netdev - Re: [PATCH v4 net-next 8/9] af_unix: Introduce SO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6827681a5a986_2af52b29458@willemb.c.googlers.com.notmuch>
Date: Fri, 16 May 2025 12:30:18 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>, 
 "David S. Miller" <davem@...emloft.net>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Paolo Abeni <pabeni@...hat.com>, 
 Willem de Bruijn <willemb@...gle.com>
Cc: Simon Horman <horms@...nel.org>, 
 Christian Brauner <brauner@...nel.org>, 
 Kuniyuki Iwashima <kuniyu@...zon.com>, 
 Kuniyuki Iwashima <kuni1840@...il.com>, 
 netdev@...r.kernel.org
Subject: Re: [PATCH v4 net-next 8/9] af_unix: Introduce SO_PASSRIGHTS.

Kuniyuki Iwashima wrote:
> As long as recvmsg() or recvmmsg() is used with cmsg, it is not
> possible to avoid receiving file descriptors via SCM_RIGHTS.
> 
> This behaviour has occasionally been flagged as problematic, as
> it can be (ab)used to trigger DoS during close(), for example, by
> passing a FUSE-controlled fd or a hung NFS fd.
> 
> For instance, as noted on the uAPI Group page [0], an untrusted peer
> could send a file descriptor pointing to a hung NFS mount and then
> close it.  Once the receiver calls recvmsg() with msg_control, the
> descriptor is automatically installed, and then the responsibility
> for the final close() now falls on the receiver, which may result
> in blocking the process for a long time.
> 
> Regarding this, systemd calls cmsg_close_all() [1] after each
> recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS.
> 
> However, this cannot work around the issue at all, because the final
> fput() may still occur on the receiver's side once sendmsg() with
> SCM_RIGHTS succeeds.  Also, even filtering by LSM at recvmsg() does
> not work for the same reason.
> 
> Thus, we need a better way to refuse SCM_RIGHTS at sendmsg().
> 
> Let's introduce SO_PASSRIGHTS to disable SCM_RIGHTS.
> 
> Note that this option is enabled by default for backward
> compatibility.
> 
> Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0]
> Link: https://github.com/systemd/systemd/blob/v257.5/src/basic/fd-util.c#L612-L628 #[1]
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>