| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 26 Jun 2014 14:55:52 +0200 From: Piotr Wilczek <p.wilczek@...sung.com> To: David Miller <davem@...emloft.net> Cc: netdev@...r.kernel.org, Kyungmin Park <kyungmin.park@...sung.com>, Juho Son <juho80.son@...sung.com>, Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>, Jan Kaluza <jkaluza@...hat.com>, Piotr Wilczek <p.wilczek@...sung.com> Subject: [PATCH net-next V2 0/2] send process status in SCM_PROCINFO Server-like processes in many cases need credentials and other metadata of the peer, to decide if the calling process is allowed to request a specific action, or the server just wants to log away this type of information for auditing tasks. The current practice to retrieve such process metadata is to look that information up in procfs with the $PID received over SCM_CREDENTIALS. This is sufficient for long-running tasks, but introduces a race which cannot be worked around for short-living processes; the calling process and all the information in /proc/$PID/ is gone before the receiver of the socket message can look it up. Changes introduced in this patchset can also increase performance of such server-like processes, because current way of opening and parsing /proc/$PID/* files is much more expensive than receiving these metadata using SCM. As an example, this patch set improves systemd-journald performance by about 20%. Generally, performance improvement depends on how heavily procfs is read the calling process. http://comments.gmane.org/gmane.comp.sysutils.systemd.devel/19467 This patch set is split in two patches: - the first adds library to retrive process information without dependency on procfs. - the second introduces a new SCM type called SCM_PROCINFO to optionally allow the direct attaching of process status to SCM. This patchset is reworked version of: https://lkml.org/lkml/2014/1/13/42 Changes for v2: - new patch with new proc info library - removed extern declaration - removed duplication code for parsing process information Piotr Wilczek (2): lib:proc_info:add library to get process information Send process status in SCM_PROCINFO arch/alpha/include/uapi/asm/socket.h | 2 + arch/avr32/include/uapi/asm/socket.h | 2 + arch/cris/include/uapi/asm/socket.h | 2 + arch/frv/include/uapi/asm/socket.h | 2 + arch/ia64/include/uapi/asm/socket.h | 2 + arch/m32r/include/uapi/asm/socket.h | 2 + arch/mips/include/uapi/asm/socket.h | 2 + arch/mn10300/include/uapi/asm/socket.h | 2 + arch/parisc/include/uapi/asm/socket.h | 2 + arch/powerpc/include/uapi/asm/socket.h | 2 + arch/s390/include/uapi/asm/socket.h | 2 + arch/sparc/include/uapi/asm/socket.h | 2 + fs/proc/Kconfig | 1 + fs/proc/array.c | 476 +---------------------- fs/proc/task_mmu.c | 66 ---- fs/proc/task_nommu.c | 114 ------ include/linux/net.h | 1 + include/linux/proc_info.h | 35 ++ include/linux/socket.h | 2 + include/net/af_unix.h | 9 + include/net/scm.h | 33 ++ include/uapi/asm-generic/socket.h | 2 + lib/Kconfig | 5 + lib/Makefile | 2 + lib/proc_info.c | 686 +++++++++++++++++++++++++++++++++ net/Kconfig | 1 + net/core/scm.c | 166 ++++++++ net/core/sock.c | 11 + net/unix/af_unix.c | 70 ++++ 29 files changed, 1057 insertions(+), 647 deletions(-) create mode 100644 include/linux/proc_info.h create mode 100644 lib/proc_info.c -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists