Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755420AbaDXJEv (ORCPT ); Thu, 24 Apr 2014 05:04:51 -0400 Received: from cantor2.suse.de ([195.135.220.15]:47369 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753569AbaDXJEo (ORCPT ); Thu, 24 Apr 2014 05:04:44 -0400 Date: Thu, 24 Apr 2014 11:04:41 +0200 From: Jan Kara To: "Michael Kerrisk (man-pages)" Cc: Jan Kara , Heinrich Schuchardt , Eric Paris , lkml Subject: Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor Message-ID: <20140424090441.GA6723@quack.suse.cz> References: <1397940833-6386-1-git-send-email-xypron.glpk@gmx.de> <20140422134044.GE366@quack.suse.cz> <20140422140747.GF366@quack.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140422140747.GF366@quack.suse.cz> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue 22-04-14 16:07:47, Jan Kara wrote: > On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: > > On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > > > On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: > > >> When monitoring a directory or a mount with the fanotify API > > >> the call to fanotify_init checks, > > >> * the process has cap_sys_admin capability > > >> > > >> The call to fanotify_mark checks, > > >> * the process has read authorization for directory or mount > > >> > > >> A directory or mount may contain files for which the process > > >> has no read or write authorization. > > >> Yet when reading from the fanotify file descriptor, structures > > >> fanotify_event_metadata are returned, which contain a file > > >> descriptor for these files, and will allow to read or write. > > >> > > >> The patch adds an authorization check for read and write > > >> permission. In case of missing permission, reading from the > > >> fanotify file descriptor returns EACCES. > > > OK, am I right you are concerned about a situation where fanotify group > > > descriptor is passed to an unpriviledged process which handles all the > > > incoming events? I'm asking because the permission checking can be > > > relatively expensive (think of acls) so we better do it for a reason. > > > I'd prefer to hear from Eric what the original intention regarding > > > permissions was... > > > > If I understand correctly, passing to an unprivileged process is the > > point. The point is I think that supposedly one only needs to > > CAP_SYS_ADMIN to use fanotify. However, once you have that capability, > > then you implicitly get the effect of CAP_DAC_READ_SEARCH and > > CAP_DAC_OVERRIDE as well. > Ah, OK. Thanks for explanation. Then I'm OK with the patch. So feel free > to add: > > Reviewed-by: Jan Kara Hum, when digging more around this code, I've found out that fanotify_mark() checks whether it has a read permission to a watched file when creating the mark (in fanotify_find_path()). So I don't think it's really worth it to recheck the permissions when creating a file descriptor for the event. Sure it may be somewhat surprising that read fd is created after a process doesn't have access to the file anymore but OTOH it is similar to a situation where the process has opened the file long time ago. Honza > > >> fs/notify/fanotify/fanotify_user.c | 20 +++++++++++++++----- > > >> 1 file changed, 15 insertions(+), 5 deletions(-) > > >> > > >> diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c > > >> index 4e565c8..5d22a20 100644 > > >> --- a/fs/notify/fanotify/fanotify_user.c > > >> +++ b/fs/notify/fanotify/fanotify_user.c > > >> @@ -62,6 +62,8 @@ static int create_fd(struct fsnotify_group *group, > > >> { > > >> int client_fd; > > >> struct file *new_file; > > >> + int mask; > > >> + int ret; > > >> > > >> pr_debug("%s: group=%p event=%p\n", __func__, group, event); > > >> > > >> @@ -75,11 +77,19 @@ static int create_fd(struct fsnotify_group *group, > > >> */ > > >> /* it's possible this event was an overflow event. in that case dentry and mnt > > >> * are NULL; That's fine, just don't call dentry open */ > > >> - if (event->path.dentry && event->path.mnt) > > >> - new_file = dentry_open(&event->path, > > >> - group->fanotify_data.f_flags | FMODE_NONOTIFY, > > >> - current_cred()); > > >> - else > > >> + if (event->path.dentry && event->path.mnt) { > > >> + /* check permissions before granting access to file */ > > >> + mask = MAY_READ; > > >> + if (group->fanotify_data.f_flags & (O_RDWR | O_WRONLY)) > > >> + mask |= MAY_WRITE; > > >> + ret = inode_permission(event->path.dentry->d_inode, mask); > > >> + if (ret) > > >> + new_file = ERR_PTR(ret); > > >> + else > > >> + new_file = dentry_open(&event->path, > > >> + group->fanotify_data.f_flags | FMODE_NONOTIFY, > > >> + current_cred()); > > >> + } else > > >> new_file = ERR_PTR(-EOVERFLOW); > > >> if (IS_ERR(new_file)) { > > >> /* > > >> -- > > >> 1.9.1 > > >> > > > -- > > > Jan Kara > > > SUSE Labs, CR > > > > > > > > -- > > Michael Kerrisk > > Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ > > Linux/UNIX System Programming Training: http://man7.org/training/ > -- > Jan Kara > SUSE Labs, CR -- Jan Kara SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/