linux-kernel - Re: [PATCH,TRIVIAL] AF_UNIX, accept() and addrlen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080324122700.GK4434@implementation.uk.xensource.com>
Date:	Mon, 24 Mar 2008 12:27:00 +0000
From:	Samuel Thibault <samuel.thibault@...-lyon.org>
To:	Andi Kleen <andi@...stfloor.org>,
	David Miller <davem@...emloft.net>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH,TRIVIAL] AF_UNIX, accept() and addrlen

Samuel Thibault, le Mon 24 Mar 2008 12:17:19 +0000, a écrit :
> Andi Kleen, le Mon 24 Mar 2008 12:50:10 +0100, a écrit :
> > Samuel Thibault <samuel.thibault@...-lyon.org> writes:
> > > David Miller, le Sun 23 Mar 2008 21:56:41 -0700, a écrit :
> > > > From: Samuel Thibault <samuel.thibault@...-lyon.org>
> > > > Date: Sat, 8 Mar 2008 02:23:21 +0000
> > > > 
> > > > > Accept and getpeername are supposed to return the amount of bytes
> > > > > written in the returned address.  However, on unnamed sockets, only
> > > > > sizeof(short) is returned, while a 0 is put in the sun_path member.
> > > > > This patch adds 1 for that additional byte.
> > > > > 
> > > > > Signed-off-by: Samuel Thibault <samuel.thibault@...-lyon.org>
> > > > 
> > > > This change isn't correct.  It's the fact that the
> > > > length returned is sizeof(short) that tells the caller
> > > > that the unix socket is unnamed.
> > > 
> > > Mmm, where that is documented?
> > > 
> > > I can't find any details about that in SUS, and man 7 unix says
> > > 
> > > `If sun_path starts with a null byte ('' '), then it refers to the
> > > abstract namespace main- tained by the Unix protocol module.'
> > 
> > [I wrote unix(7) originally]. The abstract name space is a Linux
> > extension and there is no written standard and whatever the kernel
> > implements is the de-facto standard. If unix(7) differs in anything
> > from what the code does please send patches to the manpages
> > maintainer.
> 
> Oops, sorry, we are not talking about abstract namespace actually (their
> sockaddr length are necessarily bigger than sizeof(sa_family_t) since
> they need some data), but unamed sockets.  So the Address Format
> paragraph just misses description of unnamed sockets.

How about this?

--- unix.7.orig	2008-03-24 12:24:37.000000000 +0000
+++ unix.7	2008-03-24 12:24:56.000000000 +0000
@@ -87,6 +87,15 @@
 bytes in
 .IR sun_path .
 Note that names in the abstract namespace are not zero-terminated.
+If the size returned by
+.BR accept
+or
+.BR getpeername
+is
+.IR sizeof(sa_family_t) ,
+then it refers to a unnamed socket and
+.I sun_path
+should not be read.
 .SS Socket Options
 For historical reasons these socket options are specified with a
 .B SOL_SOCKET

Samuel
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/