netdev - Re: [PATCH 1/2] c/r: Add AF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 08 Jul 2009 14:16:56 -0400
From:	Oren Laadan <orenl@...columbia.edu>
To:	Dan Smith <danms@...ibm.com>
CC:	containers@...ts.osdl.org, netdev@...r.kernel.org,
	Alexey Dobriyan <adobriyan@...il.com>
Subject: Re: [PATCH 1/2] c/r: Add AF_UNIX support (v5)



Dan Smith wrote:
> OL> It will mostly fix the buffer limits, but not entirely: if the
> OL> original socket first raised the limits above defualt, then sent
> OL> data (not read by peer), then you'll still need to adjust the
> OL> limit before restoring the buffers.
> 
> If we cap the buffers in the checkpoint image to the current system
> limit (sysctl) and then set the per-socket buffer limit (after reading
> them in) to the value in the checkpoint image then we get the desired
> result, right?

Hmmm.... still not -- if user has CAP_NET_ADMIN then there is
no upper bound on so_{snd,rcv}buf.


So I guess the right way to do it is: (1) set buf size to the size
of saved data, (2) populate buffer, (3) restore so_{snd,rcv}buf.

#1 and #3 need to be done under the same security restrictions,
of course, as any change to the buffer bounds.

Oren.

> 
> OL> I can't predict the future, but it's been there forever...
> 
> Yeah, after I sent that I remembered that the magic 108 is in the
> sockaddr_un structure which is a userspace API and therefore not
> likely to change.
> 
> OL> But the point is that I would interpret ENOSPC as "storage/space
> OL> is exhausted", while here the error is that this value is simply
> OL> invalid for the particular kernel on which the restart occurs.
> 
> Yep, fair enough.
> 
> OL> In the original system, once the file becomes unreachable it
> OL> cannot be made reachable again by simple (re)mounting, IOW it can
> OL> no longer be connected-to.
> 
> Ah, I thought you meant "was reachable on the source system and not
> reachable on the target system".  I'm with you now :)
> 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html