From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC831C5DF60 for ; Tue, 5 Nov 2019 16:07:29 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6F6D72190F for ; Tue, 5 Nov 2019 16:07:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="eri7qH+7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6F6D72190F Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E6E2B6B026D; Tue, 5 Nov 2019 11:07:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E1ED56B026E; Tue, 5 Nov 2019 11:07:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CBF996B026F; Tue, 5 Nov 2019 11:07:28 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0226.hostedemail.com [216.40.44.226]) by kanga.kvack.org (Postfix) with ESMTP id B27176B026D for ; Tue, 5 Nov 2019 11:07:28 -0500 (EST) Received: from smtpin13.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with SMTP id 6242487C9 for ; Tue, 5 Nov 2019 16:07:28 +0000 (UTC) X-FDA: 76122703776.13.man93_6f58fd399a39 X-HE-Tag: man93_6f58fd399a39 X-Filterd-Recvd-Size: 4639 Received: from mail-lj1-f195.google.com (mail-lj1-f195.google.com [209.85.208.195]) by imf21.hostedemail.com (Postfix) with ESMTP for ; Tue, 5 Nov 2019 16:07:27 +0000 (UTC) Received: by mail-lj1-f195.google.com with SMTP id r7so13798729ljg.2 for ; Tue, 05 Nov 2019 08:07:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YLw5SYrodBEqy2waMxo41K2A0f7ArdzoSUTOLYie6s4=; b=eri7qH+7uZFLsQ1nBXM7tctm6BOw+ve7hZW/6tQlf9hNm1WjWAPsqiY0Yhh6c8nJ3C Xnn6dPx2b1yQNwdIRtZ0JNE5YnWD9wT4uWdQ88Alt8ix7dhCBHf1+3hKwuNpsBgC0NGc ukdLhq7GYGzfbGDIUwM59OXJAAblz15nAU/hswHpLXqSIMcjqv2fwEBMUCFFkxQbTh6C /Lu8vp0rEgL5fU8oJBcOT/dgw9PjRG+jLqHd2zO7jznoU26UzkHwv9gr6GQOjL28gyt7 uZ8vXn/mCyVxCwOnw56QpWCAoHsMV0n6qF29a/MAE/+msYFQNuy8S+uJKSCQHHYjv0EG m2Xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YLw5SYrodBEqy2waMxo41K2A0f7ArdzoSUTOLYie6s4=; b=QFpZgUIQwvPw38k9kUuA7H/jCQrQPCEm9Jg35Lg7zu+wvajUVetFJhuBGUmbWUT86w fXobvWIqxj9I8dc+IkEYXvlC/pRWqekCZqRXxbcM1wC0KJ0w/Si4Z6xa40S+aXKN0bQI HY4he/6JcksAFLPF7nSg9EuwmFhy+ZN/Xi14PfBWNLAYcEowR/YKNa86p1Oo2Ry0Ansm M/xIDCby/WRhqbdp5vK0bj+ECGBJuotb1xRZeooFAOItfNOe8MSr0kPFPxV8GwSyeOvQ VrkxsMQSDVrAA6CmPilM2inQPv39Iciy74Pk0jAOFJXC9od1TdqCHGhH3RacpiCM15dV 5E/g== X-Gm-Message-State: APjAAAWAltBd4oW7YGm/nWGan6WbDGK1JuYf6ETP8MrwOS1TX/4XLevx lnmsDQckQah5yBXU3v++tzUzdak78xrLsqXM1Lp+BA== X-Google-Smtp-Source: APXvYqyfeC8M/8bOUxBWxwGOy++KCeRE1AqSp/eH8U72Cip1RCmkWIqkShJuw/Lzbce5kF+wF/uaswMUtDkVjGbpmA4= X-Received: by 2002:a2e:81c6:: with SMTP id s6mr1063081ljg.61.1572970045838; Tue, 05 Nov 2019 08:07:25 -0800 (PST) MIME-Version: 1.0 References: <1572967777-8812-1-git-send-email-rppt@linux.ibm.com> <1572967777-8812-2-git-send-email-rppt@linux.ibm.com> In-Reply-To: From: Daniel Colascione Date: Tue, 5 Nov 2019 08:06:49 -0800 Message-ID: Subject: Re: [PATCH 1/1] userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK To: Andy Lutomirski Cc: Mike Rapoport , linux-kernel , Andrea Arcangeli , Andrew Morton , Jann Horn , Linus Torvalds , Lokesh Gidra , Nick Kralevich , Nosh Minwalla , Pavel Emelyanov , Tim Murray , Linux API , linux-mm Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 5, 2019 at 8:00 AM Andy Lutomirski wrote: > > On Tue, Nov 5, 2019 at 7:55 AM Daniel Colascione wrote: > > > > On Tue, Nov 5, 2019 at 7:29 AM Mike Rapoport wrote: > > > > > > Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file > > > descriptor table from the read() implementation of uffd, which may have > > > security implications for unprivileged use of the userfaultfd. > > > > > > Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have > > > CAP_SYS_PTRACE. > > > > Thanks. But shouldn't we be doing the capability check at > > userfaultfd(2) time (when we do the other permission checks), not > > later, in the API ioctl? > > The ioctl seems reasonable to me. In particular, if there is anyone > who creates a userfaultfd as root and then drop permissions, a later > ioctl could unexpectedly enable FORK. Sure, but the same argument applies to all the other permission checks that we do at open time, not at ioctl time. For better or for worse, the DAC-ish model used in most places is that access checks happen at file object creation time and anyone who has the FD can perform those operations later. Confusing the model by doing *some* permission checks at open time and *some* permission checks at usage time makes the system harder to understand.