From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1756562AbcKBRbZ (ORCPT <rfc822;w@1wt.eu>);
        Wed, 2 Nov 2016 13:31:25 -0400
Received: from mx1.redhat.com ([209.132.183.28]:44764 "EHLO mx1.redhat.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1756347AbcKBRbY (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 2 Nov 2016 13:31:24 -0400
Date: Wed, 2 Nov 2016 19:29:41 +0100
From: Oleg Nesterov <oleg@redhat.com>
To: Jann Horn <jann@thejh.net>
Cc: Seth Forshee <seth.forshee@canonical.com>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Doug Ledford <dledford@redhat.com>, Al Viro <viro@zeniv.linux.org.uk>,
        Tejun Heo <tj@kernel.org>, Roland McGrath <roland@redhat.com>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] signal: fix overflow_uid signal sender
Message-ID: <20161102182941.GC1112@redhat.com>
References: <1477929262-2531-1-git-send-email-jann@thejh.net> <20161102181640.GA1112@redhat.com> <20161102172455.GE8196@pc.thejh.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20161102172455.GE8196@pc.thejh.net>
User-Agent: Mutt/1.5.18 (2008-05-17)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Wed, 02 Nov 2016 17:31:23 +0000 (UTC)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 11/02, Jann Horn wrote:
>
> On Wed, Nov 02, 2016 at 07:16:41PM +0100, Oleg Nesterov wrote:
> > On 10/31, Jann Horn wrote:
> > >
> > >  static inline void userns_fixup_signal_uid(struct siginfo *info, struct task_struct *t)
> > >  {
> > > -	if (current_user_ns() == task_cred_xxx(t, user_ns))
> > > +	if (&init_user_ns == task_cred_xxx(t, user_ns))
> > >  		return;
> > >
> > >  	if (SI_FROMKERNEL(info))
> > > @@ -959,7 +959,7 @@ static inline void userns_fixup_signal_uid(struct siginfo *info, struct task_str
> > >
> > >  	rcu_read_lock();
> > >  	info->si_uid = from_kuid_munged(task_cred_xxx(t, user_ns),
> > > -					make_kuid(current_user_ns(), info->si_uid));
> > > +					make_kuid(&init_user_ns, info->si_uid));
> > >  	rcu_read_unlock();
> > >  }
> > >  #else
> > > @@ -1027,7 +1027,8 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
> > >  			q->info.si_code = SI_USER;
> > >  			q->info.si_pid = task_tgid_nr_ns(current,
> > >  							task_active_pid_ns(t));
> > > -			q->info.si_uid = from_kuid_munged(current_user_ns(), current_uid());
> > > +			q->info.si_uid = from_kuid(&init_user_ns,
> > > +						   current_uid());
> >
> > Looks good to me at first glance, but I think this needs an ack from Eric.
> >
> > I have to admit that I forgot how uid_map/etc actually works, I can't
> > even recall if from_kuid(init_user_ns, xxx) == __kuid_val(xxx) or not,
> > although this doesn't really matter.
>
> Yes, from_kuid(&init_user_ns, xxx) == __kuid_val(xxx). For values from 0
> to 0xfffffffe, the uid_map of init_user_ns is an identity map (and it
> can't be changed), and for 0xffffffff, which isn't mapped, it returns
> 0xffffffff to denote failure.

So perhaps we can add another helper to avoid the unnecessary map_id_up()

	from_kuid_init_user_ns(kuid_t kuid)
	{
		return __kuid_val(kuid);
	}

But this is a bit off-topic, let me repeat that your patch looks fine to me.

Oleg.