Messages in this thread | | | Date | Thu, 29 Jul 2021 16:53:48 +0200 | From | Christian Brauner <> | Subject | Re: [PATCH] ipc: add set_ownership() and permissions() callbacks for posix mqueue sysctl |
| |
On Wed, Jul 28, 2021 at 08:06:51PM -0700, cgel.zte@gmail.com wrote: > From: Ran Xiaokai <ran.xiaokai@zte.com.cn> > > When a non-root user process creates a user namespace and ipc namespace > with command "unshare -Ur -i", and map the root user inside > the user namesapce to the global owner of user namespace. > The newly created user namespace OWNS the ipc namespace, > So the root user inside the user namespace should have full access > rights to the ipc namespace resources. > > $ id > uid=1200(u1200) gid=1200(u1200) groups=1200(u1200) > $ unshare -Ur -i > $ id > uid=0(root) gid=0(root) groups=0(root) > $ ls -l /proc/sys/fs/mqueue/ > total 0 > -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msg_default > -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msg_max > -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msgsize_default > -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 msgsize_max > -rw-r--r-- 1 65534 65534 0 Jul 28 19:03 queues_max > -sh: /proc/sys/fs/mqueue/msg_max: Permission denied > > As opposite, inside a net namespace, > 1. sysctl files owners are set to the local root user > insede the user namespace, not the GLOBAL_ROOT_UID; > 2. sysctl files are writable when accessed by root user > inside the user namespace. > > $ id > uid=1200(u1200) gid=1200(u1200) groups=1200(u1200) > $ unshare -Ur -n > $ id > uid=0(root) gid=0(root) groups=0(root) > $ ls -l /proc/sys/net/ipv4/ip_forward > -rw-r--r-- 1 root root 0 Jul 28 19:04 /proc/sys/net/ipv4/ip_forward > $ echo 1 > /proc/sys/net/ipv4/ip_forward > $ cat /proc/sys/net/ipv4/ip_forward > 1
Yeah, we did that work specifically for the network namespace but knew there were quite a few places that would need fix up. This makes sense to me.
Please add tests for this patch though. Also make sure to run them in a tight loop on a kernel with memory and log debugging enabled. The whole sysctl retire stuff can't be called from rcu contexts and that's easy to miss. So turn on at least sm like:
CONFIG_HAVE_ARCH_KASAN=y CONFIG_HAVE_ARCH_KASAN_VMALLOC=y CONFIG_CC_HAS_KASAN_GENERIC=y CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y CONFIG_KASAN=y CONFIG_KASAN_GENERIC=y # CONFIG_KASAN_OUTLINE is not set CONFIG_KASAN_INLINE=y CONFIG_KASAN_STACK=1 CONFIG_KASAN_VMALLOC=y # CONFIG_KASAN_MODULE_TEST is not set CONFIG_HAVE_ARCH_KFENCE=y CONFIG_KFENCE=y CONFIG_KFENCE_STATIC_KEYS=y CONFIG_KFENCE_SAMPLE_INTERVAL=100 CONFIG_KFENCE_NUM_OBJECTS=255 CONFIG_KFENCE_STRESS_TEST_FAULTS=0 CONFIG_LOCKDEP_SUPPORT=y CONFIG_LOCKDEP=y
| |