Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 6 Apr 2022 14:59:41 -0700
From:   Stephen Hemminger <stephen@networkplumber.org>
To:     Yann Droneaud <ydroneaud@opteya.com>
Cc:     "David S . Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] af_unix: Escape abstract unix socket address
Message-ID: <20220406145941.728b4cb5@hermes.local>
In-Reply-To: <20220406102213.2020784-1-ydroneaud@opteya.com>
References: <20220406102213.2020784-1-ydroneaud@opteya.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Wed,  6 Apr 2022 12:22:13 +0200
Yann Droneaud <ydroneaud@opteya.com> wrote:

> Abstract unix socket address are bytes sequences up to
> 108 bytes (UNIX_PATH_MAX == sizeof(struct sockaddr_un) -
> offsetof(struct sockaddr_un, sun_path)).
> 
> As with any random string of bytes, printing them in
> /proc/net/unix should be done with caution to prevent
> misbehavior.
> 
> It would have been great to use seq_escape_mem() to escape
> the control characters in a reversible way.
> 
> Unfortunately userspace might expect that NUL bytes are
> replaced with '@' characters as it's done currently.
> 
> So this patch implements the following scheme: any control
> characters, including NUL, in the abstract unix socket
> addresses is replaced by '@' characters.
> 
> Sadly, with such non reversible escape scheme, abstract
> addresses such as "\0\0", "\0\a", "\0\b", "\0\t", etc.
> will have the same representation: "@@".
> 
> But will prevent "cat /proc/net/unix" from messing with
> terminal, and will prevent "\n" in abstract address from
> messing with parsing the list of Unix sockets.
> 
> Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
> ---
>  net/unix/af_unix.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index e71a312faa1e..8021efd92301 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -3340,7 +3340,8 @@ static int unix_seq_show(struct seq_file *seq, void *v)
>  				i++;
>  			}
>  			for ( ; i < len; i++)
> -				seq_putc(seq, u->addr->name->sun_path[i] ?:
> +				seq_putc(seq, !iscntrl(u->addr->name->sun_path[i]) ?
> +					 u->addr->name->sun_path[i] :
>  					 '@');
>  		}
>  		unix_state_unlock(s);

Unfortunately, you will break userspace ABI with this.