From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-8fa9.mail.infomaniak.ch (smtp-8fa9.mail.infomaniak.ch [83.166.143.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92744A47 for ; Tue, 6 May 2025 08:32:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=83.166.143.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746520340; cv=none; b=dbQXPndX7IoZLVCf6CKVgQwL532Kr3BlIBHb3MZqfAl4eDffJAxFwDOFNku7+kn48es2Nj1QQQyI/9bgmzpn3xjTRpOhr+rd7jM0u/iboQaW9e5eq9ugRgSbdj5wIT8ETfgF95W4bGfk7qcPu2ZWrsPm7rm/AaxqRRiqLMN0c6E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746520340; c=relaxed/simple; bh=YSWl+QfwkOnRfAH90XS1/0eMYPBj00WkhiTyiofpPcU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Ej3dJFum+ZpY9A0EiVPcinlB7SKdyTL4VlyHnL7XbFfUawnrMJK3ekIfvZTlgpNXeXyg3I+GprrfrsDPywGIuWs3S502dhZYlstL5bDpzCN/o0mJ0YWBX5dbni9LpohG5REdmwixULzvDj2DO9OX1ZpyfcOKqCzkF8TZgDRXlmQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=phs/DWbu; arc=none smtp.client-ip=83.166.143.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="phs/DWbu" Received: from smtp-4-0001.mail.infomaniak.ch (smtp-4-0001.mail.infomaniak.ch [10.7.10.108]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4ZsBKP0tKlzxvW; Tue, 6 May 2025 10:25:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1746519913; bh=i4kB+dqu3Gkr/hdwa8JkKng9U1uVnoBQB3MDCaMXOP0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=phs/DWbuE3BjYaFDGc4kP6Y06gZrB3iNk0R3hNh9ysHb0gtRc8uz9Dkm5ND/BnUK6 xJAMq5cUXkfBNSxP0SEL/Ym0gUDuX5jsHjqfHAv7JyXCKKE2weLd0jQP4lQasVdp4m ty90N4LjlRdoOdU7l1TMBH9ZgDdF/PmQkyttd7/o= Received: from unknown by smtp-4-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4ZsBKL3wtjz4m9; Tue, 6 May 2025 10:25:10 +0200 (CEST) Date: Tue, 6 May 2025 10:25:09 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Alexei Starovoitov Cc: Kuniyuki Iwashima , Martin KaFai Lau , Daniel Borkmann , John Fastabend , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , =?utf-8?Q?G=C3=BCnther?= Noack , Paul Moore , James Morris , "Serge E. Hallyn" , Stephen Smalley , Ondrej Mosnacek , Casey Schaufler , Christian Brauner , Kuniyuki Iwashima , bpf , Network Development , LSM List , selinux@vger.kernel.org, Kees Cook , Jann Horn , linux-api@vger.kernel.org Subject: Re: [PATCH v1 bpf-next 4/5] bpf: Add kfunc to scrub SCM_RIGHTS at security_unix_may_send(). Message-ID: <20250506.ahjae2Beemuo@digikod.net> References: <20250505215802.48449-1-kuniyu@amazon.com> <20250505215802.48449-5-kuniyu@amazon.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Infomaniak-Routing: alpha On Mon, May 05, 2025 at 05:13:32PM -0700, Alexei Starovoitov wrote: > On Mon, May 5, 2025 at 3:00 PM Kuniyuki Iwashima wrote: > > > > As Christian Brauner said [0], systemd calls cmsg_close_all() [1] after > > each recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS. > > > > However, this cannot work around the issue that close() for unwanted file > > descriptors could block longer because the last fput() could occur on > > the receiver side once sendmsg() with SCM_RIGHTS succeeds. > > > > Also, even filtering by LSM at recvmsg() does not work for the same reason. > > > > Thus, we need a better way to filter SCM_RIGHTS on the sender side. > > > > Let's add a new kfunc to scrub all file descriptors from skb in > > sendmsg(). > > > > This allows the receiver to keep recv()ing the bare data and disallows > > the sender to impose the potential slowness of the last fput(). > > > > If necessary, we can add more granular filtering per file descriptor > > after refactoring GC code and adding some fd-to-file helpers for BPF. > > > > Sample: > > > > SEC("lsm/unix_may_send") > > int BPF_PROG(unix_scrub_scm_rights, > > struct socket *sock, struct socket *other, struct sk_buff *skb) > > { > > struct unix_skb_parms *cb; > > > > if (skb && bpf_unix_scrub_fds(skb)) > > return -EPERM; > > > > return 0; > > } > > Any other programmability do you need there? > > If not and above is all that is needed then what Jann proposed > sounds like better path to me: > " > I think the thorough fix would probably be to introduce a socket > option (controlled via setsockopt()) that already blocks the peer's > sendmsg(). > " > > Easier to operate and upriv process can use such setsockopt() too. Adding a flag with setsockopt() will enable any program to protect themselves instead of requiring the capability to load an eBPF program. For the systemd use case, I think a flag would be enough, and it would benefit more than only/mainly systemd. Another thing is that we should have a consistent user space error code if passing file descriptors is denied, to avoid confusing senders, to not silently ignore dropped file descriptors, and to let the sender know that it can send again but without passed file descriptors or maybe with a maximum number of file descriptors. The ENFILE errno (file table overflow) looks like a good candidate. I guess both approaches are valuable, but this series should add this new flag as well, and specify the expected error handling. If we want to be able to handle legacy software not using this new flag, we can leverage seccomp unotify.