From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Date: Mon, 03 Jun 2019 16:30:26 +0000 Subject: Re: [PATCH 3/7] vfs: Add a mount-notification facility Message-Id: <19414.1559579426@warthog.procyon.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit List-Id: References: <155905930702.7587.7100265859075976147.stgit@warthog.procyon.org.uk> <155905933492.7587.6968545866041839538.stgit@warthog.procyon.org.uk> <14347.1559127657@warthog.procyon.org.uk> <312a138c-e5b2-4bfb-b50b-40c82c55773f@schaufler-ca.com> In-Reply-To: To: Casey Schaufler Cc: dhowells@redhat.com, Jann Horn , Al Viro , raven@themaw.net, linux-fsdevel , Linux API , linux-block@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module , kernel list , Andy Lutomirski Casey Schaufler wrote: > >> should be used. Someone or something caused the event. It can > >> be important who it was. > > The kernel's normal security model means that you should be able to > > e.g. accept FDs that random processes send you and perform > > read()/write() calls on them without acting as a subject in any > > security checks; let alone close(). > > Passed file descriptors are an anomaly in the security model > that (in this developer's opinion) should have never been > included. More than one of the "B" level UNIX systems disabled > them outright. Considering further on this, I think the only way to implement what you're suggesting is to add a field to struct file to record the last fputter's creds as the procedure of fputting is offloaded to a workqueue. Note that's last fputter, not the last closer, as we don't track the number of open fds linked to a file struct. In the case of AF_UNIX sockets that contain in-the-process-of-being-passed fds at the time of closure, this is further complicated by the socket fput being achieved in the work item - thereby adding layers of indirection. It might be possible to replace f_cred rather than adding a new field, but that might get used somewhere after that point. Note also that fsnotify_close() doesn't appear to use the last fputter's path since it's not available if called from deferred fput. David