Received: by 10.192.165.156 with SMTP id m28csp1130322imm; Wed, 11 Apr 2018 13:01:14 -0700 (PDT) X-Google-Smtp-Source: AIpwx49jfzakyeTO/s6w/zRt0EjWvTSOotOqFnqfQOLJV2OKZgwfj3ynzv6oJiotViZ5BywlijlY X-Received: by 2002:a17:902:5609:: with SMTP id h9-v6mr6499737pli.121.1523476874100; Wed, 11 Apr 2018 13:01:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523476874; cv=none; d=google.com; s=arc-20160816; b=Z/oOgBCw9Apw/kehS81UEnMv3r1F+qDhl06TTfnDG50/p2HtLg7obEMzrOMVEE20de mtzNvd4j1fbkTS2yL5tvntvebFwo1NSNVfS8h8dE1ZVq3toPcpJ1Bb/c76Rc9p3+e3XB Wkl6KjioCG+worQOt2x/xPH0dmFwZ5mwAArToBCobfDuUooUhUwld5WXczkgHvhs5W4V IaKRozTOUVFLKfttRJ4j4dAMoqw+Qqk0nIZbU1H0bB2xfesiCqs8d0vo3hiKEMdzEVAc ZgelL9COvrSuKbKjpF+X0II76N3FgKqy4Q0zXAIshBLY9uPogBo1xyg+i5m5ggbW79gI l4PQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:date:from:arc-authentication-results; bh=wCXQ1J00+gFoahzZK1D2eRo13l9bTTFwX4G8Mxxp0yo=; b=gSTN8QvYlZu04oWaPFQ7cbA8AwYaYLZNxtcFpgbuwTT/9tKRbGSl9SqNcXlh/fc/MN VBf02Fn7deBHSCPf2zqIpF78zPWe/Nsuyi+8fdzyGScTJ76/rn3GZxDD8XI2HTbzipLg SEBAAuwXH0ZECA2RDEdITJjFosvFovA3sTT7dFsREYgsi+DVdcPkPNcVGriZsYgSZW1I AziK38xsKX+vSLJfjc9zR1kFkcdneeTAO2rnbunnSWPE6aAk7Bi2h0bLbBiIFGxgncaB oOqWeHTdu0sT2KbbG/Kxl1HCm80fPBy9NjUmUlgnS4mb/PrRQxjUvx5snV2sWwVSXAru JgXw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 3-v6si1664383plu.465.2018.04.11.13.00.35; Wed, 11 Apr 2018 13:01:14 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932481AbeDKT5s (ORCPT + 99 others); Wed, 11 Apr 2018 15:57:48 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:52572 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756425AbeDKT5q (ORCPT ); Wed, 11 Apr 2018 15:57:46 -0400 Received: from mail-wm0-f71.google.com ([74.125.82.71]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1f6LsH-0004r8-CX for linux-kernel@vger.kernel.org; Wed, 11 Apr 2018 19:57:45 +0000 Received: by mail-wm0-f71.google.com with SMTP id b23so1599981wme.3 for ; Wed, 11 Apr 2018 12:57:45 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:date:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=wCXQ1J00+gFoahzZK1D2eRo13l9bTTFwX4G8Mxxp0yo=; b=GpGZIuv37ZjONDl3sc1NOvjYXwYKo479mmF2epm8hZ2V9O1dC24rmoBPHQlDCsIsLT 7HwMG13UWQBhitdVpzFMHKsvpVFCoWzm4jZr2gYP0JcFdDVwIqQ1x4FYENnxqC3oo+kr odnGvLvPANk4p9T+Waa3ldUMG6xlYMyFS6RYlkhgnTCr3CADo2b7k28pKAsr37H1hv7k n8HgKORBHFlxBHKj3yJKhvDhkLMXmf8UMr6UY9s4XRuxJHw5IyhAfk0n3jP1v9Ix0MBq 824EUeOKEifiF0gfMrmtj7S04DDFsYVw22tHw++YMhAfRkcoHnXYQLnF4XbfUysdlp+Y floQ== X-Gm-Message-State: ALQs6tBRj4oWAVGnZHcsu4NPQS71UdftHeaxjPcQGfz39aWpwt/Dztap UXzoh64PmhquPfISxjJTfBzM6fGe+JyIu57Ur+DXYKXBLAXRKBtJAu9GPjrRfXzBe+cQbm6z0Dj onxHO2Qf88KVA5Nr6abn4RVd0fZauhj16vV+zTEVYoA== X-Received: by 10.28.190.3 with SMTP id o3mr3694004wmf.57.1523476665034; Wed, 11 Apr 2018 12:57:45 -0700 (PDT) X-Received: by 10.28.190.3 with SMTP id o3mr3693990wmf.57.1523476664764; Wed, 11 Apr 2018 12:57:44 -0700 (PDT) Received: from gmail.com ([2a02:8070:8895:9700:29d3:13fa:afa8:ff34]) by smtp.gmail.com with ESMTPSA id t8sm1763158wmc.20.2018.04.11.12.57.43 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 11 Apr 2018 12:57:44 -0700 (PDT) From: Christian Brauner X-Google-Original-From: Christian Brauner Date: Wed, 11 Apr 2018 21:57:43 +0200 To: "Eric W. Biederman" Cc: Kirill Tkhai , davem@davemloft.net, gregkh@linuxfoundation.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, avagin@virtuozzo.com, serge@hallyn.com Subject: Re: [PATCH net-next] netns: filter uevents correctly Message-ID: <20180411195742.GA640@gmail.com> References: <20180409154627.GA15157@gmail.com> <878t9wx8xw.fsf@xmission.com> <20180410143515.GA14186@gmail.com> <87in8zumpd.fsf@xmission.com> <20180411090907.GA20340@gmail.com> <87tvshlms1.fsf@xmission.com> <20180411170333.GA4319@gmail.com> <87efjllhcx.fsf@xmission.com> <20180411185715.GA15862@gmail.com> <871sflk0zc.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <871sflk0zc.fsf@xmission.com> User-Agent: Mutt/1.9.4 (2018-02-28) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 11, 2018 at 02:16:23PM -0500, Eric W. Biederman wrote: > Christian Brauner writes: > > > On Wed, Apr 11, 2018 at 01:37:18PM -0500, Eric W. Biederman wrote: > >> Christian Brauner writes: > >> > >> > On Wed, Apr 11, 2018 at 11:40:14AM -0500, Eric W. Biederman wrote: > >> >> Christian Brauner writes: > >> >> > Yeah, agreed. > >> >> > But I think the patch is not complete. To guarantee that no non-initial > >> >> > user namespace actually receives uevents we need to: > >> >> > 1. only sent uevents to uevent sockets that are located in network > >> >> > namespaces that are owned by init_user_ns > >> >> > 2. filter uevents that are sent to sockets in mc_list that have opened a > >> >> > uevent socket that is owned by init_user_ns *from* a > >> >> > non-init_user_ns > >> >> > > >> >> > We account for 1. by only recording uevent sockets in the global uevent > >> >> > socket list who are owned by init_user_ns. > >> >> > But to account for 2. we need to filter by the user namespace who owns > >> >> > the socket in mc_list. So in addition to that we also need to slightly > >> >> > change the filter logic in kobj_bcast_filter() I think: > >> >> > > >> >> > diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c > >> >> > index 22a2c1a98b8f..064d7d29ace5 100644 > >> >> > --- a/lib/kobject_uevent.c > >> >> > +++ b/lib/kobject_uevent.c > >> >> > @@ -251,7 +251,8 @@ static int kobj_bcast_filter(struct sock *dsk, struct sk_buff *skb, void *data) > >> >> > return sock_ns != ns; > >> >> > } > >> >> > > >> >> > - return 0; > >> >> > + /* Check if socket was opened from non-initial user namespace. */ > >> >> > + return sk_user_ns(dsk) != &init_user_ns; > >> >> > } > >> >> > #endif > >> >> > > >> >> > > >> >> > But correct me if I'm wrong. > >> >> > >> >> You are worrying about NETLINK_LISTEN_ALL_NSID sockets. That has > >> >> permissions and an explicit opt-in to receiving packets from multiple > >> >> network namespaces. > >> > > >> > I don't think that's what I'm talking about unless that is somehow the > >> > default for NETLINK_KOBJECT_UEVENT sockets. What I'm worried about is > >> > doing > >> > > >> > unshare -U --map-root > >> > > >> > then opening a NETLINK_KOBJECT_UEVENT socket and starting to listen to > >> > uevents. Imho, this should not be possible because I'm in a > >> > non-init_user_ns. But currently I'm able to - even with the patch to > >> > come - since the uevent socket in the kernel was created when init_net > >> > was created and hence is *owned* by the init_user_ns which means it is > >> > in the list of uevent sockets. Here's a demo of what I mean: > >> > > >> > https://asciinema.org/a/175632 > >> > >> Why do you care about this case? > > > > It's not so much that I care about this case since any workload that > > wants to run a separate udevd will have to unshare the network namespace > > and the user namespace for it to make complete sense. > > What I do care about is that the two of us are absolutely in the clear > > about what semantics we are going to expose to userspace and it seems > > that we were talking past each other wrt to this "corner case". > > For userspace, it needs to be very clear that the intention is to filter > > by *owning user namespace of the network namespace a given task resides > > in* and not by user namespace of the task per se. This is what this > > corner case basically shows, I think. > > If this is just a clarification of semantics then yes this is a > productive question. I almost agree with your definition above. > > I would make the definition very simple. Uevents will not be broadcast > via netlink in a network namespace where net->user_ns != &init_user_ns, > with the exception of uevents for network devices in that network > namespace. Well, for the sake of posterity :) I should add that I'd prefer we'd add what I suggested above: - return 0; + /* Check if socket was opened from non-initial user namespace. */ + return sk_user_ns(dsk) != &init_user_ns; } to slam the door shut once and for all for all non-init_user_ns namespaces because it *seems* like the cleanest solution: uevents are owned by init_user_ns; period. Because it is the only user namespace that can do anything interesting with them *by default*. But what we have now right now with my upcoming patch is at least sufficient and safe. Christian > > The existing filtering by the sending uid and verifying that it is uid 0 > gives a little more room to filter if we want (as udev & friends will > ignore the uevent), but I don't see the point. > > Eric