From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FSL_HELO_FAKE, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A19B6C4338F for ; Thu, 29 Jul 2021 22:49:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8678960F46 for ; Thu, 29 Jul 2021 22:49:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232996AbhG2WtM (ORCPT ); Thu, 29 Jul 2021 18:49:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234325AbhG2WtH (ORCPT ); Thu, 29 Jul 2021 18:49:07 -0400 Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E99FC0613D3 for ; Thu, 29 Jul 2021 15:49:04 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id t21so8678990plr.13 for ; Thu, 29 Jul 2021 15:49:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=cud3OIkgb3qTpL75CZeQ4prefyp9kbYPmFH5eW7nSl0=; b=pngrPVc1ThDnBlTMX37huWkZLhfwyBbhEvacbRWVmsLUTE698eeDlGMCjL1HcKZ2Y5 2UZmcnqRNphPnwhBqA8a70FfJkN3VoLf4zE0/xICG4dPOmnqMYLxvBpcAxYVWJLf2cvi gy+8a6msQAmlTsJT9W0R7Q5vjf4Ize3MMZBDfTaX2qVnPRrXix4okmMsnUOMyp8tVgas AEHd37T8235msNSausxzC7/6bIfZxPmHmW0vigz5ZvAKYKQjmrwyYLkDYtmePhv4bDKO 0HT7i88Wk9R7ybF4w3QFyEz8S5w7lN51oFp8o1bXVBYwn9Z5WlwNwa5hQB577Qy+rwvK 3VXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=cud3OIkgb3qTpL75CZeQ4prefyp9kbYPmFH5eW7nSl0=; b=h0MY1aTUKI2LXP3WAuptcZ0sY0pjolv/QgzuNkfAvEUxWoNNYDv6aGGmtSO2Nnnn0D aZ/qhOSi6V+Nk8b/yw9kfSIDI4dfJRQjyD/K7cn3TlAI0wQvgazNaWIuLiyEO7vJm5jr oDF5FwU3UFER8UJ6GY6twGC/KwgmlCqIEK/h9GbL1LCjVwnawYu0pqzpmGZkcNDrDs2m jpHN2abKtkCdepE77m5xibwhLf2qnSi1y+KG1KxMyjl8wHtwMIPHUuMrMli9cJleuzfh mwbcG0XKqSiV8bKcni5H6Puwk7ZUHQtdZOpjtuOoVWpJuo949Js1XU6ABAHzml5RdX67 +Qpg== X-Gm-Message-State: AOAM533gWBgNo9GqkEMo9R0bTzdzV6U8itK4oDpxDoaROYisTl/itlT5 b2yc7bXV6AO+3X4rnGRlqiTaVg== X-Google-Smtp-Source: ABdhPJy4PXErrWgDXOCNXUSpbIXGeRYQnnjP5FknlN72tzyDYHxD4GkLjobNpmAyfUemapUXSC8gEQ== X-Received: by 2002:a05:6a00:158e:b029:32b:9de5:a199 with SMTP id u14-20020a056a00158eb029032b9de5a199mr7229064pfk.76.1627598943460; Thu, 29 Jul 2021 15:49:03 -0700 (PDT) Received: from google.com (64.157.240.35.bc.googleusercontent.com. [35.240.157.64]) by smtp.gmail.com with ESMTPSA id w15sm4340796pjc.45.2021.07.29.15.49.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jul 2021 15:49:02 -0700 (PDT) Date: Thu, 29 Jul 2021 22:48:54 +0000 From: Matthew Bobrowski To: Jann Horn Cc: jack@suse.cz, amir73il@gmail.com, christian.brauner@ubuntu.com, linux-fsdevel@vger.kernel.org, linux-api@vger.kernel.org, Andy Lutomirski Subject: Re: [PATCH v3 5/5] fanotify: add pidfd support to the fanotify API Message-ID: References: <02ba3581fee21c34bd986e093d9eb0b9897fa741.1626845288.git.repnop@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On Tue, Jul 27, 2021 at 10:54:18PM +1000, Matthew Bobrowski wrote: > Hey Jann, > > On Tue, Jul 27, 2021 at 02:23:38AM +0200, Jann Horn wrote: > > On Wed, Jul 21, 2021 at 8:21 AM Matthew Bobrowski wrote: > > > Introduce a new flag FAN_REPORT_PIDFD for fanotify_init(2) which > > > allows userspace applications to control whether a pidfd info record > > > containing a pidfd is to be returned with each event. > > > > > > If FAN_REPORT_PIDFD is enabled for a notification group, an additional > > > struct fanotify_event_info_pidfd object will be supplied alongside the > > > generic struct fanotify_event_metadata within a single event. This > > > functionality is analogous to that of FAN_REPORT_FID in terms of how > > > the event structure is supplied to the userspace application. Usage of > > > FAN_REPORT_PIDFD with FAN_REPORT_FID/FAN_REPORT_DFID_NAME is > > > permitted, and in this case a struct fanotify_event_info_pidfd object > > > will follow any struct fanotify_event_info_fid object. > > > > > > Currently, the usage of FAN_REPORT_TID is not permitted along with > > > FAN_REPORT_PIDFD as the pidfd API only supports the creation of pidfds > > > for thread-group leaders. Additionally, the FAN_REPORT_PIDFD is > > > limited to privileged processes only i.e. listeners that are running > > > with the CAP_SYS_ADMIN capability. Attempting to supply either of > > > these initialization flags with FAN_REPORT_PIDFD will result with > > > EINVAL being returned to the caller. > > > > > > In the event of a pidfd creation error, there are two types of error > > > values that can be reported back to the listener. There is > > > FAN_NOPIDFD, which will be reported in cases where the process > > > responsible for generating the event has terminated prior to fanotify > > > being able to create pidfd for event->pid via pidfd_create(). The > > > there is FAN_EPIDFD, which will be reported if a more generic pidfd > > > creation error occurred when calling pidfd_create(). > > [...] > > > @@ -524,6 +562,34 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, > > > } > > > metadata.fd = fd; > > > > > > + if (pidfd_mode) { > > > + /* > > > + * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual > > > + * exclusion is ever lifted. At the time of incoporating pidfd > > > + * support within fanotify, the pidfd API only supported the > > > + * creation of pidfds for thread-group leaders. > > > + */ > > > + WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); > > > + > > > + /* > > > + * The PIDTYPE_TGID check for an event->pid is performed > > > + * preemptively in attempt to catch those rare instances where > > > + * the process responsible for generating the event has > > > + * terminated prior to calling into pidfd_create() and acquiring > > > + * a valid pidfd. Report FAN_NOPIDFD to the listener in those > > > + * cases. All other pidfd creation errors are represented as > > > + * FAN_EPIDFD. > > > + */ > > > + if (metadata.pid == 0 || > > > + !pid_has_task(event->pid, PIDTYPE_TGID)) { > > > + pidfd = FAN_NOPIDFD; > > > + } else { > > > + pidfd = pidfd_create(event->pid, 0); > > > + if (pidfd < 0) > > > + pidfd = FAN_EPIDFD; > > > + } > > > + } > > > + > > > > As a general rule, f_op->read callbacks aren't allowed to mess with > > the file descriptor table of the calling process. A process should be > > able to receive a file descriptor from an untrusted source and call > > functions like read() on it without worrying about affecting its own > > file descriptor table state with that. > > Interesting, thanks for bringing this up. I never knew about this general > rule. Do you mind elaborating a little on why f_op->read() callbacks aren't > allowed to mess with the fdtable of the calling process? I don't quite > exactly understand why this is considered to be suboptimal. Nevermind. I done a little extra thinking about this and I can see exactly why this could be problematic. /M