linux-kernel - [GIT PULL] ipc: per namespace ipc sysctl changes for v5.19

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <875ylh8xxx.fsf@email.froward.int.ebiederm.org>
Date:   Fri, 03 Jun 2022 12:21:46 -0500
From:   "Eric W. Biederman" <ebiederm@...ssion.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     <linux-kernel@...r.kernel.org>, Alexey Gladkov <legion@...nel.org>,
        Linux Containers <containers@...ts.linux.dev>
Subject: [GIT PULL] ipc: per namespace ipc sysctl changes for v5.19

Linus,

Please pull the per-namespace-ipc-sysctls-for-v5.19 tag from the git tree:

  git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git per-namespace-ipc-sysctls-for-v5.19
  HEAD: 38cd5b12b7854941ede1954cf5a2393eb94b5d37 ipc: Remove extra braces

These changes update the ipc sysctls so that they are fundamentally
per ipc namespace.  Previously these sysctls depended upon a hack to
simulate being per ipc namespace by looking up the ipc namespace in
read or write.  With this set of changes the ipc sysctls are
registered per ipc namespace and open looks up the ipc namespace.

Not only does this series of changes ensure the traditional binding at
open time happens, but it sets a foundation for being able to relax the
permission checks to allow a user namspace root to change the ipc sysctls
for an ipc namespace that the user namespace root requires.  To do this
requires the ipc namespace to be known at open time.

These changes were sent for v5.18[1] but were dropped because some
additional cleanups were requested.  Linus has given his nod[2] to the
cleanups so I hope enough cleanups are present this time.

[1] https://lkml.kernel.org/r/877d8kfmdp.fsf@email.froward.int.ebiederm.org
[2] https://lkml.kernel.org/r/CAHk-=whi2SzU4XT_FsdTCAuK2qtYmH+-hwi1cbSdG8zu0KXL=g@mail.gmail.com

Alexey Gladkov (6):
      ipc: Store mqueue sysctls in the ipc namespace
      ipc: Store ipc sysctls in the ipc namespace
      ipc: Use the same namespace to modify and validate
      ipc: Remove extra1 field abuse to pass ipc namespace
      ipc: Check permissions for checkpoint_restart sysctls at open time
      ipc: Remove extra braces

 include/linux/ipc_namespace.h |  37 +++++++-
 ipc/ipc_sysctl.c              | 205 +++++++++++++++++++++++++-----------------
 ipc/mq_sysctl.c               | 121 +++++++++++++------------
 ipc/mqueue.c                  |  10 +--
 ipc/namespace.c               |  10 +++
 5 files changed, 238 insertions(+), 145 deletions(-)

Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>

p.s. My apologies for this coming in so late.  Everyone in the house has
been sick.