linux-kernel - Re: [PATCH v3] add group restriction bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241001111516.GA23907@redhat.com>
Date: Tue, 1 Oct 2024 13:15:17 +0200
From: Oleg Nesterov <oleg@...hat.com>
To: Stas Sergeev <stsp2@...dex.ru>
Cc: linux-kernel@...r.kernel.org, Alexander Viro <viro@...iv.linux.org.uk>,
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	Jens Axboe <axboe@...nel.dk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Catalin Marinas <catalin.marinas@....com>,
	Florent Revest <revest@...omium.org>, Kees Cook <kees@...nel.org>,
	Palmer Dabbelt <palmer@...osinc.com>,
	Charlie Jenkins <charlie@...osinc.com>,
	Benjamin Gray <bgray@...ux.ibm.com>, Helge Deller <deller@....de>,
	Zev Weiss <zev@...ilderbeest.net>,
	Samuel Holland <samuel.holland@...ive.com>,
	linux-fsdevel@...r.kernel.org,
	Eric Biederman <ebiederm@...ssion.com>,
	Andy Lutomirski <luto@...nel.org>,
	Josh Triplett <josh@...htriplett.org>
Subject: Re: [PATCH v3] add group restriction bitmap

I can't comment the intent, just some nits about implementation.

On 09/30, Stas Sergeev wrote:
>
>  struct group_info {
>  	refcount_t	usage;
> +	unsigned int	restrict_bitmap;

Why not unsigned long?

>  int groups_search(const struct group_info *group_info, kgid_t grp)
>  {
>  	unsigned int left, right;
> @@ -105,7 +108,7 @@ int groups_search(const struct group_info *group_info, kgid_t grp)
>  		else if (gid_lt(grp, group_info->gid[mid]))
>  			right = mid;
>  		else
> -			return 1;
> +			return mid + 1;

Suppose we change groups_search()

	--- a/kernel/groups.c
	+++ b/kernel/groups.c
	@@ -104,8 +104,11 @@ int groups_search(const struct group_info *group_info, kgid_t grp)
				left = mid + 1;
			else if (gid_lt(grp, group_info->gid[mid]))
				right = mid;
	-		else
	-			return 1;
	+		else {
	+			bool r = mid < BITS_PER_LONG &&
	+				 test_bit(mid, &group_info->restrict_bitmap);
	+			return r ? -1 : 1;
	+		}
		}
		return 0;
	 }

so that it returns, say, -1 if the found grp is restricted.

Then everything else can be greatly simplified, afaics...

Oleg.