From patchwork Mon Oct 24 11:29:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 10289 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp653799wru; Mon, 24 Oct 2022 14:10:52 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5Gf1cw0qe9xYEWmOGjA4xe2QkYfJqTB3IbqtddKWGsomgWuEDmpXOMnfCJe8FQbvD8i16I X-Received: by 2002:aa7:c054:0:b0:453:98c6:f6c4 with SMTP id k20-20020aa7c054000000b0045398c6f6c4mr32270259edo.2.1666645852356; Mon, 24 Oct 2022 14:10:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666645852; cv=none; d=google.com; s=arc-20160816; b=mXcY/e9wm7uZq8GPuxyRs0zgV8DbFiWT6T2O2GzDhaZZvQHcGvg61tcF724sSNwm2y l7H8nYGuAEMplL87t5gidlAlXK5zwTh2YBoebbor+RI7eJ2uzigkvJj7kD7pM5CdnS8d iEzyIuZd+BoJP56/B5JdjpUBFL95WD79TqeDZ63/n6PC85YAT6FOXI5CqKaPTV1EDc4Q UvSCDVxGVbU8EgTJORwIwzGNsP7MxeGCKAXz7qVXLHaOYWI49AGqw5LYAcy2SfyWgKiR E1ZJIqc3cxoBwzBSMH42BHZE99WGinljXpEcoNQdWGuRb1H3U0Wen+kjR7rHHSJJECc9 rFBw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=rJmBh40SEDwJpH1DSpVMvM9IWkv3BnOzNOKX+4LnlJ8=; b=zW95AZ0EbVt/yqVNmYjyCvt+r49BkI2syqCv0Oa+5AJKsEY65azyAdrDqVymga46uC lV2QhCBDw/oMpJdMOqt7rJGrCQt0203pJAVI2hmr5B+2vllkfekxfuruenXNNArzUFJZ qXz091SOXRQinKXs+5FSFmQpdKwlDGzsbenRYWawq6PYKUyawE64gQX4OWYUa5D42gyV G0+/NuwWQ8Ouw/G8PauVFMTsdF4q/lg132cA7rAyyfTDMwSkEpfTXoqzGlnBjtMlaWAQ is5BhBHUOcF3DlE7AWkJV4gzuuWJOtP4ib9z7WBkL9GFX/mA6BJk1Gk1BvFRY6OQsvkJ J+Ag== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=rFs6R6hF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bn3-20020a170906c0c300b0078306c5c48asi705788ejb.250.2022.10.24.14.10.26; Mon, 24 Oct 2022 14:10:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=rFs6R6hF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234135AbiJXU4V (ORCPT + 99 others); Mon, 24 Oct 2022 16:56:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232571AbiJXU4C (ORCPT ); Mon, 24 Oct 2022 16:56:02 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E600F2413CA; Mon, 24 Oct 2022 12:02:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 759A5B81330; Mon, 24 Oct 2022 12:08:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4BB6C433D7; Mon, 24 Oct 2022 12:08:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666613311; bh=QOy3cjI1C0pLjk5Kou9W52sE41We3XgJT9GQSvfzZZ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rFs6R6hFdr54lQ59ZL1Q+Pex0r8aByLmHA1QoHbklt4VdzvTjEhL/cJlkEHV51qgA EJAIlCtmCGpJ+D3MsWr+vt5TJhKdVETKIiZlMdnOqX1Rm8K5tiVXSlLCMGCjWUyh6n +RP1YsfK6al72p4i56IDZQ3JJZaiIXWYx0fPISkU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert OCallahan , Ondrej Mosnacek , Peter Xu , "Christian Brauner (Microsoft)" , Paul Moore , Sasha Levin Subject: [PATCH 5.4 059/255] userfaultfd: open userfaultfds with O_RDONLY Date: Mon, 24 Oct 2022 13:29:29 +0200 Message-Id: <20221024113004.455015344@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113002.471093005@linuxfoundation.org> References: <20221024113002.471093005@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747604841423790476?= X-GMAIL-MSGID: =?utf-8?q?1747604841423790476?= From: Ondrej Mosnacek [ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ] Since userfaultfd doesn't implement a write operation, it is more appropriate to open it read-only. When userfaultfds are opened read-write like it is now, and such fd is passed from one process to another, SELinux will check both read and write permissions for the target process, even though it can't actually do any write operation on the fd later. Inspired by the following bug report, which has hit the SELinux scenario described above: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 Reported-by: Robert O'Callahan Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Ondrej Mosnacek Acked-by: Peter Xu Acked-by: Christian Brauner (Microsoft) Signed-off-by: Paul Moore Signed-off-by: Sasha Levin --- fs/userfaultfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index ec57bbb6bb05..740853465356 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -1018,7 +1018,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *ctx, int fd; fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, new, - O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS)); + O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS)); if (fd < 0) return fd; @@ -1969,7 +1969,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) mmgrab(ctx->mm); fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, ctx, - O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS)); + O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS)); if (fd < 0) { mmdrop(ctx->mm); kmem_cache_free(userfaultfd_ctx_cachep, ctx);