linux-kernel - Re: [PATCH v3 0/6] ipc: Clamp *mni to the real IPCMNI limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Mar 2018 18:23:35 +0000
From:   "Luis R. Rodriguez" <mcgrof@...nel.org>
To:     Waiman Long <longman@...hat.com>
Cc:     "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v3 0/6] ipc: Clamp *mni to the real IPCMNI limit

On Thu, Mar 01, 2018 at 12:43:34PM -0500, Waiman Long wrote:
> v2->v3:
>  - Fix kdoc comment errors.
>  - Incorporate comments and suggestions from Luis R. Rodriguez.
>  - Add a patch to fix a typo error in fs/proc/proc_sysctl.c.
> 
> v1->v2:
>  - Add kdoc comments to the do_proc_do{u}intvec_minmax_conv_param
>    structures.
>  - Add a new flags field to the ctl_table structure for specifying
>    whether range clamping should be activated instead of adding new
>    sysctl parameter handlers.
>  - Clamp the semmni value embedded in the multi-values sem parameter.
> 
> v1 patch: https://lkml.org/lkml/2018/2/19/453
> v2 patch: https://lkml.org/lkml/2018/2/27/627
> 
> The sysctl parameters msgmni, shmmni and semmni have an inherent limit
> of IPC_MNI (32k). However, users may not be aware of that because they
> can write a value much higher than that without getting any error or
> notification. Reading the parameters back will show the newly written
> values which are not real.
> 
> Enforcing the limit by failing sysctl parameter write, however, can
> break existing user applications. To address this delemma, a new flags
> field is introduced into the ctl_table. The value CTL_FLAGS_CLAMP_RANGE
> can be added to any ctl_table entries to enable a looser range clamping
> without returning any error. For example,
> 
>   .flags = CTL_FLAGS_CLAMP_RANGE,
> 
> This flags value are now used for the range checking of shmmni,
> msgmni and semmni without breaking existing applications. If any out
> of range value is written to those sysctl parameters, the following
> warning will be printed instead.
> 
>   Kernel parameter "shmmni" was set out of range [0, 32768], clamped to 32768.
> 
> Reading the values back will show 32768 instead of some fake values.

I don't see any addition of respective tests cases, I thought I asked
for this. Please add respective tests cases for all the API you are
adding on lib/test_sysctl.c and respective tests on
tools/testing/selftests/sysctl/sysctl.sh

  Luis