linux-kernel - Re: [PATCH v2 11/14] networking: Update to register_net_sysctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Aug 2023 17:23:38 +0200
From:   Joel Granados <joel.granados@...il.com>
To:     Przemek Kitszel <przemyslaw.kitszel@...el.com>
Cc:     mcgrof@...nel.org, Catalin Marinas <catalin.marinas@....com>,
        Iurii Zaikin <yzaikin@...gle.com>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Kees Cook <keescook@...omium.org>,
        "D. Wythe" <alibuda@...ux.alibaba.com>, mptcp@...ts.linux.dev,
        Jakub Kicinski <kuba@...nel.org>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Paolo Abeni <pabeni@...hat.com>, coreteam@...filter.org,
        Jan Karcher <jaka@...ux.ibm.com>,
        Alexander Aring <alex.aring@...il.com>,
        Will Deacon <will@...nel.org>,
        Stefan Schmidt <stefan@...enfreihafen.org>,
        Matthieu Baerts <matthieu.baerts@...sares.net>,
        bridge@...ts.linux-foundation.org,
        linux-arm-kernel@...ts.infradead.org,
        Joerg Reuter <jreuter@...na.de>, Julian Anastasov <ja@....bg>,
        David Ahern <dsahern@...nel.org>,
        netfilter-devel@...r.kernel.org, Wen Gu <guwen@...ux.alibaba.com>,
        linux-kernel@...r.kernel.org,
        Santosh Shilimkar <santosh.shilimkar@...cle.com>,
        linux-wpan@...r.kernel.org, lvs-devel@...r.kernel.org,
        Karsten Graul <kgraul@...ux.ibm.com>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        linux-sctp@...r.kernel.org, Tony Lu <tonylu@...ux.alibaba.com>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Ralf Baechle <ralf@...ux-mips.org>,
        Florian Westphal <fw@...len.de>, willy@...radead.org,
        Heiko Carstens <hca@...ux.ibm.com>,
        "David S. Miller" <davem@...emloft.net>,
        linux-rdma@...r.kernel.org, Roopa Prabhu <roopa@...dia.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Simon Horman <horms@...ge.net.au>,
        Mat Martineau <martineau@...nel.org>, josh@...htriplett.org,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Eric Dumazet <edumazet@...gle.com>, linux-hams@...r.kernel.org,
        Wenjia Zhang <wenjia@...ux.ibm.com>,
        linux-fsdevel@...r.kernel.org, linux-s390@...r.kernel.org,
        Xin Long <lucien.xin@...il.com>,
        Nikolay Aleksandrov <razor@...ckwall.org>,
        netdev@...r.kernel.org, rds-devel@....oracle.com
Subject: Re: [PATCH v2 11/14] networking: Update to register_net_sysctl_sz

On Tue, Aug 08, 2023 at 01:20:36PM +0200, Przemek Kitszel wrote:
> On 7/31/23 09:17, Joel Granados wrote:
> > Move from register_net_sysctl to register_net_sysctl_sz for all the
> > networking related files. Do this while making sure to mirror the NULL
> > assignments with a table_size of zero for the unprivileged users.
> > 
> > We need to move to the new function in preparation for when we change
> > SIZE_MAX to ARRAY_SIZE() in the register_net_sysctl macro. Failing to do
> > so would erroneously allow ARRAY_SIZE() to be called on a pointer. We
> > hold off the SIZE_MAX to ARRAY_SIZE change until we have migrated all
> > the relevant net sysctl registering functions to register_net_sysctl_sz
> > in subsequent commits.
> > 
> > An additional size function was added to the following files in order to
> > calculate the size of an array that is defined in another file:
> >      include/net/ipv6.h
> >      net/ipv6/icmp.c
> >      net/ipv6/route.c

...

> > diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> > index 64e873f5895f..51c6cdae8723 100644
> > --- a/net/ipv6/route.c
> > +++ b/net/ipv6/route.c
> > @@ -6447,14 +6447,19 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
> >   		table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
> >   		table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
> >   		table[10].data = &net->ipv6.sysctl.skip_notify_on_dev_down;
> > -
> > -		/* Don't export sysctls to unprivileged users */
> > -		if (net->user_ns != &init_user_ns)
> > -			table[1].procname = NULL;
Here I remove the setting of the procname to NULL for ipv6 sysctl
registers in route.c and I do not replace that assignment anywhere.
This means that we will export sysctls to unprivilged users for ipv6.
I'll correct this in V3.

> >   	}
> >   	return table;
> >   }
> > +
> > +size_t ipv6_route_sysctl_table_size(struct net *net)
> > +{
> > +	/* Don't export sysctls to unprivileged users */
> > +	if (net->user_ns != &init_user_ns)
> > +		return 0;
> > +
> > +	return ARRAY_SIZE(ipv6_route_table_template);
> > +}
> >   #endif
> >   static int __net_init ip6_route_net_init(struct net *net)

-- 

Joel Granados

Download attachment "signature.asc" of type "application/pgp-signature" (660 bytes)