From patchwork Sat Oct 22 07:20:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7229 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1090586wrr; Sat, 22 Oct 2022 00:47:39 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6u6qV2eFX/HbBIiPH+0vHlm59wvsViruzGWWaJD77fXyZJSWrsyOG0W160z3T0/083yaiZ X-Received: by 2002:a17:90a:2fc7:b0:212:e22a:5ba9 with SMTP id n7-20020a17090a2fc700b00212e22a5ba9mr2560904pjm.70.1666424859245; Sat, 22 Oct 2022 00:47:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666424859; cv=none; d=google.com; s=arc-20160816; b=P0fG/WncUOK1UPwa4ehG7NechXTu3H5jMzvVe+dfCpd+JDOh9qGgE9bEb/7D3v2cOf I5WYS3pE/Mc36MtVdysBHLuDLpNo0SV0yZpPHPgKbRlcd+3m31++JRpYNIUJGNZLkX0E fnO5wfh54L17tjSogU1yj2EjbPSfLhLLipxgu+OU55mE4XBKyUoWKWgNcuyz6b9XTD21 oMUqzO2tlDqIVUTrWOAmpO4awG+ZX901JenzAjDe8BXDwPSEWalYsjAHchG/3aLU/ubo wtVwVY40CW+3Ja8T/Sw35ExawaLJy/aD1MOMxWIFlF/dxKtet3EX0OMvK3zCZF53EE++ PIpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=IlZLaypbjwCRja7PjmrTTl1NJxqwdxrNBGqUZT7rM6s=; b=AZkp6PLQwKnlYmEL9PoQi2IabHLviVXn9pn9NqLbEYq6LodjAcu4OM6TLthTCuOzMk TnyWRTphuG+LL6j1WKzMmMKO9C2uztOajlalnr1yoLfRddcR9bXoO4LcDD2onMdElLkR xyu1SOZ1pVCA9U5/GoXOi0f4zGTx0+v0uqy3MRTLnmad6dEAjcYxP8KPpJKVrel9/ZXZ /L0Z3kQlQ2I/ElxFupk1/QUIQY0bZzp7/WbaIwc3Rlw7FuADSaFKnN3oFM3P4RIHR1B2 aanNlrAWdyC1r1HjTcR4kvnCx0BZI/m2S/LTV4OGYThrkma/9qvNBJJeTjk4G8V+RolC 5Qpg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Dp2cPbiI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b3-20020a655783000000b00439f026cf5dsi29101246pgr.612.2022.10.22.00.47.27; Sat, 22 Oct 2022 00:47:39 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Dp2cPbiI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231534AbiJVHrE (ORCPT + 99 others); Sat, 22 Oct 2022 03:47:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34368 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231696AbiJVHpJ (ORCPT ); Sat, 22 Oct 2022 03:45:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A71BA13F7D; Sat, 22 Oct 2022 00:43:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9636FB82E0C; Sat, 22 Oct 2022 07:42:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EBC81C433D7; Sat, 22 Oct 2022 07:42:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666424522; bh=AoD7+dTTk9jFcrmi68nzi+Pl5BVo8xV9UUy1UM1JpqY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Dp2cPbiI6kVo9txPvU1CGMmerGi2mziYtq69ey+yaSRx9+vzR+HgX+DeBz+XSx8ld 1x7pPGNGpoik0ffovnp4vmKzb5HGzCinM+WfCEOp6Dl3N7UWkb+epZZKLjTSKddl3o MyP4PoBonwu0Y3WfbvupCSD01UVnRscemZdv0o8s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert OCallahan , Ondrej Mosnacek , Peter Xu , "Christian Brauner (Microsoft)" , Paul Moore , Sasha Levin Subject: [PATCH 5.19 178/717] userfaultfd: open userfaultfds with O_RDONLY Date: Sat, 22 Oct 2022 09:20:57 +0200 Message-Id: <20221022072447.079288900@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747373113624236268?= X-GMAIL-MSGID: =?utf-8?q?1747373113624236268?= From: Ondrej Mosnacek [ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ] Since userfaultfd doesn't implement a write operation, it is more appropriate to open it read-only. When userfaultfds are opened read-write like it is now, and such fd is passed from one process to another, SELinux will check both read and write permissions for the target process, even though it can't actually do any write operation on the fd later. Inspired by the following bug report, which has hit the SELinux scenario described above: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 Reported-by: Robert O'Callahan Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Ondrej Mosnacek Acked-by: Peter Xu Acked-by: Christian Brauner (Microsoft) Signed-off-by: Paul Moore Signed-off-by: Sasha Levin --- fs/userfaultfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index ab0576d372d6..fa0a2fa5debb 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -991,7 +991,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *new, int fd; fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new, - O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); + O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); if (fd < 0) return fd; @@ -2096,7 +2096,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) mmgrab(ctx->mm); fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx, - O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); + O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); if (fd < 0) { mmdrop(ctx->mm); kmem_cache_free(userfaultfd_ctx_cachep, ctx);