Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760269AbaJ3O62 (ORCPT ); Thu, 30 Oct 2014 10:58:28 -0400 Received: from mail-la0-f47.google.com ([209.85.215.47]:41648 "EHLO mail-la0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751426AbaJ3O60 (ORCPT ); Thu, 30 Oct 2014 10:58:26 -0400 MIME-Version: 1.0 In-Reply-To: <20141030144855.GA9705@dztty> References: <1414620056-6675-1-git-send-email-gregkh@linuxfoundation.org> <1414620056-6675-9-git-send-email-gregkh@linuxfoundation.org> <8738a6w6kv.fsf@x220.int.ebiederm.org> <20141030095854.GA4716@dztty> <87wq7hiwjb.fsf@x220.int.ebiederm.org> <20141030144855.GA9705@dztty> From: Andy Lutomirski Date: Thu, 30 Oct 2014 07:58:04 -0700 Message-ID: Subject: Re: kdbus: add code for buses, domains and endpoints To: Djalal Harouni Cc: "Eric W. Biederman" , Greg Kroah-Hartman , Linux API , "linux-kernel@vger.kernel.org" , John Stultz , Arnd Bergmann , Tejun Heo , Marcel Holtmann , Ryan Lortie , Bastien Nocera , David Herrmann , Simon McVittie , Daniel Mack , "alban.crequy" , Javier Martinez Canillas , Tom Gundersen Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 30, 2014 at 7:48 AM, Djalal Harouni wrote: > On Thu, Oct 30, 2014 at 05:15:04AM -0700, Eric W. Biederman wrote: >> Djalal Harouni writes: >> What others are doing makes it very hard to safely use allow those >> ioctls in a tightly sandboxed application, as it is unpredictable >> what the sandboxed ioctl can do with the file descriptor. >> >> Further an application that calls setresuid at different times during >> it's application will behave differently. Which makes ioctls that do >> not have consistent behavior after open time inappropriate for use in >> userspace libraries. > We are consistent in our checks, you say that the application will > behave differently when it calls setresuid() sure! If it changes its > creds then regain of course it will behave differently! and the checks > are here to make sure that setresuid() and alike work correctly when the > application changes its creds and calls-in. > Except that it isn't consistent. If I open a postgresql socket that wants me to be root and then I drop privileges, I can keep talking to postresql. This is a good thing, because it means that I can keep talking to postgresql but I lose my privilege to do other things. The new kdbus model breaks this. If I start as root and drop privileges to UID_PRIVSEP, then my attempts to communicate over already-open connections shouldn't consider UID_PRIVSEP. In the, they shouldn't tell the other endpoints that UID_PRIVSEP exists at all unless I've explicitly asked the kernel for this behavior. I suggest reading up on the object capability model. Linux isn't one, but large deviations (like kdbus') from an object capability model are rarely a good thing. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/