linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Tycho Andersen <tycho@tycho.ws>
To: Sargun Dhillon <sargun@sargun.me>
Cc: linux-kernel@vger.kernel.org,
	containers@lists.linux-foundation.org, linux-api@vger.kernel.org,
	christian.brauner@ubuntu.com, keescook@chromium.org,
	cyphar@cyphar.com, Jeffrey Vander Stoep <jeffv@google.com>,
	jannh@google.com, rsesek@google.com, palmer@google.com,
	Matt Denton <mpdenton@google.com>,
	Kees Cook <keescook@google.com>
Subject: Re: [PATCH 2/5] seccomp: Introduce addfd ioctl to seccomp user notifier
Date: Sun, 24 May 2020 17:58:34 -0600	[thread overview]
Message-ID: <20200524235834.GJ2605652@cisco> (raw)
In-Reply-To: <20200524235732.GI2605652@cisco>

On Sun, May 24, 2020 at 05:57:32PM -0600, Tycho Andersen wrote:
> On Sun, May 24, 2020 at 04:39:39PM -0700, Sargun Dhillon wrote:
> > +static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd)
> > +{
> > +	int ret;
> > +
> > +	/*
> > +	 * Remove the notification, and reset the list pointers, indicating
> > +	 * that it has been handled.
> > +	 */
> > +	list_del_init(&addfd->list);
> > +
> > +	ret = security_file_receive(addfd->file);
> > +	if (ret)
> > +		goto out;
> > +
> > +	if (addfd->fd >= 0) {
> > +		ret = replace_fd(addfd->fd, addfd->file, addfd->flags);
> > +		if (ret >= 0)
> > +			fput(addfd->file);
> > +	} else {
> > +		ret = get_unused_fd_flags(addfd->flags);
> > +		if (ret >= 0)
> > +			fd_install(ret, addfd->file);
> > +	}
> > +
> > +out:
> > +	addfd->ret = ret;
> > +	complete(&addfd->completion);
> > +}
> 
> My previous comment about SCM_RIGHTS still applies, right? That is, we
> should do,
> 
> 		sock = sock_from_file(fp[i], &err);
> 		if (sock) {
> 				sock_update_netprioidx(&sock->sk->sk_cgrp_data);
> 				sock_update_classid(&sock->sk->sk_cgrp_data);
> 		}
> 
> and perhaps lift that into a helper.

Oh, and now I see the later patch. But is there a reason to separate
these? I can't think of one.

Tycho

  reply	other threads:[~2020-05-24 23:58 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-24 23:39 [PATCH 0/5] Add seccomp notifier ioctl that enables adding fds Sargun Dhillon
2020-05-24 23:39 ` [PATCH 1/5] seccomp: Add find_notification helper Sargun Dhillon
2020-05-24 23:55   ` Tycho Andersen
2020-05-25 13:26   ` Christian Brauner
2020-05-24 23:39 ` [PATCH 2/5] seccomp: Introduce addfd ioctl to seccomp user notifier Sargun Dhillon
2020-05-24 23:57   ` Tycho Andersen
2020-05-24 23:58     ` Tycho Andersen [this message]
2020-05-25  0:05   ` Al Viro
2020-05-25  0:27     ` Sargun Dhillon
2020-05-25  0:39       ` Al Viro
2020-05-25 13:50   ` Christian Brauner
2020-05-26  6:59     ` Sargun Dhillon
2020-05-26  8:22       ` Christian Brauner
2020-05-24 23:39 ` [PATCH 3/5] selftests/seccomp: Test SECCOMP_IOCTL_NOTIF_ADDFD Sargun Dhillon
2020-05-24 23:39 ` [PATCH 4/5] seccomp: Add SECCOMP_ADDFD_FLAG_MOVE flag to add fd ioctl Sargun Dhillon
2020-05-25 14:20   ` Christian Brauner
2020-05-26  6:08     ` Sargun Dhillon
2020-05-24 23:39 ` [PATCH 5/5] selftests/seccomp: Add test for addfd move semantics Sargun Dhillon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200524235834.GJ2605652@cisco \
    --to=tycho@tycho.ws \
    --cc=christian.brauner@ubuntu.com \
    --cc=containers@lists.linux-foundation.org \
    --cc=cyphar@cyphar.com \
    --cc=jannh@google.com \
    --cc=jeffv@google.com \
    --cc=keescook@chromium.org \
    --cc=keescook@google.com \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mpdenton@google.com \
    --cc=palmer@google.com \
    --cc=rsesek@google.com \
    --cc=sargun@sargun.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).