Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756856AbaJ3D4X (ORCPT ); Wed, 29 Oct 2014 23:56:23 -0400 Received: from mail-lb0-f178.google.com ([209.85.217.178]:50016 "EHLO mail-lb0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752590AbaJ3D4W (ORCPT ); Wed, 29 Oct 2014 23:56:22 -0400 MIME-Version: 1.0 In-Reply-To: <87k33iw759.fsf@x220.int.ebiederm.org> References: <1414620056-6675-1-git-send-email-gregkh@linuxfoundation.org> <1414620056-6675-6-git-send-email-gregkh@linuxfoundation.org> <87k33iw759.fsf@x220.int.ebiederm.org> From: Andy Lutomirski Date: Wed, 29 Oct 2014 20:55:58 -0700 Message-ID: Subject: Re: kdbus: add connection, queue handling and message validation code To: "Eric W. Biederman" Cc: Greg Kroah-Hartman , Linux API , "linux-kernel@vger.kernel.org" , John Stultz , Arnd Bergmann , Tejun Heo , Marcel Holtmann , Ryan Lortie , Bastien Nocera , David Herrmann , Djalal Harouni , Simon McVittie , daniel@zonque.org, alban.crequy@collabora.co.uk, Javier Martinez Canillas , Tom Gundersen Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Oct 29, 2014 at 8:47 PM, Eric W. Biederman wrote: > Greg Kroah-Hartman writes: > >> From: Daniel Mack >> >> This patch adds code to create and destroy connections, to validate >> incoming messages and to maintain the queue of messages that are >> associated with a connection. >> >> Note that connection and queue have a 1:1 relation, the code is only >> split in two parts for cleaner separation and better readability. > > You are not performing capability checks at open time. > > As such this API is suceptible to a host of file descriptor passing attacks. To be fair, write(2) doesn't work on these fds, so the usual attacks don't work. But who knows what absurd things kdbus clients will do with fd passing? --Andy > >> Signed-off-by: Daniel Mack >> Signed-off-by: Greg Kroah-Hartman >> --- > >> +/* >> + * Check for maximum number of messages per individual user. This >> + * should prevent a single user from being able to fill the receiver's >> + * queue. >> + */ >> +static int kdbus_conn_queue_user_quota(struct kdbus_conn *conn, >> + const struct kdbus_conn *conn_src, >> + struct kdbus_queue_entry *entry) >> +{ >> + unsigned int user; >> + >> + if (!conn_src) >> + return 0; >> + >> + if (ns_capable(&init_user_ns, CAP_IPC_OWNER)) >> + return 0; > > -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/