From:   Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
To:     Christian Brauner <brauner@kernel.org>,
        Jakub Kicinski <kuba@kernel.org>
CC:     "davem@davemloft.net" <davem@davemloft.net>,
        "edumazet@google.com" <edumazet@google.com>,
        "pabeni@redhat.com" <pabeni@redhat.com>,
        "zbr@ioremap.net" <zbr@ioremap.net>,
        "johannes@sipsolutions.net" <johannes@sipsolutions.net>,
        "ecree.xilinx@gmail.com" <ecree.xilinx@gmail.com>,
        "leon@kernel.org" <leon@kernel.org>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "socketcan@hartkopp.net" <socketcan@hartkopp.net>,
        "petrm@nvidia.com" <petrm@nvidia.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs
Thread-Topic: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs
Thread-Index: AQHZU53jvr0f3jRxyk20sGUEtokB+a75b4CAgACKCICAAKp5bQ==
Date:   Tue, 14 Mar 2023 18:51:07 +0000
Message-ID: <BY5PR10MB412905AE523693D8D8A62669C4BE9@BY5PR10MB4129.namprd10.prod.outlook.com>
References: <20230310221547.3656194-1-anjali.k.kulkarni@oracle.com>
 <20230310221547.3656194-3-anjali.k.kulkarni@oracle.com>
 <20230313172441.480c9ec7@kernel.org>
 <20230314083843.wb3xmzboejxfg73b@wittgenstein>
In-Reply-To: <20230314083843.wb3xmzboejxfg73b@wittgenstein>
Accept-Language: en-US
Content-Language: en-US
msip_labels: 
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: BY5PR10MB4129:EE_|DM4PR10MB7389:EE_
x-ms-office365-filtering-correlation-id: 970816b0-d542-41bf-db9f-08db24bd123e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: gB6C7y8SnzcPMwJug6vzwlbsEGbK167uhZN5Atkq7xqV5unKv18SGnMT7c33oUmb2f63ut+SrugcYWSyphE6H2ZE7LApX/cY5wWM0yjgcIp2qvceAIG3zjq+HkdF6grJx8jqZk4bGC7WV10WENIEhOffSGtZxGG5yWOqRpXHJLSVKfO4ig40uAI3E32IKlreBXQksUyCS+IBg6PRTnFLYeSNgrmbDg7pblL5F9ELu5ykQMLpw9hqHcgUTW1tNr5rUCghsR+7d7bRIbX6nXTnh0n66R5VTURYYaKx/ANqAVnMqA47f5dirm1AeOwY+d04JEanIXKpNAakc9+Y2nboLQIxqjweZobpIy1H2XgTzA/Q9BXjkjM/pke+TPGiuia86JThSVKmNBOtlPhph1to7DgaaxzAJaDGNRzIsHIn9wyHRI6KA0cH7OthPzUnQm9xEMzhMzDsPZ1FmMabKBdPTZbaHsbeNulzi5oE492iUKa5swwDHNgqyWkFwcS0LI8Nt6/FRTq56cksCiXrXYpAOCvqUJufAhhqycaHGmO8RC8G00SGWY8jWKG+dkwu3aQ8MT00T3zfY6s4kD/zjZjGsUvjTu3Isef8E2dopo+rX+FDCccI3luebRhBMdAbgowL4qlWH/0zyH4TuvjbmQowkzzukkj6TF/XZ40xPa46N4+2+o0fyLE3WGIQGgV7XKiSCd9eP1ouV0C6xi5sVdO2WNtDsK99ojqk8kYz2f4ol2s=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR10MB4129.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230025)(39860400002)(366004)(136003)(396003)(376002)(346002)(451199018)(316002)(54906003)(110136005)(33656002)(55016003)(38100700002)(122000001)(86362001)(38070700005)(53546011)(83380400001)(6506007)(9686003)(186003)(71200400001)(7696005)(52536014)(5660300002)(478600001)(7416002)(41300700001)(66446008)(66476007)(64756008)(76116006)(8936002)(2906002)(66556008)(4326008)(66946007)(8676002)(586874003);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?gUJD6VqxQkLWQyvMAZJD2089spoWfFS+81mbSYR7Zt+fpcTGN6Q9KpvFeJ?=
 =?iso-8859-1?Q?taxhVfmsKK0rZapzuz7hNbq+Inf2kB4oU0r61a7Zv+ulOS0r2aDKjgqlfB?=
 =?iso-8859-1?Q?UdtiY1h/MkF9ijG+MFARsrS27Hxf5XbALOwvuYDtNPvFLIvnGcngqaQE5Z?=
 =?iso-8859-1?Q?SqhEFv0VUkeCx8EFZ2dhHjecxWV3j2122z7uxkOJmlpEi0yLgi4oFLs8CG?=
 =?iso-8859-1?Q?jQ+B6f79T4q/mMU8ig88gGJVuT25QRbkci+dn70NDvJpcge5E2nWODKuaZ?=
 =?iso-8859-1?Q?s/VbqQ/VmDsEZ/TLui6aCDDmAamUBas47elSK11FpUaVZWZkIioaFHPCML?=
 =?iso-8859-1?Q?JcV376+eR3d3oZ+YzqMwo3kqr9vZ7tfEadukXc6CaWF/MCrF+Ee6chyuYv?=
 =?iso-8859-1?Q?EFel3/Z625px5HE8LxnOXK9MKRcH3q7mlqEhxeGY05/tgg4+tja/KGKa1d?=
 =?iso-8859-1?Q?qUHwYuCvniob+lGGzDz236HMz3/K8OqPbVNJJzps33GQSDt+MauJ5cGB0r?=
 =?iso-8859-1?Q?bLfCCLi7mF4FNB40AZBOU8tuslf9+EVCdrvbozaf1T/jo+v8gedXuUtliU?=
 =?iso-8859-1?Q?zuDH1hJ91XzWfZ6vin/R0JyuSIRE96m9zWb8+yFPWmscAVmQ7DiEQtinQm?=
 =?iso-8859-1?Q?+wrxhcUVxqjhBQLjGDqf9GDIRDAU0OdeWPhJezy/CYBb2cg9hMDXGr5bof?=
 =?iso-8859-1?Q?mtHQNYtAU7upSlNra2ADIUXak9sF0j0WlGkye/aFOr4jbD5HlQut+DRCFX?=
 =?iso-8859-1?Q?1aFzTNzVe6H2BXdYBeViu7Xxr8eqxn7WlhszszMnsKaTfBnUzpRwJ2Kr5V?=
 =?iso-8859-1?Q?Y3SmZsmPDEjykRYcQd/vfAPjqvQBe7ynLf1YhfEMRsI1Z1nAqhViGCe8GG?=
 =?iso-8859-1?Q?1ztAClRLHsyDha7lrQbgcvHJ0b4yQpzAZqgl2i1S9GMIfS7RYHxDOf1nIL?=
 =?iso-8859-1?Q?XJfyaG3/aoMguL4aUIq0fwcX7zRheEIRMQHdDrFSJn17DVxIDAzzRfdqSI?=
 =?iso-8859-1?Q?rkM01hn2Sckapk6C7B3TDDsCM7I3/AnPeeJcrtR6Yhi+5RkbgLlHNSYYWt?=
 =?iso-8859-1?Q?+wrYcTUXZnjN8UQNQS1xCmIJKuxAt/hC/eCckxo1Rf9BgVUNs7S9Hsv+tb?=
 =?iso-8859-1?Q?hTrS3fQtomB1rzIHzIMVxdso5zEDVeepM10d8/yktlnRBcBcOV5z9ciHvg?=
 =?iso-8859-1?Q?5QlBvm3M9bJxYHHjipG72UKnZtc3Yx1WpDvLk5vZhYUI5Lz4a/ITJq7qSx?=
 =?iso-8859-1?Q?2Go+YnqKr3H4WDzERacZGAayGp3V66ev0Tw+Gagk4/oUcPH7PyaQZSGfsg?=
 =?iso-8859-1?Q?J6cf64ek+icHaJ0OWWgrj+3viQnrYqEP/+pG6IQ97yQy3Tf4LxD7TTO9nl?=
 =?iso-8859-1?Q?qzY+1vnHzFom6h3hKXBZdWiiu8MDBd/3SAjmp1S7E/n0PLTkclf6fRC5ea?=
 =?iso-8859-1?Q?UoDuXvb7BPbKJG9uJyCbuooO2DtdDMJ64HbVcXiHz/o1xhUp4aSVZ2vgmM?=
 =?iso-8859-1?Q?CdRNuRcpXn1eCAvnAg/Yburw2AdborB49Ts8XNk1903MbkxEMT54Iwg3T+?=
 =?iso-8859-1?Q?xRH21AHiRx4U96//TfLNg2HJK5uJt0iZIq5ilPJN+Ks+TElNqV5pGI37CO?=
 =?iso-8859-1?Q?pFuvNUGODzi2C3UJUkLEmzLr1dNiIdurvVLDGwUCzUawp9I5LfmahDnxHt?=
 =?iso-8859-1?Q?aUHcsA7fjOOev+PTG2g=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?iso-8859-1?Q?37TcF4rdG7NRz0HUe5fe6qpsnU9d3Zti1lSxC5tPSM5yXe10V6tSW+HNUE?=
 =?iso-8859-1?Q?kB1QQ/j+R5H0XF/V0JGJ/Mr2zoMTdIz2G0wJkRBJIK9zgUVAWzxSVEQhM+?=
 =?iso-8859-1?Q?DTh254Bb9jeN5cIxIN5y606PM64/uHC08HJwWZjYMyKBUNNQRqVEaL37Zi?=
 =?iso-8859-1?Q?rN03+0ZYSFqFc2/kd/T40zeC5yhSzEvY5MMqxpgxim66pjGdR6vWcBEtqj?=
 =?iso-8859-1?Q?7wFsWG0sUKeYaL/kaRQzapdsfiok6XaCmcpJ4zugUZT8GRvgrBA2bSoPBk?=
 =?iso-8859-1?Q?5IRsIRrJNeAZ55SD50u5bXj8nVDeYsS7HWZI/AE0VjUVHj12Hb9EUmLRno?=
 =?iso-8859-1?Q?3KVJHK2q0/ALmDtkYXRiiYr78XVlbwxGfbDPlPgUOvCKSUuc6Mmk8NjJMo?=
 =?iso-8859-1?Q?tewuV3j7dKYj/DWm0Rm2s/eld/2UAd2tga7d9aAiN07qeXkj/Wi8/aNVOx?=
 =?iso-8859-1?Q?jOyKHDITtB06NKeKPEqv2IOISOoul7AeHXBClYL+uz3DBdWAU2yaQBBmv7?=
 =?iso-8859-1?Q?nJCJePBDIz2wZXHfEG1W4D4bOFnGNrQYlGhZ4KDst+OunVCxMrHEhYH9IQ?=
 =?iso-8859-1?Q?q2ZzToaDMWKuSwf3Y/FxRZdydqV62yIOCpzvcAfPFJF8aIcUDUBwqEZm1W?=
 =?iso-8859-1?Q?0JUkGKaiYytYvXLk9oxE3DErw/SOQgZyZax7ZNQfLlu1M1quC6dyiEZjyL?=
 =?iso-8859-1?Q?ZJLVlH70Lk1PopOviyhhnnDRsw3seWfdP+RmNmIMTUaaxCJy8IROGB+ero?=
 =?iso-8859-1?Q?dsd8tefrv3oYDdUjN6cSBp8QmhLIzRyTNwWrkg3wsjzRalcDm3l8z7fTJu?=
 =?iso-8859-1?Q?4kEJGvMNIrqCBejAqIOXFamhY86hVv0hDuwTdTmEt5zNkMQToZzTbV6OY7?=
 =?iso-8859-1?Q?puSQ8zvmQHJQ/Qft/L1Cez1VqNiUcq27pYp9R4MzXRLvehq5Fv3eFycGAc?=
 =?iso-8859-1?Q?MXE9RIYdR3/cAQiXz0jX39MJUvrsCcmRdzfcFW63D4pzzPd5Hg5D7PWfcP?=
 =?iso-8859-1?Q?Nw+qL0OKUE2U560pXboHx0D9LuEHReKzOu/wxu1TafPtG9ZdqoTKjO8j1b?=
 =?iso-8859-1?Q?rrxDtipOCrDvKW6MytMQvLgHsyN5lbFQarT2Bq4//yxGrORKHPSwDrQPDJ?=
 =?iso-8859-1?Q?42h+qqnQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4129.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 970816b0-d542-41bf-db9f-08db24bd123e
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Mar 2023 18:51:07.6429
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 2wb/HWLlfK2y9HBkDlse9nhD7zk6S044GBfLBx4OLkS/HnDSPyLtN//xxupriTuEw8bAREpo0hde9JYJZZWVKW/zihhqzLlK9/riVdg6yrs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR10MB7389
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-14_12,2023-03-14_02,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 malwarescore=0
 mlxlogscore=999 mlxscore=0 suspectscore=0 bulkscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000
 definitions=main-2303140154
X-Proofpoint-GUID: 305TrrQQToayGlgGIBQR7T7F_8RtrPin
X-Proofpoint-ORIG-GUID: 305TrrQQToayGlgGIBQR7T7F_8RtrPin
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

=0A=
=0A=
________________________________________=0A=
From: Christian Brauner <brauner@kernel.org>=0A=
Sent: Tuesday, March 14, 2023 1:38 AM=0A=
To: Jakub Kicinski=0A=
Cc: Anjali Kulkarni; davem@davemloft.net; edumazet@google.com; pabeni@redha=
t.com; zbr@ioremap.net; johannes@sipsolutions.net; ecree.xilinx@gmail.com; =
leon@kernel.org; keescook@chromium.org; socketcan@hartkopp.net; petrm@nvidi=
a.com; linux-kernel@vger.kernel.org; netdev@vger.kernel.org=0A=
Subject: Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bu=
gs=0A=
=0A=
On Mon, Mar 13, 2023 at 05:24:41PM -0700, Jakub Kicinski wrote:=0A=
> On Fri, 10 Mar 2023 14:15:44 -0800 Anjali Kulkarni wrote:=0A=
> > diff --git a/include/linux/connector.h b/include/linux/connector.h=0A=
> > index 487350bb19c3..1336a5e7dd2f 100644=0A=
> > --- a/include/linux/connector.h=0A=
> > +++ b/include/linux/connector.h=0A=
> > @@ -96,7 +96,11 @@ void cn_del_callback(const struct cb_id *id);=0A=
> >   *=0A=
> >   * If there are no listeners for given group %-ESRCH can be returned.=
=0A=
> >   */=0A=
> > -int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid, u32 =
group, gfp_t gfp_mask);=0A=
> > +int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid,=0A=
> > +                    u32 group, gfp_t gfp_mask,=0A=
> > +                    int (*filter)(struct sock *dsk, struct sk_buff *sk=
b,=0A=
> > +                                  void *data),=0A=
> > +                    void *filter_data);=0A=
>=0A=
> kdoc needs to be extended=0A=
=0A=
just a thought from my side. I think giving access to unprivileged users=0A=
will require a little thought as that's potentially sensitive.=0A=
=0A=
If possible I would think that the patches that don't lead to a=0A=
behavioral change should go in completely independently and then we can=0A=
discuss the non-root access change.=0A=
ANJALI> That sounds fine. I can send the non-root change as the last patch =
=0A=
in the series. I can also add a change to allow the sensitive content only =
if=0A=
the user ID or parent ID matches etc. I know the exit status needs more=0A=
discussion..=0A=