Hi.
Attached patch puts pid into unused cookie field in inotify events.
Cookie from move command were not changed.
Having pid of the event origin is very useful for the notification
daemons which have to differentiate 'local' and 'remote' users, i.e.
those which have different policies. One of the examples is libionotify
(an IO notiication library) and POHMELFS server.
Also fixed several whitespace issues.
1. libionotify
http://www.ioremap.net/projects/libionotify
2. POHMELFS
http://www.ioremap.net/projects/pohmelfs
Signed-off-by: Evgeniy Polyakov <[email protected]>
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index d4b7c4a..4a10dff 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -55,7 +55,7 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
if (isdir)
isdir = IN_ISDIR;
- inotify_inode_queue_event(old_dir, IN_MOVED_FROM|isdir,cookie,old_name,
+ inotify_inode_queue_event(old_dir, IN_MOVED_FROM|isdir,cookie, old_name,
source);
inotify_inode_queue_event(new_dir, IN_MOVED_TO|isdir, cookie, new_name,
source);
@@ -79,7 +79,8 @@ static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
if (isdir)
isdir = IN_ISDIR;
dnotify_parent(dentry, DN_DELETE);
- inotify_dentry_parent_queue_event(dentry, IN_DELETE|isdir, 0, dentry->d_name.name);
+ inotify_dentry_parent_queue_event(dentry, IN_DELETE|isdir,
+ task_tgid_vnr(current), dentry->d_name.name);
}
/*
@@ -87,7 +88,8 @@ static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
*/
static inline void fsnotify_inoderemove(struct inode *inode)
{
- inotify_inode_queue_event(inode, IN_DELETE_SELF, 0, NULL, NULL);
+ inotify_inode_queue_event(inode, IN_DELETE_SELF,
+ task_tgid_vnr(current), NULL, NULL);
inotify_inode_is_dead(inode);
}
@@ -96,7 +98,8 @@ static inline void fsnotify_inoderemove(struct inode *inode)
*/
static inline void fsnotify_link_count(struct inode *inode)
{
- inotify_inode_queue_event(inode, IN_ATTRIB, 0, NULL, NULL);
+ inotify_inode_queue_event(inode, IN_ATTRIB,
+ task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -105,8 +108,8 @@ static inline void fsnotify_link_count(struct inode *inode)
static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
{
inode_dir_notify(inode, DN_CREATE);
- inotify_inode_queue_event(inode, IN_CREATE, 0, dentry->d_name.name,
- dentry->d_inode);
+ inotify_inode_queue_event(inode, IN_CREATE, task_tgid_vnr(current),
+ dentry->d_name.name, dentry->d_inode);
audit_inode_child(dentry->d_name.name, dentry, inode);
}
@@ -118,8 +121,8 @@ static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct dentry *new_dentry)
{
inode_dir_notify(dir, DN_CREATE);
- inotify_inode_queue_event(dir, IN_CREATE, 0, new_dentry->d_name.name,
- inode);
+ inotify_inode_queue_event(dir, IN_CREATE, task_tgid_vnr(current),
+ new_dentry->d_name.name, inode);
fsnotify_link_count(inode);
audit_inode_child(new_dentry->d_name.name, new_dentry, dir);
}
@@ -130,8 +133,8 @@ static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct
static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry)
{
inode_dir_notify(inode, DN_CREATE);
- inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR, 0,
- dentry->d_name.name, dentry->d_inode);
+ inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR,
+ task_tgid_vnr(current), dentry->d_name.name, dentry->d_inode);
audit_inode_child(dentry->d_name.name, dentry, inode);
}
@@ -147,8 +150,9 @@ static inline void fsnotify_access(struct dentry *dentry)
mask |= IN_ISDIR;
dnotify_parent(dentry, DN_ACCESS);
- inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
- inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, mask,
+ task_tgid_vnr(current), dentry->d_name.name);
+ inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -163,8 +167,9 @@ static inline void fsnotify_modify(struct dentry *dentry)
mask |= IN_ISDIR;
dnotify_parent(dentry, DN_MODIFY);
- inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
- inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, mask,
+ task_tgid_vnr(current), dentry->d_name.name);
+ inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -178,8 +183,10 @@ static inline void fsnotify_open(struct dentry *dentry)
if (S_ISDIR(inode->i_mode))
mask |= IN_ISDIR;
- inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
- inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, mask,
+ task_tgid_vnr(current), dentry->d_name.name);
+ inotify_inode_queue_event(inode, mask,
+ task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -196,8 +203,8 @@ static inline void fsnotify_close(struct file *file)
if (S_ISDIR(inode->i_mode))
mask |= IN_ISDIR;
- inotify_dentry_parent_queue_event(dentry, mask, 0, name);
- inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, mask, task_tgid_vnr(current), name);
+ inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -211,8 +218,10 @@ static inline void fsnotify_xattr(struct dentry *dentry)
if (S_ISDIR(inode->i_mode))
mask |= IN_ISDIR;
- inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
- inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, mask,
+ task_tgid_vnr(current), dentry->d_name.name);
+ inotify_inode_queue_event(inode, mask,
+ task_tgid_vnr(current), NULL, NULL);
}
/*
@@ -259,9 +268,10 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
if (in_mask) {
if (S_ISDIR(inode->i_mode))
in_mask |= IN_ISDIR;
- inotify_inode_queue_event(inode, in_mask, 0, NULL, NULL);
- inotify_dentry_parent_queue_event(dentry, in_mask, 0,
- dentry->d_name.name);
+ inotify_inode_queue_event(inode, in_mask,
+ task_tgid_vnr(current), NULL, NULL);
+ inotify_dentry_parent_queue_event(dentry, in_mask,
+ task_tgid_vnr(current), dentry->d_name.name);
}
}
--
Evgeniy Polyakov
[CC+=linux-api]
On Sat, Nov 8, 2008 at 6:42 AM, Evgeniy Polyakov <[email protected]> wrote:
> Hi.
>
> Attached patch puts pid into unused cookie field in inotify events.
> Cookie from move command were not changed.
>
> Having pid of the event origin is very useful for the notification
> daemons which have to differentiate 'local' and 'remote' users, i.e.
> those which have different policies. One of the examples is libionotify
> (an IO notiication library) and POHMELFS server.
Hi Evgeniy,
I've not looked closely at the patch, but a quick question. The
ookied field is unused for _most_ events, but is used for rename
events. Are you saying that with this patch, that the cookie will be
used as before for rename events, but for other events it will be the
PID of the triggering process? If so, that seems a bit ugly -- why
wouldn't we also be intersted in the PID for rename events?
Cheers,
Michael
> Also fixed several whitespace issues.
>
> 1. libionotify
> http://www.ioremap.net/projects/libionotify
>
> 2. POHMELFS
> http://www.ioremap.net/projects/pohmelfs
>
> Signed-off-by: Evgeniy Polyakov <[email protected]>
>
> diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
> index d4b7c4a..4a10dff 100644
> --- a/include/linux/fsnotify.h
> +++ b/include/linux/fsnotify.h
> @@ -55,7 +55,7 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
>
> if (isdir)
> isdir = IN_ISDIR;
> - inotify_inode_queue_event(old_dir, IN_MOVED_FROM|isdir,cookie,old_name,
> + inotify_inode_queue_event(old_dir, IN_MOVED_FROM|isdir,cookie, old_name,
> source);
> inotify_inode_queue_event(new_dir, IN_MOVED_TO|isdir, cookie, new_name,
> source);
> @@ -79,7 +79,8 @@ static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
> if (isdir)
> isdir = IN_ISDIR;
> dnotify_parent(dentry, DN_DELETE);
> - inotify_dentry_parent_queue_event(dentry, IN_DELETE|isdir, 0, dentry->d_name.name);
> + inotify_dentry_parent_queue_event(dentry, IN_DELETE|isdir,
> + task_tgid_vnr(current), dentry->d_name.name);
> }
>
> /*
> @@ -87,7 +88,8 @@ static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
> */
> static inline void fsnotify_inoderemove(struct inode *inode)
> {
> - inotify_inode_queue_event(inode, IN_DELETE_SELF, 0, NULL, NULL);
> + inotify_inode_queue_event(inode, IN_DELETE_SELF,
> + task_tgid_vnr(current), NULL, NULL);
> inotify_inode_is_dead(inode);
> }
>
> @@ -96,7 +98,8 @@ static inline void fsnotify_inoderemove(struct inode *inode)
> */
> static inline void fsnotify_link_count(struct inode *inode)
> {
> - inotify_inode_queue_event(inode, IN_ATTRIB, 0, NULL, NULL);
> + inotify_inode_queue_event(inode, IN_ATTRIB,
> + task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -105,8 +108,8 @@ static inline void fsnotify_link_count(struct inode *inode)
> static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
> {
> inode_dir_notify(inode, DN_CREATE);
> - inotify_inode_queue_event(inode, IN_CREATE, 0, dentry->d_name.name,
> - dentry->d_inode);
> + inotify_inode_queue_event(inode, IN_CREATE, task_tgid_vnr(current),
> + dentry->d_name.name, dentry->d_inode);
> audit_inode_child(dentry->d_name.name, dentry, inode);
> }
>
> @@ -118,8 +121,8 @@ static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
> static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct dentry *new_dentry)
> {
> inode_dir_notify(dir, DN_CREATE);
> - inotify_inode_queue_event(dir, IN_CREATE, 0, new_dentry->d_name.name,
> - inode);
> + inotify_inode_queue_event(dir, IN_CREATE, task_tgid_vnr(current),
> + new_dentry->d_name.name, inode);
> fsnotify_link_count(inode);
> audit_inode_child(new_dentry->d_name.name, new_dentry, dir);
> }
> @@ -130,8 +133,8 @@ static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct
> static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry)
> {
> inode_dir_notify(inode, DN_CREATE);
> - inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR, 0,
> - dentry->d_name.name, dentry->d_inode);
> + inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR,
> + task_tgid_vnr(current), dentry->d_name.name, dentry->d_inode);
> audit_inode_child(dentry->d_name.name, dentry, inode);
> }
>
> @@ -147,8 +150,9 @@ static inline void fsnotify_access(struct dentry *dentry)
> mask |= IN_ISDIR;
>
> dnotify_parent(dentry, DN_ACCESS);
> - inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
> - inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, mask,
> + task_tgid_vnr(current), dentry->d_name.name);
> + inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -163,8 +167,9 @@ static inline void fsnotify_modify(struct dentry *dentry)
> mask |= IN_ISDIR;
>
> dnotify_parent(dentry, DN_MODIFY);
> - inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
> - inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, mask,
> + task_tgid_vnr(current), dentry->d_name.name);
> + inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -178,8 +183,10 @@ static inline void fsnotify_open(struct dentry *dentry)
> if (S_ISDIR(inode->i_mode))
> mask |= IN_ISDIR;
>
> - inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
> - inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, mask,
> + task_tgid_vnr(current), dentry->d_name.name);
> + inotify_inode_queue_event(inode, mask,
> + task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -196,8 +203,8 @@ static inline void fsnotify_close(struct file *file)
> if (S_ISDIR(inode->i_mode))
> mask |= IN_ISDIR;
>
> - inotify_dentry_parent_queue_event(dentry, mask, 0, name);
> - inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, mask, task_tgid_vnr(current), name);
> + inotify_inode_queue_event(inode, mask, task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -211,8 +218,10 @@ static inline void fsnotify_xattr(struct dentry *dentry)
> if (S_ISDIR(inode->i_mode))
> mask |= IN_ISDIR;
>
> - inotify_dentry_parent_queue_event(dentry, mask, 0, dentry->d_name.name);
> - inotify_inode_queue_event(inode, mask, 0, NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, mask,
> + task_tgid_vnr(current), dentry->d_name.name);
> + inotify_inode_queue_event(inode, mask,
> + task_tgid_vnr(current), NULL, NULL);
> }
>
> /*
> @@ -259,9 +268,10 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
> if (in_mask) {
> if (S_ISDIR(inode->i_mode))
> in_mask |= IN_ISDIR;
> - inotify_inode_queue_event(inode, in_mask, 0, NULL, NULL);
> - inotify_dentry_parent_queue_event(dentry, in_mask, 0,
> - dentry->d_name.name);
> + inotify_inode_queue_event(inode, in_mask,
> + task_tgid_vnr(current), NULL, NULL);
> + inotify_dentry_parent_queue_event(dentry, in_mask,
> + task_tgid_vnr(current), dentry->d_name.name);
> }
> }
>
>
>
> --
> Evgeniy Polyakov
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html
Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html
Hi Michael.
On Sat, Nov 08, 2008 at 09:25:16AM -0500, Michael Kerrisk ([email protected]) wrote:
> I've not looked closely at the patch, but a quick question. The
> ookied field is unused for _most_ events, but is used for rename
> events. Are you saying that with this patch, that the cookie will be
> used as before for rename events, but for other events it will be the
> PID of the triggering process? If so, that seems a bit ugly -- why
> wouldn't we also be intersted in the PID for rename events?
Yes, rename events actually consist of at least two: move from and move
to, and they carry the same cookie, so that userspace could combine them
into single transaction. All others use zero, so I decided to put PID of
the caller there. This does not look perfect of course, but we can not
change the structure layout, so rename events can not be changed to
carry additional PID field.
--
Evgeniy Polyakov
[CC += "John McCutchan" <[email protected]>, who was one of the
inotify developers, as I recall]
Hi Evgeniy,
On Sat, Nov 8, 2008 at 10:35 AM, Evgeniy Polyakov <[email protected]> wrote:
> Hi Michael.
>
> On Sat, Nov 08, 2008 at 09:25:16AM -0500, Michael Kerrisk ([email protected]) wrote:
>> I've not looked closely at the patch, but a quick question. The
>> ookied field is unused for _most_ events, but is used for rename
>> events. Are you saying that with this patch, that the cookie will be
>> used as before for rename events, but for other events it will be the
>> PID of the triggering process? If so, that seems a bit ugly -- why
>> wouldn't we also be intersted in the PID for rename events?
>
> Yes, rename events actually consist of at least two: move from and move
> to, and they carry the same cookie, so that userspace could combine them
> into single transaction. All others use zero, so I decided to put PID of
> the caller there. This does not look perfect of course, but we can not
> change the structure layout, so rename events can not be changed to
> carry additional PID field.
It's perhaps unfortunate that the structure wasn't padded out with a
few additional fields "for future use". But -- maybe it is not really
true that we can't change things. Two things to consider:
a) We now (since 2.6.27) have an inotify_init1() which has a flags argument.
b) There are spare bits in the mask argument of inotify_add_watch()
We could use a flag in either of these to say that we want a different
structure returned on read() from the inotify descriptor. In the
first case, this would be a global setting for all inotify events on
that descriptor. In the second, we could do it on a per-watch basis
(I'm not so sure that that is a nice idea). Since we are in any case
extending the ABI, and new applications would need to be taught about
the extension, it seems we could consider either of the alternative
extensions I mentioned, which woul also allow the PID to be obtained
for rename() events. What do you think?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html
Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html
The reason John & I did not add a pid field -- and we discussed it and
really wanted it -- is security. It is an information leak to know
what an unrelated process is doing.
Trust me that the rest of the kernel developers are even harder on
this subject than I.
I suppose you could fill out the pid field only if the uid's match,
but that is extra work for less utility.
Robert
On Sat, Nov 8, 2008 at 11:58 AM, Michael Kerrisk
<[email protected]> wrote:
> [CC += "John McCutchan" <[email protected]>, who was one of the
> inotify developers, as I recall]
>
> Hi Evgeniy,
>
> On Sat, Nov 8, 2008 at 10:35 AM, Evgeniy Polyakov <[email protected]> wrote:
>> Hi Michael.
>>
>> On Sat, Nov 08, 2008 at 09:25:16AM -0500, Michael Kerrisk ([email protected]) wrote:
>>> I've not looked closely at the patch, but a quick question. The
>>> ookied field is unused for _most_ events, but is used for rename
>>> events. Are you saying that with this patch, that the cookie will be
>>> used as before for rename events, but for other events it will be the
>>> PID of the triggering process? If so, that seems a bit ugly -- why
>>> wouldn't we also be intersted in the PID for rename events?
>>
>> Yes, rename events actually consist of at least two: move from and move
>> to, and they carry the same cookie, so that userspace could combine them
>> into single transaction. All others use zero, so I decided to put PID of
>> the caller there. This does not look perfect of course, but we can not
>> change the structure layout, so rename events can not be changed to
>> carry additional PID field.
>
> It's perhaps unfortunate that the structure wasn't padded out with a
> few additional fields "for future use". But -- maybe it is not really
> true that we can't change things. Two things to consider:
>
> a) We now (since 2.6.27) have an inotify_init1() which has a flags argument.
> b) There are spare bits in the mask argument of inotify_add_watch()
>
> We could use a flag in either of these to say that we want a different
> structure returned on read() from the inotify descriptor. In the
> first case, this would be a global setting for all inotify events on
> that descriptor. In the second, we could do it on a per-watch basis
> (I'm not so sure that that is a nice idea). Since we are in any case
> extending the ABI, and new applications would need to be taught about
> the extension, it seems we could consider either of the alternative
> extensions I mentioned, which woul also allow the PID to be obtained
> for rename() events. What do you think?
>
> Cheers,
>
> Michael
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
> man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html
> Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html
>
Hi.
On Sat, Nov 08, 2008 at 12:04:40PM -0500, Robert Love ([email protected]) wrote:
> The reason John & I did not add a pid field -- and we discussed it and
> really wanted it -- is security. It is an information leak to know
> what an unrelated process is doing.
Really? And receiving notifications about hidden root-only
modified files is ok in this case? :)
Fortunately /proc file creation is not broadcasted via inotify.
I'm talking about following example:
libionotify-1.0$ LD_PRELOAD=./libionotify.so ./inotify -r /tmp
2008-11-08 20:08:19.412222 2478 CREATE: /tmp/test_dir
2008-11-08 20:08:45.725481 2478 CREATE: /tmp/test_dir/test
Failed to add notification for '/tmp/test_dir/test': Permission denied [13].
2008-11-08 20:11:11.424793 2478 CREATE: /tmp/test_dir/another_test
Failed to add notification for '/tmp/test_dir/another_test': Permission denied [13].
2008-11-08 20:11:11.426266 2478 WRITE : /tmp/test_dir/another_test
while in parallel I do:
$ sudo mkdir /tmp/test_dir
$ sudo chown 0.0 /tmp/test_dir
$ sudo chmod 700 /tmp/test_dir
$ sudo touch /tmp/test_dir/test
$ sudo dd if=/dev/zero of=/tmp/test_dir/another_test bs=4k count=1
Permission denied is returned when program tries to add a watch to that objects.
Btw, this means that inotify does not break when permissions are changed
for given object, particulary when read/exec is dropped. This may be a
security problem, since directory listing is forbidden in this case:
$ sudo mkdir /tmp/2
$ cd /tmp/2/
$ sudo chmod 700 .
$ sudo mkdir /tmp/2/test
$ ls
ls: cannot open directory .: Permission denied
Inotify sucessfully prints all created objects...
So, let's not talk about security with PIDs.
> Trust me that the rest of the kernel developers are even harder on
> this subject than I.
>
> I suppose you could fill out the pid field only if the uid's match,
> but that is extra work for less utility.
Well... Although I could not call this 'security', but yes, it can be
done for root and when uids match. This will solve my particular problem
where server with multiple threads should differentiate between own
writes and local writes from other processes.
--
Evgeniy Polyakov
On Sat, Nov 08, 2008 at 01:35:07PM -0500, Robert Love ([email protected]) wrote:
> Pointing out some other information leak doesn't lessen the pid problem.
I just wanted to show that this is not a security problem.
Since there are others probably even more important.
But I really do not want to start to discuss this, since I already see
that result will be effectively zero, so returning to the original
problem with putting pid into events: if inotify_init() caller has 0
(e)uid or if IO origin has the same (e)uid, are you ok to put pid into
the event?
--
Evgeniy Polyakov
On Sat, Nov 08, 2008 at 09:40:13PM +0300, Evgeniy Polyakov ([email protected]) wrote:
> But I really do not want to start to discuss this, since I already see
> that result will be effectively zero, so returning to the original
> problem with putting pid into events: if inotify_init() caller has 0
> (e)uid or if IO origin has the same (e)uid, are you ok to put pid into
> the event?
Something like this (not tested yet, no normal network access).
Signed-off.
diff --git a/fs/inotify.c b/fs/inotify.c
index 690e725..121f025 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -80,6 +80,7 @@ struct inotify_handle {
struct list_head watches; /* list of watches */
atomic_t count; /* reference count */
u32 last_wd; /* the last wd allocated */
+ uid_t uid; /* watcher's uid */
const struct inotify_operations *in_ops; /* inotify caller operations */
};
@@ -292,6 +293,10 @@ void inotify_inode_queue_event(struct inode *inode, u32 mask, u32 cookie,
mutex_lock(&ih->mutex);
if (watch_mask & IN_ONESHOT)
remove_watch_no_event(watch, ih);
+
+ if (!cookie && (ih->uid == 0 ||
+ ih->uid == current->user->uid))
+ cookie = task_tgid_vnr(current);
ih->in_ops->handle_event(watch, watch->wd, mask, cookie,
name, n_inode);
mutex_unlock(&ih->mutex);
diff --git a/fs/inotify_user.c b/fs/inotify_user.c
index 6024942..e426f7c 100644
--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -612,6 +612,8 @@ asmlinkage long sys_inotify_init1(int flags)
dev->ih = ih;
dev->fa = NULL;
+ ih->uid = user->uid;
+
filp->f_op = &inotify_fops;
filp->f_path.mnt = mntget(inotify_mnt);
filp->f_path.dentry = dget(inotify_mnt->mnt_root);
--
Evgeniy Polyakov
Hi Michael.
On Sat, Nov 08, 2008 at 11:58:30AM -0500, Michael Kerrisk ([email protected]) wrote:
> It's perhaps unfortunate that the structure wasn't padded out with a
> few additional fields "for future use". But -- maybe it is not really
> true that we can't change things. Two things to consider:
>
> a) We now (since 2.6.27) have an inotify_init1() which has a flags argument.
> b) There are spare bits in the mask argument of inotify_add_watch()
>
> We could use a flag in either of these to say that we want a different
> structure returned on read() from the inotify descriptor. In the
> first case, this would be a global setting for all inotify events on
> that descriptor. In the second, we could do it on a per-watch basis
> (I'm not so sure that that is a nice idea). Since we are in any case
> extending the ABI, and new applications would need to be taught about
> the extension, it seems we could consider either of the alternative
> extensions I mentioned, which woul also allow the PID to be obtained
> for rename() events. What do you think?
This may be a good idea for some serious ABI change. I think we could
extend it even more to include IO offset/size into events and attribute
changes.
--
Evgeniy Polyakov
Hi Evgeniy,
On Mon, Nov 10, 2008 at 10:20 AM, Evgeniy Polyakov <[email protected]> wrote:
> Hi Michael.
>
> On Sat, Nov 08, 2008 at 11:58:30AM -0500, Michael Kerrisk ([email protected]) wrote:
>> It's perhaps unfortunate that the structure wasn't padded out with a
>> few additional fields "for future use". But -- maybe it is not really
>> true that we can't change things. Two things to consider:
>>
>> a) We now (since 2.6.27) have an inotify_init1() which has a flags argument.
>> b) There are spare bits in the mask argument of inotify_add_watch()
>>
>> We could use a flag in either of these to say that we want a different
>> structure returned on read() from the inotify descriptor. In the
>> first case, this would be a global setting for all inotify events on
>> that descriptor. In the second, we could do it on a per-watch basis
>> (I'm not so sure that that is a nice idea). Since we are in any case
>> extending the ABI, and new applications would need to be taught about
>> the extension, it seems we could consider either of the alternative
>> extensions I mentioned, which woul also allow the PID to be obtained
>> for rename() events. What do you think?
>
> This may be a good idea for some serious ABI change. I think we could
> extend it even more to include IO offset/size into events and attribute
> changes.
Are you going to revise your patch to use this idea?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html
Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html
On Mon, Nov 10, 2008 at 12:15:36PM -0500, Michael Kerrisk ([email protected]) wrote:
> > This may be a good idea for some serious ABI change. I think we could
> > extend it even more to include IO offset/size into events and attribute
> > changes.
>
> Are you going to revise your patch to use this idea?
Not now, since it is not a two-minute hack to write on top of existing
interfaces :)
--
Evgeniy Polyakov