Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756856AbaDWQpq (ORCPT ); Wed, 23 Apr 2014 12:45:46 -0400 Received: from mx1.redhat.com ([209.132.183.28]:57131 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752530AbaDWQpo (ORCPT ); Wed, 23 Apr 2014 12:45:44 -0400 Date: Wed, 23 Apr 2014 12:45:37 -0400 From: Vivek Goyal To: Andy Lutomirski Cc: Tejun Heo , Daniel Walsh , "linux-kernel@vger.kernel.org" , lpoetter@redhat.com, Simo Sorce , cgroups@vger.kernel.org, "David S. Miller" , kay@redhat.com, Network Development Subject: Re: [PATCH 2/2] net: Implement SO_PASSCGROUP to enable passing cgroup path Message-ID: <20140423164537.GD24651@redhat.com> References: <1397596546-10153-1-git-send-email-vgoyal@redhat.com> <1397596546-10153-3-git-send-email-vgoyal@redhat.com> <20140416002010.GA5035@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 15, 2014 at 08:47:54PM -0700, Andy Lutomirski wrote: [..] > Here's an attack against SO_PASSCGROUP, as you implemented it: connect > a socket and get someone else to write(2) to it. This isn't very > hard. Now you've impersonated. If this is a problem then I think kernel requires fixing. Because kernel will apply all resource management policies based on the cgroup at write(2) time and not based on open() time. For example, blkio throttling policies. If you get a process in other cgroup to read/write to an fd, then IO throttling rules of that cgroup are applied and it does not matter who opened fd in first place. So SO_PASSCGROUP is not exactly same as SO_PASSCRED in that sense. If there are issues w.r.t authorization/authentication etc, then that should be a recommendation to user space that don't use cgroup info for unsafe cases. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/