Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <2ff479df-1f88-ecd0-8a0e-7d31ab02ca0d@rasmusvillemoes.dk>
Date:   Mon, 16 May 2022 09:51:10 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.7.0
Subject: Re: procfs: open("/proc/self/fd/...") allows bypassing O_RDONLY
Content-Language: en-US
To:     Simon Ser <contact@emersion.fr>,
        Amir Goldstein <amir73il@gmail.com>
Cc:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>
References: <lGo7a4qQABKb-u_xsz6p-QtLIy2bzciBLTUJ7-ksv7ppK3mRrJhXqFmCFU4AtQf6EyrZUrYuSLDMBHEUMe5st_iT9VcRuyYPMU_jVpSzoWg=@emersion.fr>
 <CAOQ4uxjOOe0aouDYNdkVyk7Mu1jQ-eY-6XoW=FrVRtKyBd2KFg@mail.gmail.com>
 <Uc-5mYLV3EgTlSFyEEzmpLvNdXKVJSL9pOSCiNylGIONHoljlV9kKizN2bz6lHsTDPDR_4ugSxLYNCO7xjdSeF3daahq8_kvxWhpIvXcuHA=@emersion.fr>
From:   Rasmus Villemoes <linux@rasmusvillemoes.dk>
In-Reply-To: <Uc-5mYLV3EgTlSFyEEzmpLvNdXKVJSL9pOSCiNylGIONHoljlV9kKizN2bz6lHsTDPDR_4ugSxLYNCO7xjdSeF3daahq8_kvxWhpIvXcuHA=@emersion.fr>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12/05/2022 14.38, Simon Ser wrote:
> On Thursday, May 12th, 2022 at 14:30, Amir Goldstein <amir73il@gmail.com> wrote:
> 
>> Clients can also readlink("/proc/self/fd/<fd>") to get the path of the file
>> and open it from its path (if path is accessible in their mount namespace).
> 
> What the compositor does is:
> 
> - shm_open with O_RDWR
> - Write the kyeboard keymap
> - shm_open again the same file with O_RDONLY
> - shm_unlink
> - Send the O_RDONLY FD to clients
> 
> Thus, the file doesn't exist anymore when clients get the FD.

So, what happens if you do fchmod(fd, 0400) on the fd before passing it
to the client [1].

I assume the client is not running as the same uid as the compositor (so
it can't fchmod() the inode back); if it is, then it could just ptrace
you and all bets are off.

[1] or for that matter, simply specify 0400 as the mode argument when
creating the file - that's perfectly legal to do in conjunction with
O_RDWR | O_CREAT | O_EXCL, and should probably be done to prevent
anybody else from opening the same shm file with write permission before
it gets shm_unlinked.

Rasmus