Re: [PATCH] io_uring/register: don't exempt disabled rings from task restrictions

[Jens Axboe <axboe@kernel.dk>]

On 10/8/26 5:08 PM, Eugene Gvozdetsky via B4 Relay wrote:
> From: Eugene Gvozdetsky <gvozdet@gmail.com>
> 
> A ring created with IORING_SETUP_R_DISABLED is exempt from its register
> restrictions until it is enabled. This lets the creator register the
> restrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,
> whether or not that opcode is in the allowed set.
> 
> Since commit ed82f35b926b ("io_uring: allow registration of per-task
> restrictions"), a ring also inherits restrictions from the task that
> creates it, and the same exemption applies to those. A task whose
> register opcodes are restricted can therefore create a disabled ring,
> issue any register opcode on it, and then enable it.
> 
> Mark rings whose restrictions were inherited from the task, and keep
> checking register opcodes for them while the ring is disabled. Enabling
> such a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the
> task's allowed set. Per-ring restrictions registered on a disabled ring
> work as before.

I think you want something like the below on top, setting the
inheritance only when it's true. Going to fold that in, let me know if
you object

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 6feaf09bbe8e..c994157173a2 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2957,13 +2957,13 @@ static void io_ctx_restriction_clone(struct io_ring_ctx *ctx,
 	struct io_restriction *dst = &ctx->restrictions;
 
 	io_restriction_clone(dst, src);
-	ctx->int_flags |= IO_RING_F_RESTRICT_INHERITED;
 	if (dst->bpf_filters)
 		WRITE_ONCE(ctx->bpf_filters, dst->bpf_filters->filters);
 	if (dst->op_registered)
 		ctx->int_flags |= IO_RING_F_OP_RESTRICTED;
 	if (dst->reg_registered)
-		ctx->int_flags |= IO_RING_F_REG_RESTRICTED;
+		ctx->int_flags |= IO_RING_F_REG_RESTRICTED |
+				  IO_RING_F_RESTRICT_INHERITED;
 }
 
 static __cold int io_uring_create(struct io_ctx_config *config)

-- 
Jens Axboe