linux-kernel - Re: [PATCH v1 2/3] cgroup: allow for unprivileged subtree management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Jul 2016 08:59:12 +1000
From:	Aleksa Sarai <asarai@...e.de>
To:	Tejun Heo <tj@...nel.org>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Li Zefan <lizefan@...wei.com>,
	Johannes Weiner <hannes@...xchg.org>,
	"Serge E. Hallyn" <serge.hallyn@...ntu.com>,
	Aditya Kali <adityakali@...gle.com>,
	Chris Wilson <chris@...is-wilson.co.uk>,
	linux-kernel@...r.kernel.org, cgroups@...r.kernel.org,
	Christian Brauner <cbrauner@...e.de>, dev@...ncontainers.org,
	James Bottomley <James.Bottomley@...senpartnership.com>
Subject: Re: [PATCH v1 2/3] cgroup: allow for unprivileged subtree management

>> +static int cgroup_permission(struct inode *inode, struct kernfs_node *kn,
>> +			     int mask)
>> +{
>> +	int ret;
>> +	struct cgroup *cgroup;
>> +	struct cgroup_namespace *cgroupns;
>> +
>> +	/*
>> +	 * First, compute the generic_permission return value. In most cases
>> +	 * this will succeed and we can also avoid duplicating this code.
>> +	 */
>> +
>> +	cgroup = kn->priv;
>> +	cgroup_get(cgroup);
>
> This pattern which is repated for cgroupns doesn't make sense.  The
> code is already assuming that the cgroup is safe to deref.  Getting
> its reference doesn't do anything.  Getting it here would only make
> sense if the pointer is passed to an asynchronous context.

I'll send out a fixed patchset once we figure out the 
cgroups_proc_write_permission() stuff.

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/