaultfd: allow to forbid unprivileged users
@ 2019-03-19  3:07 Peter Xu
  2019-03-19  3:07 ` [PATCH v2 1/1] userfaultfd/sysctl: add vm.unprivileged_userfaultfd Peter Xu
  0 siblings, 1 reply; 11+ messages in thread
From: Peter Xu @ 2019-03-19  3:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Paolo Bonzini, Hugh Dickins, Luis Chamberlain, Maxime Coquelin,
	Maya Gokhale, Jerome Glisse, Pavel Emelyanov, Johannes Weiner,
	peterx, Martin Cracauer, Denis Plotnikov, linux-mm,
	Marty McFadden, Mike Kravetz, Andrea Arcangeli, Mike Rapoport,
	Kees Cook, Mel Gorman, Kirill A . Shutemov, linux-api,
	linux-fsdevel, Dr . David Alan Gilbert, Andrew Morton


This is the second version of the work.  V1 was here:

I removed CC to kvm list since not necessary any more, but added
linux-api to the list as suggested by Kirill.

This one greatly simplifies the previous version, dropped the kvm
special entry and mimic the sysctl_unprivileged_bpf_disabled knob for
userfaultfd as suggested by many.  The major differences comparing to
the BPF flag are: (1) use PTRACE instead of ADMIN capability, and (2)
allow to switch the flag back and forth (BPF does not allow to switch
back to "enabled" if "disabled" once).

So the main idea of this simpler version is that we still keep the old
way as is by default but we only provide a way for admins when they
really want to turn userfaultfd off for unprivileged users.

About procfs vs sysfs: I still used the procfs way because admins can
still leverage sysctl.conf with that and also since no one yet
explicitly asked for sysfs for a better reason yet (And I just noticed
BPF just added another bpf_stats_enabled into sysctl a few weeks ago).

Please have a look, thanks.

Peter Xu (1):
  userfaultfd/sysctl: add vm.unprivileged_userfaultfd

 Documentation/sysctl/vm.txt   | 12 ++++++++++++
 fs/userfaultfd.c              |  5 +++++
 include/linux/userfaultfd_k.h |  2 ++
 kernel/sysctl.c               | 12 ++++++++++++
 4 files changed, 31 insertions(+)


^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2019-04-23 22:26 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-19  3:07 [PATCH v2 0/1] userfaultfd: allow to forbid unprivileged users Peter Xu
2019-03-19  3:07 ` [PATCH v2 1/1] userfaultfd/sysctl: add vm.unprivileged_userfaultfd Peter Xu
2019-03-19  7:11   ` Mike Rapoport
2019-03-19 18:07     ` Andrea Arcangeli
2019-03-19 18:02   ` Andrew Morton
2019-03-19 18:28     ` Dr. David Alan Gilbert
2019-03-20  0:20       ` Peter Xu
2019-03-20 19:01       ` Andrea Arcangeli
2019-03-21 13:43         ` Luis Chamberlain
2019-03-21 21:06           ` Andrea Arcangeli
2019-04-23 22:19     ` Kees Cook

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).