linux-kernel - Does SCM_RIGHTS limit on fd array apply to a particular cmsghdr or the whole ancillary data?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <82d68b42-8dc1-7730-a173-3ae7c44bcb16@datenwolf.net>
Date:   Wed, 9 Dec 2020 20:23:58 +0100
From:   Wolfgang Draxinger <list@...enwolf.net>
To:     LKML Mailing List <linux-kernel@...r.kernel.org>
Subject: Does SCM_RIGHTS limit on fd array apply to a particular cmsghdr or
 the whole ancillary data?

Hi,

in the documentation on SCM_RIGHTS the maximum number of file
descriptors that can be passed is described as (release 5.09 of the
Linux man-pages project):

| SCM_RIGHTS
|   Send or receive a set of open file descriptors from another
|   process. The data portion contains an integer array of the file
|   descriptors.
| (...)
|   The kernel constant SCM_MAX_FD defines a limit on the number of
        |   file descriptors in the array.  Attempting to send an array
            |   larger than this limit causes sendmsg(2) to fail with
the error              |   EINVAL.

In my reading this might be interpreted as SCM_MAX_FD per SCM_RIGHTS
cmsghdr, xor SCM_MAX_FD per sendmsg. It would be good to know, which one
it is. So which is the proper strategy if I have to pass more than
SCM_MAX_FD file descriptors between processes?

Cheers,
Wolfgang