linux-kernel - Re: [PATCH] ipc: add set_ownership() and permissions() callbacks for posix mqueue sysctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210811155132.GA13845@www>
Date:   Wed, 11 Aug 2021 08:51:32 -0700
From:   CGEL <cgel.zte@...il.com>
To:     Christian Brauner <christian.brauner@...ntu.com>
Cc:     keescook@...omium.org, ktkhai@...tuozzo.com,
        jamorris@...ux.microsoft.com, varad.gautam@...e.com,
        legion@...nel.org, dbueso@...e.de, linux-kernel@...r.kernel.org,
        Ran Xiaokai <ran.xiaokai@....com.cn>
Subject: Re: [PATCH] ipc: add set_ownership() and permissions() callbacks for
 posix mqueue sysctl

On Tue, Aug 03, 2021 at 04:01:33PM +0200, Christian Brauner wrote:
> - Create a new mount and ipc namespace and mount mqueue in there.
>   Read and remember the /proc/sys/fs/mqueue/queues_max value.
> - Now create a new user + mount namespace pair in a child process.
> - Mount mqueue filesystem in there.
> - Set /proc/sys/fs/mqueue/queues_max to 1.
> - Call mq_open with O_CREAT in the child process the first time and
>   expect success keeping the fd open.
> - Call mq_open with O_CREAT in the child process a second time and
>   expect failure because of:
> 
> 	if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
> 	    !capable(CAP_SYS_RESOURCE)) {
> 		error = -ENOSPC;
> 		goto out_unlock;
> 	}
> 	ipc_ns->mq_queues_count++;
> 	spin_unlock(&mq_lock);
> 
> - Reap the child in the parent expecting success.
> - Verify that the /proc/sys/fs/mqueue/queues_max value in the parent is
>   identical to the value you read before creating the child.

Hi, Christian                                                                                                                                                                                                             
Thanks for your patient explanation of the kselftest code.                                                   
Please give comments on this test code. 

int get_mq_queues_max(void)
{
	int fd;
	char buf[16];
	int val = -1;

	fd = open("/proc/sys/fs/mqueue/queues_max", O_RDONLY);
	if (fd >= 0) {
		if (read(fd, buf, sizeof(buf)) > 0)
			val = atoi(buf);

		close(fd);
		return val;
	}
	return val;
}

TEST(mqueue_sysctl)
{
	pid_t pid;
	int qmax1, qmax2;
	
	/*
	> - Create a new mount and ipc namespace and mount mqueue in there.
	This test code is intended to run as non-root user,
	so unshare(CLONE_NEWNS) is not allowed, so i skip this step.
	 */

	chdir(getenv("HOME"));
	/* read and stash the original sysctl value */
	qmax1 = get_mq_queues_max();
	ASSERT_GE(qmax1, 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		ASSERT_EQ(prepare_unpriv_mountns(), 0);
	
	/*
	A new mqueue filesystem instance will be mounted by kernel internally 
	when a ipc namespace created. I don't quite get the point here why we should 
	mount mqueue manually?
	 */
		if (mkdir("./mqueue", 755) && errno != EEXIST)
			SKIP(return, "mkdir /dev/mqueue failed");

		ASSERT_EQ(mount("none", "./mqueue", "mqueue", MS_NOATIME, NULL), 0);

		/* modify the sysctl value in new ipc namesapce */
		ASSERT_EQ(write_file("/proc/sys/fs/mqueue/queues_max", "1", 1), 0);

		ASSERT_GE(mq_open("/new_ns1",  O_RDWR | O_CREAT, 0644, NULL), 0);

		/* mq_open() should fail as exceeding of queues_max */
		ASSERT_EQ(mq_open("/new_ns2",  O_RDWR | O_CREAT, 0644, NULL), -1);

		ASSERT_EQ(mq_unlink("/new_ns1"), 0);
		ASSERT_EQ(umount("./mqueue"), 0);

		exit(0);
	}

	ASSERT_EQ(wait_for_pid(pid), 0);

	qmax2 = get_mq_queues_max();
	ASSERT_EQ(qmax1, qmax2);
}

TEST_HARNESS_MAIN

for this test code ,i add a new file mq_sysctl_test.c, a makefile and a config file 
with content
CONFIG_USER_NS=y
CONFIG_POSIX_MQUEUE_SYSCTL=y

but i am not sure which directory to place thess files,
for the original tools/testing/selftests/mqueue/
i think this directory don't need a config file, but for this test code,
this config file is needed,
do you have any suggestion on which directory this test code should place?