Re: [PATCH] PCI/proc: Use file_ns_capable() when checking config space read access

["Krzysztof Wilczyński" <kwilczynski@kernel.org>]

Hello,

> proc_bus_pci_read() decides how much of the config space is readable
> based on capable(CAP_SYS_ADMIN), which checks the credentials of the
> task calling read(), not the credentials of the process that opened
> the file.
> 
> The sysfs equivalent, pci_read_config(), has checked the credentials
> of the opening process since commit de139a339395 ("pci: check caps
> from sysfs file open to read device dependent config space"), so a
> privileged process can open the config space file and pass the file
> descriptor to an unprivileged process (for example, a process running
> a KVM guest with an assigned device), which can then read the entire
> config space.  The check was subsequently routed through the LSM
> framework in commit 47970b1b2aa6 ("pci: use security_capable() when
> checking capablities during config space read") and converted to the
> dedicated helper in commit ab0fa82b2df9 ("pci-sysfs: use proper file
> capability helper function").
> 
> Thus, the two interfaces check the same capability against different
> credentials.  Checking the credentials of the task calling read()
> makes the outcome depend on who reads rather than who opened, so the
> restriction is bypassed whenever a more privileged process reads
> through the descriptor.  Checking the credentials recorded in
> file->f_cred settles the decision at open() time and ties it to the
> file, where it cannot change with the caller.
> 
> Therefore, use file_ns_capable() to check CAP_SYS_ADMIN against the
> credentials in effect when the file was opened, bringing the procfs
> interface in line with the sysfs behaviour.
> 
> As a result, a file descriptor opened by a privileged process and
> passed to an unprivileged one now allows the entire config space to
> be read through procfs, matching sysfs.

Applied to the procfs branch.

Thank you!

	Krzysztof