Re: [PATCH] Security: Implement and document RLIMIT_NETWORK.

Evgeniy Polyakov
2009-01-07T22:00:10Z

On Wed, Jan 07, 2009 at 04:07:58PM -0500, Michael Stone (michael@laptop.org) wrote:
> First, thanks very much for all your comments and questions.

you are welcome :)

> >It isn't, since it can not set rlimit, and if it can, it still can drop
> >it.
>
> Some sample code will probably clarify the use of my patch:
>
> http://dev.laptop.org/git?p=users/mstone/test-rlimit-network;a=blob;f=disable_network.c;hb=HEAD
>
> This C code describes a 'disable_network' exec-chain script which, when run
> as
> any user, irrevocably disables network access as described in my previous
> emails.
>
> As you can see, processes start with full access to the 'network' resource
> and
> may, at any time, irrevocably (modulo CAP_SYS_RESOURCE) limit their and
> their
> future children's access to this resource by lowering both their soft and
> hard
> limits to 0.

Argh, I see. That clarifies most questions indeed.

> >Your code does not cover sendpage() interface (aka splice() and
> >sendfile())
>
> Nor should it. Applications should continue to be able to send data on any
> sockets where were already connected and should be able to accept new
> connections on sockets which were already bound.
>
> I have done some primitive testing to ensure that the patch implements this
> functionality by means of the test utilities provided here:
>
> http://dev.laptop.org/git?p=users/mstone/test-rlimit-network;a=tree
>
> Can you confirm my results?

Your patch adds a rlimit check into __sock_sendmsg() call, which is
invoked via usual send() path, but sendfile() and splice() are still
exectuted without this check and thus will be able to send data after
rlimit applied.

> >and with your approach application will suddenly stops sending data even
> >into
> >old sockets, but will be able to receive it from anywhere. Is it
> >intentional?
>
> Why do you think this would happen?
>
> (My test results, e.g. via
> http://dev.laptop.org/git?p=users/mstone/test-rlimit-network;a=blob;f=positive_localhost_tcp;hb=HEAD
> show otherwise.)

I meant that connected or accepted socket will not be able to send data
via send() call, but will be able to receive data using recv().

--
Evgeniy Polyakov