From patchwork Mon Oct 24 11:28:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 9049 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp442568wru; Mon, 24 Oct 2022 06:07:43 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4LOwXknsRrwRiBhlLH5Z5OS/W/RYOgvaDQmD59RFejO/3gvyv+p4vjGvFbsBBLiBowBmlR X-Received: by 2002:a65:408b:0:b0:42a:55fb:60b0 with SMTP id t11-20020a65408b000000b0042a55fb60b0mr28411020pgp.431.1666616863372; Mon, 24 Oct 2022 06:07:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666616863; cv=none; d=google.com; s=arc-20160816; b=TF6O5wxP6D1r1zoYX1kH9smTDYr8sDU6f2emoY5dSIti8KBE/Rtwz5zRIqWV3apZ3g HzIKUwnLLoORMN7FbMY+oQ9Zqxz0ylf08GnNdSoAnNUtuNGovbmzbd/W2GKrMAemeSKQ VpGQKhn2fy9uBvQ5dikysb9RP0BpOUdXCUG6vaORmicRWq1pIC9zqwgoPv6itRila2J9 UcFqGoXhNbMP6wzRazP05fdi9vZbwTpbq+1LXOUqEHotJscLpoOew6eVeWNOJ76KbDRB 9Wz1cvek/YyMxXZj3tnPINctaCeTcaGqb/9dUCGbJOyADSmZiLWBr4TAHf+Yud85pDcW tdKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=gh+YMn+XtmbAX6MdyACHByFc1Qmd6QIL7nL3AsNHBJ4=; b=DGJQmjQRAr6TnpHaVL92pxsvgFgZfrpcCgntu6N7eBZJj0JiEU5QzZWrfOWZkvXc7x 8j1+4vagcNaQBXzzJXm15CPCQtIcJZoLqCfwrgVISyWBUUztK91/c+puL+QVPDleB1Ir HuaK20k9zHL3i3JP6Uf06bR850W0YNozpSnoPJc3JjF/MT/Jta4iCZl7BX8qGuPoYay/ UVltXlg3eTTLDZ8RL6aO1qpDDnFJ0PUYS0hD+XkE3s8GAD/TJjGcEL9meTouMYqRHNxl xxuaxEpJwB322QV50ihkGVniYX8gTSviDjZAW3LT+UTBtec6PJVhRwGAU2dqEiztoXpL S/xg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=uf3ORQ4d; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t26-20020a63535a000000b0045ce0eba52esi37415875pgl.114.2022.10.24.06.07.21; Mon, 24 Oct 2022 06:07:43 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=uf3ORQ4d; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234966AbiJXNGZ (ORCPT + 99 others); Mon, 24 Oct 2022 09:06:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235372AbiJXNEj (ORCPT ); Mon, 24 Oct 2022 09:04:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72BC74D4F2; Mon, 24 Oct 2022 05:20:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5E8A66129D; Mon, 24 Oct 2022 12:19:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 735A3C433D6; Mon, 24 Oct 2022 12:19:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666613992; bh=hn6W96T8z04EogJtNH5PSoub5gNDEco86kNA8E7waSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uf3ORQ4dFYf2jalbFOn8wQ1Jkl+jTLa/Q6KS96IdeKWQuRyEHqFzCPdsnZnmYbI6R zRS0Dm58loifcCRkHEhLqgKKu6OcmkSr6RwbJY11f5i+fOUsc7fU4rfzRX1tEjTgND yj9iBvIld/xhVKKj0s5Gwr5/wl6pFSEzEj6IXTX4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert OCallahan , Ondrej Mosnacek , Peter Xu , "Christian Brauner (Microsoft)" , Paul Moore , Sasha Levin Subject: [PATCH 5.10 092/390] userfaultfd: open userfaultfds with O_RDONLY Date: Mon, 24 Oct 2022 13:28:09 +0200 Message-Id: <20221024113026.545715262@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113022.510008560@linuxfoundation.org> References: <20221024113022.510008560@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747574444447494121?= X-GMAIL-MSGID: =?utf-8?q?1747574444447494121?= From: Ondrej Mosnacek [ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ] Since userfaultfd doesn't implement a write operation, it is more appropriate to open it read-only. When userfaultfds are opened read-write like it is now, and such fd is passed from one process to another, SELinux will check both read and write permissions for the target process, even though it can't actually do any write operation on the fd later. Inspired by the following bug report, which has hit the SELinux scenario described above: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 Reported-by: Robert O'Callahan Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Ondrej Mosnacek Acked-by: Peter Xu Acked-by: Christian Brauner (Microsoft) Signed-off-by: Paul Moore Signed-off-by: Sasha Levin --- fs/userfaultfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index aef0da5d6f63..a3074a9d71a6 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -974,7 +974,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *ctx, int fd; fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, new, - O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS)); + O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS)); if (fd < 0) return fd; @@ -1987,7 +1987,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) mmgrab(ctx->mm); fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, ctx, - O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS)); + O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS)); if (fd < 0) { mmdrop(ctx->mm); kmem_cache_free(userfaultfd_ctx_cachep, ctx);