linux-kernel - Re: fanotify: the fscking all notification system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 11 Jul 2009 12:18:16 -0700
From:	Sukadev Bhattiprolu <sukadev@...ux.vnet.ibm.com>
To:	Matt Helsley <matthltc@...ibm.com>
Cc:	Eric Paris <eparis@...hat.com>, linux-kernel@...r.kernel.org,
	malware-list@...sg.printk.net,
	Containers <containers@...ts.linux-foundation.org>
Subject: Re: fanotify: the fscking all notification system

| > struct fanotify_event_metadata {
| >         __u32 event_len;
| >         __s32 fd;
| >         __u32 mask;
| >         __u32 f_flags;
| >         pid_t pid;
| >         pid_t tgid;
| >         __u64 cookie;
| > }  __attribute__((packed));
| 
| Since it passes pids from the kernel to userspace via a socket I suspect
| this needs input from the folks working on pid namespaces. The events may
| need to be dropped if the pid namespace of the event's origin doesn't
| match that of the destination. Otherwise the pid would be ambiguous and
| this interface will only work for tasks in the initial pid namespace.

If we do have the destination pid namespace, we could translate the pid
of the process modifying the file, into the pid namespace of the process
receiving the notification, like we do in mq_notify().

So when a process in an ancestor or unrelated pid namespace modifies the
file, the si_pid would get set to 0. 

Sukadev
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/