netdev - Re: [PATCH v1 bpf-next 4/5] bpf: Add kfunc to scrub SCM_RIGHTS at security_unix_may

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQ+bk8Qt=Zo4S2MZxB+O4G4q_EXB4P0BtJ3LjgbJuY_9_w@mail.gmail.com>
Date: Mon, 5 May 2025 17:56:49 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
Cc: Alexei Starovoitov <ast@...nel.org>, Andrii Nakryiko <andrii@...nel.org>, bpf <bpf@...r.kernel.org>, 
	Christian Brauner <brauner@...nel.org>, Casey Schaufler <casey@...aufler-ca.com>, 
	Daniel Borkmann <daniel@...earbox.net>, Eduard <eddyz87@...il.com>, 
	Günther Noack <gnoack@...gle.com>, 
	Hao Luo <haoluo@...gle.com>, James Morris <jmorris@...ei.org>, 
	John Fastabend <john.fastabend@...il.com>, Jiri Olsa <jolsa@...nel.org>, 
	KP Singh <kpsingh@...nel.org>, Kuniyuki Iwashima <kuni1840@...il.com>, 
	LSM List <linux-security-module@...r.kernel.org>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Mickaël Salaün <mic@...ikod.net>, 
	Network Development <netdev@...r.kernel.org>, Ondrej Mosnacek <omosnace@...hat.com>, 
	Paul Moore <paul@...l-moore.com>, Stanislav Fomichev <sdf@...ichev.me>, selinux@...r.kernel.org, 
	"Serge E . Hallyn" <serge@...lyn.com>, Song Liu <song@...nel.org>, 
	Stephen Smalley <stephen.smalley.work@...il.com>, Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH v1 bpf-next 4/5] bpf: Add kfunc to scrub SCM_RIGHTS at security_unix_may_send().

On Mon, May 5, 2025 at 5:46 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
>
> From: Alexei Starovoitov <alexei.starovoitov@...il.com>
> Date: Mon, 5 May 2025 17:13:32 -0700
> > On Mon, May 5, 2025 at 3:00 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
> > >
> > > As Christian Brauner said [0], systemd calls cmsg_close_all() [1] after
> > > each recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS.
> > >
> > > However, this cannot work around the issue that close() for unwanted file
> > > descriptors could block longer because the last fput() could occur on
> > > the receiver side once sendmsg() with SCM_RIGHTS succeeds.
> > >
> > > Also, even filtering by LSM at recvmsg() does not work for the same reason.
> > >
> > > Thus, we need a better way to filter SCM_RIGHTS on the sender side.
> > >
> > > Let's add a new kfunc to scrub all file descriptors from skb in
> > > sendmsg().
> > >
> > > This allows the receiver to keep recv()ing the bare data and disallows
> > > the sender to impose the potential slowness of the last fput().
> > >
> > > If necessary, we can add more granular filtering per file descriptor
> > > after refactoring GC code and adding some fd-to-file helpers for BPF.
> > >
> > > Sample:
> > >
> > > SEC("lsm/unix_may_send")
> > > int BPF_PROG(unix_scrub_scm_rights,
> > >              struct socket *sock, struct socket *other, struct sk_buff *skb)
> > > {
> > >         struct unix_skb_parms *cb;
> > >
> > >         if (skb && bpf_unix_scrub_fds(skb))
> > >                 return -EPERM;
> > >
> > >         return 0;
> > > }
> >
> > Any other programmability do you need there?
>
> This is kind of PoC, and as Kumar mentioned, per-fd scrubbing
> is ideal to cover the real use cases.
>
> https://lore.kernel.org/netdev/CAP01T77STmncrPt=BsFfEY6SX1+oYNXhPeZ1HC9J=S2jhOwQoQ@mail.gmail.com/
>
> for example:
> https://uapi-group.org/kernel-features/#filtering-on-received-file-descriptors

Fair enough.
Would be great to have them as selftests to make sure that advanced
use cases are actually working.