From patchwork Thu Jun 29 13:27:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matteo Rizzo X-Patchwork-Id: 11434 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp9648006vqr; Thu, 29 Jun 2023 06:44:45 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4ByrxmRTrg1zqMA1Tg0a6u7vUcUOlIUorNSbbTdZ2i573Oqkyz2X6Wa4hrEea/96/KgoSk X-Received: by 2002:a05:6a20:440d:b0:123:149b:a34f with SMTP id ce13-20020a056a20440d00b00123149ba34fmr28073433pzb.1.1688046284705; Thu, 29 Jun 2023 06:44:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688046284; cv=none; d=google.com; s=arc-20160816; b=bb+S9Qph3MBW22FE2oTWFJs5qczRD+hZ5GuR0Ij6Ml+bubMm/TcWERS03YKwaBr6Ah Tvv+bhtPXVu0TqrYwB8rZT9m4+wsfWJ6DM77/o3O5KtzVul4mL2JH+QmOBBz7rnHYGPy RCLKw55s2GR4RY0QYh2baI0tvefmjSOzgIcyVnXuuI4ueBQi0FxJmIUYO+8ryV7f3YEq kicDE/GXwlK1XYdwFMokpcPSNf+q8dBh/TDgM1+uocIxsHOzbc0CZTVXQyCwUjlls0FB Tx/LEOYMK/yNWHKcW1zaoInGAUTqzxrjMtxfXf5ThRsmynx5RV3RYkIe5NY+jUh7BDYw BKQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :dkim-signature; bh=RBX/ZfKOmZybnCy+TJCC1Khkdf0JaxSO6nOHYL3602s=; fh=ZfpwLDVlmNgvezOSXzZuuGmhElGHltohWawYF6yzPNw=; b=rhxwLNQlt46Gy3jAZXSIfVSkMb//Wj01IKu2j5MJ5C/zpzfne1X6Sp1wchnqLwHuts yGWNuTdHC7dkqBjnc94SOVLY2TSnrE+Tt/iN5VDRWuFAkFj2sBBZ5WxmSq1jejSenE/9 QF4UWFpVgPehdAESfMXxsSvRiNyHSmdw2EHQHA3elJVFTY7PIN+g/BDZDL1tb65YUqQb VeA0VNxfzb73+tc2PTmut7Muvft6uZCO6MIvqeFGaN0atohUIxGq0p8u2YCaxT/AmkGe XiA4OO9Yn7AN5Y156xhvznwQmK+0QqPb0Xp4VLZArqSuqGGBtEXfW1QxPTkRHOy1sDHz Btrw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="74Ac2Po/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 33-20020a630a21000000b0054fd06a3585si10310560pgk.158.2023.06.29.06.44.31; Thu, 29 Jun 2023 06:44:44 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="74Ac2Po/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232011AbjF2N1m (ORCPT + 99 others); Thu, 29 Jun 2023 09:27:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231855AbjF2N1k (ORCPT ); Thu, 29 Jun 2023 09:27:40 -0400 Received: from mail-ed1-x54a.google.com (mail-ed1-x54a.google.com [IPv6:2a00:1450:4864:20::54a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 998422689 for ; Thu, 29 Jun 2023 06:27:39 -0700 (PDT) Received: by mail-ed1-x54a.google.com with SMTP id 4fb4d7f45d1cf-51dd18ca0a2so450196a12.1 for ; Thu, 29 Jun 2023 06:27:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1688045258; x=1690637258; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=RBX/ZfKOmZybnCy+TJCC1Khkdf0JaxSO6nOHYL3602s=; b=74Ac2Po/8YOM/O803qScwIOjP8gYg8G4wgHxyw5rZCTNWIAlHSyGb9SzNo9Xnf5sQE qzan4SM0hGh4dAHfg8JrtmpEF/sZ2DHeotQDS3yXSGNuwTKxqCLJUy2FBE/GS6RJ0JBj lMH/r5u8eQ5j8+xaJAqcCaNWpwxYsUaf0VJkMFMj0Xztjh9h3z0me4Pm2E75CiDzgW1O gopD6LcMIvae2qAnyV0jf4iFCXfxK2l2GJApT0fhEWXmyerE3Ghhmezd6x5eVhW/VGEJ /xStz4RtSKlO3l1WpCXgOc910qGmb1vb7ex4f23C/e4mVgmMeZfJ67s5z/MxghQ6zRUA gsgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688045258; x=1690637258; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=RBX/ZfKOmZybnCy+TJCC1Khkdf0JaxSO6nOHYL3602s=; b=O+mTCEB4Lx+2cnKq19xGBX6Os3gQo1xbGymX6Uv3OBM4OfpwOAaczOZuM4s4+h7RiT eUHZoDMDnxs1dQVJBBhSsDTWeUBIPf0FyT/wMRR+mJ4mU+tpNC6wlOcP9LvsY98goKri TMSCnFCgwsXASijYB5TXwccraYB+bcUb+06latFUDb2yGk5lY5FEP1FDFK3rOQ6Lkmd2 FDMqrk44geIT/1ovbl+e2qvfO2XvQny+ZlvklqdMpLNyFHpGOXXkDlflIxvu3wLRdO3a VXsGv2QmR7XAdfKm7s5bLsatGZF6WVgYiSQDcuUzwYfgP5n1Z7WAnxQUlfK7fN5ZX7+2 4mwQ== X-Gm-Message-State: AC+VfDxqYQokUL1a92TAosbJQs5DAXekQsn07mbUqKoluYFZfUX/szx6 d94lhqrYotxXap9JRqilkKAJvPqaLPv9M2MRIA== X-Received: from mr-cloudtop2.c.googlers.com ([fda3:e722:ac3:cc00:31:98fb:c0a8:fb5]) (user=matteorizzo job=sendgmr) by 2002:a50:cdc8:0:b0:51d:7d61:a833 with SMTP id h8-20020a50cdc8000000b0051d7d61a833mr1674482edj.0.1688045258087; Thu, 29 Jun 2023 06:27:38 -0700 (PDT) Date: Thu, 29 Jun 2023 13:27:10 +0000 Mime-Version: 1.0 X-Mailer: git-send-email 2.41.0.162.gfafddb0af9-goog Message-ID: <20230629132711.1712536-1-matteorizzo@google.com> Subject: [PATCH v2 0/1] Add a sysctl to disable io_uring system-wide From: Matteo Rizzo To: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, io-uring@vger.kernel.org Cc: matteorizzo@google.com, jordyzomer@google.com, evn@google.com, poprdi@google.com, corbet@lwn.net, axboe@kernel.dk, asml.silence@gmail.com, akpm@linux-foundation.org, keescook@chromium.org, rostedt@goodmis.org, dave.hansen@linux.intel.com, ribalda@chromium.org, chenhuacai@kernel.org, steve@sk2.org, gpiccoli@igalia.com, ldufour@linux.ibm.com, bhe@redhat.com, oleksandr@natalenko.name X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770044820969847643?= X-GMAIL-MSGID: =?utf-8?q?1770044820969847643?= Over the last few years we've seen many critical vulnerabilities in io_uring[1] which could be exploited by an unprivileged process to gain control over the kernel. This patch introduces a new sysctl which disables the creation of new io_uring instances system-wide. The goal of this patch is to give distros, system admins, and cloud providers a way to reduce the risk of privilege escalation through io_uring where disabling it with seccomp or at compile time is not practical. For example a distro or cloud provider might want to disable io_uring by default and have users enable it again if they need to run a program that requires it. The new sysctl is designed to let a user with root on the machine enable and disable io_uring systemwide at runtime without requiring a kernel recompilation or a reboot. [1] Link: https://goo.gle/limit-iouring --- v2: * Documentation style fixes * Add a third level that only disables io_uring for unprivileged processes Matteo Rizzo (1): Add a new sysctl to disable io_uring system-wide Documentation/admin-guide/sysctl/kernel.rst | 19 +++++++++++++ io_uring/io_uring.c | 30 +++++++++++++++++++++ 2 files changed, 49 insertions(+)