linux-kernel - Re: [RFC PATCH] tmpfs: support user quotas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <25866.1320657093@turing-police.cc.vt.edu>
Date:	Mon, 07 Nov 2011 04:11:33 -0500
From:	Valdis.Kletnieks@...edu
To:	dave@....org
Cc:	Hugh Dickins <hughd@...gle.com>,
	Lennart Poettering <lennart@...ttering.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	lkml <linux-kernel@...r.kernel.org>, linux-mm@...ck.org
Subject: Re: [RFC PATCH] tmpfs: support user quotas

On Sun, 06 Nov 2011 18:15:01 -0300, Davidlohr Bueso said:

> @@ -1159,7 +1159,12 @@ shmem_write_begin(struct file *file, struct address_space *mapping,
>  			struct page **pagep, void **fsdata)

> +	if (atomic_long_read(&user->shmem_bytes) + len > 
> +	    rlimit(RLIMIT_TMPFSQUOTA))
> +		return -ENOSPC;

Is this a per-process or per-user limit?  If it's per-process, it doesn't
really do much good, because a user can use multiple processes to over-run the
limit (either intentionally or accidentally).

> @@ -1169,10 +1174,12 @@ shmem_write_end(struct file *file, struct address_space *mapping,
>  			struct page *page, void *fsdata)

> +	if (pos + copied > inode->i_size) {
>  		i_size_write(inode, pos + copied);
> +		atomic_long_add(copied, &user->shmem_bytes);
> +	}

If this is per-user, it's racy with shmem_write_begin() - two processes can hit
the write_begin(), be under quota by (say) 1M, but by the time they both
complete the user is 1M over the quota.

>  @@ -1535,12 +1542,15 @@ static int shmem_unlink(struct inode *dir, struct dentry *dentry)
> +	struct user_struct *user = current_user();
> +	atomic_long_sub(inode->i_size, &user->shmem_bytes);

What happens here if user 'fred' creates a file on a tmpfs, and then logs out so he has
no processes running, and then root does a 'find tmpfs -user fred -exec rm {} \;' to clean up?
We just decremented root's quota, not fred's....

Content of type "application/pgp-signature" skipped