From patchwork Wed Oct 19 08:24:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 5101 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp250213wrs; Wed, 19 Oct 2022 03:48:27 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6pG2KmohpljaswlhFuS49YSjHSsEIeD6GawtkGfmqpSHVkuoMnbE5rkFHSX2iJdFm/rVpT X-Received: by 2002:a17:906:7193:b0:78d:b87e:6aa5 with SMTP id h19-20020a170906719300b0078db87e6aa5mr6198082ejk.580.1666176507164; Wed, 19 Oct 2022 03:48:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666176507; cv=none; d=google.com; s=arc-20160816; b=XowwsV00A8R7V3S7eD0Kz5709kA/ZBajf0WyaEgbavo0cmVhLhy3hf3JMrp97R4UeD AgtX+e7ZKbdYQwBLvVVmQeWXZ4JTj82KzM6JQg1b/0coNqYXQ9zvBa0jcjvPuNLfLWMh ne70Ba02Dgg17L+pIAQI1bZ2NaleeTCS4y5QMutrPszQFpndCIR+du1NXcE7KiIbT9Ty RpCB1oTTQm4TXYowrmIVbzkp/kk2hDKkcj4MCrZCg9KZ/yl4bEDSqx2LyEqE+h1Nqu2h leJwW01XxweEYDiPCLLepV/SY+Ws/iRggazLHvHXkPxdR5v/Q/jXy1hP0es1dMecZVwx QBag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=UuynBRzC068PlSLg8YaI9IPzgPbUSV14I+dRrJecnJs=; b=SBS4fEHN1MExg9SsDwgXEUwqaAavS/gDP5tnwS2Jdj5AghXWyt9eto3ABFd5DL7ogk +BrE+6M2MO7br+TaW5V2g9n4P7vpWCJok8PnaTJuaYsdnPGAjglBztikT0k9HWw7yoUH a03iVhysMNG2MQ7geh9ewzIUoYTMZNxv2NlcgTL4ekjyJavbb9z5wZnXu1magZvfE2bd 0ouvBenBYFCTISAcRn2s55rODhWJkUWtfUluqXkSHn1ERad3OQhdok+IyFlGbJaauXVI 8WV2yJp29/YPKI8cdoBF77cS+4xpEYOvr366j3E1T4ikZYCUhm5SxX7Lq8WNtd08MJ66 Cxzg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=tqKdZp3u; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p28-20020a50cd9c000000b00458ce1a20dfsi12408348edi.271.2022.10.19.03.48.02; Wed, 19 Oct 2022 03:48:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=tqKdZp3u; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233213AbiJSKri (ORCPT + 99 others); Wed, 19 Oct 2022 06:47:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232801AbiJSKp1 (ORCPT ); Wed, 19 Oct 2022 06:45:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D38E26AF7; Wed, 19 Oct 2022 03:21:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3E36B82304; Wed, 19 Oct 2022 08:47:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4ED99C433C1; Wed, 19 Oct 2022 08:47:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666169233; bh=NNlN43yRYP/GS1meNtY2/HGKhqpVXSar/Y/KnVaTkSA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tqKdZp3u/pujysaXeK19W8Y6rXPWUg8vUOpi4LM4JllX5UtheOR5vDqMVC0HGpaRn l4kvToE1sIMcSM8jACVHntCgqHBRth2Sk+si3gavR/BkgAvVFU4AsLk6B6j1YvNnvM f5hg69YqBKVVSo9LTcGIgLwi4pEzFv/XuvdUBfh0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert OCallahan , Ondrej Mosnacek , Peter Xu , "Christian Brauner (Microsoft)" , Paul Moore , Sasha Levin Subject: [PATCH 6.0 204/862] userfaultfd: open userfaultfds with O_RDONLY Date: Wed, 19 Oct 2022 10:24:51 +0200 Message-Id: <20221019083259.023119499@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747112697200236951?= X-GMAIL-MSGID: =?utf-8?q?1747112697200236951?= From: Ondrej Mosnacek [ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ] Since userfaultfd doesn't implement a write operation, it is more appropriate to open it read-only. When userfaultfds are opened read-write like it is now, and such fd is passed from one process to another, SELinux will check both read and write permissions for the target process, even though it can't actually do any write operation on the fd later. Inspired by the following bug report, which has hit the SELinux scenario described above: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 Reported-by: Robert O'Callahan Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Ondrej Mosnacek Acked-by: Peter Xu Acked-by: Christian Brauner (Microsoft) Signed-off-by: Paul Moore Signed-off-by: Sasha Levin --- fs/userfaultfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 175de70e3adf..0c1d33c4f74c 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -991,7 +991,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *new, int fd; fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new, - O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); + O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); if (fd < 0) return fd; @@ -2094,7 +2094,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) mmgrab(ctx->mm); fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx, - O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); + O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); if (fd < 0) { mmdrop(ctx->mm); kmem_cache_free(userfaultfd_ctx_cachep, ctx);