Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
To:     Christian Brauner <brauner@kernel.org>
CC:     Jakub Kicinski <kuba@kernel.org>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "edumazet@google.com" <edumazet@google.com>,
        "pabeni@redhat.com" <pabeni@redhat.com>,
        "zbr@ioremap.net" <zbr@ioremap.net>,
        "johannes@sipsolutions.net" <johannes@sipsolutions.net>,
        "ecree.xilinx@gmail.com" <ecree.xilinx@gmail.com>,
        "leon@kernel.org" <leon@kernel.org>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "socketcan@hartkopp.net" <socketcan@hartkopp.net>,
        "petrm@nvidia.com" <petrm@nvidia.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
Subject: Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs
Thread-Topic: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs
Thread-Index: AQHZU53jvr0f3jRxyk20sGUEtokB+a75b4CAgACKCICAHO/eAA==
Date:   Sat, 1 Apr 2023 18:32:31 +0000
Message-ID: <AB1355C3-08FA-4A96-A5E5-56FCF35D4921@oracle.com>
References: <20230310221547.3656194-1-anjali.k.kulkarni@oracle.com>
 <20230310221547.3656194-3-anjali.k.kulkarni@oracle.com>
 <20230313172441.480c9ec7@kernel.org>
 <20230314083843.wb3xmzboejxfg73b@wittgenstein>
In-Reply-To: <20230314083843.wb3xmzboejxfg73b@wittgenstein>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?eWsbkFMZ4GDeVfQeC5e7KrDE3OWZWGOdnK8mgcd50QnZadKJEYpvXSH3DDJZ?=
 =?us-ascii?Q?q67msNXd7qbz3SV9OkC8UqsObWNr/mckegCasf8OyHlX8j/Pxoe6I0Fptm7g?=
 =?us-ascii?Q?rEiki1FgwpjlPPBtR/GC4x55J4y6NWHC4p/i9kahntcZH6rp0muvw3WG4lq+?=
 =?us-ascii?Q?Re37CXHz3OkMm+GXgeennR2KJT7wCJSCj+jDGGKuoG1NRRpLC7GPzWX5bnoN?=
 =?us-ascii?Q?IzHsiA72dU8rlBnFIka2LH/Hkz5jOiKEM2ZERtCON5BxzaSPxYwkdvf1TIZ8?=
 =?us-ascii?Q?x5nCclokxwFWrgn8cpj9ZUStABl/Q3cFuynBlp+4g6EA38pBDRoQL3nm6hQF?=
 =?us-ascii?Q?9+yVo+cACvXGBsVBmxZxkUNkwHN5F3ZMd4LDievfn9Lb8/4fO+dLoRMjIfOJ?=
 =?us-ascii?Q?jCd2sWSFSgz0MALWCzP3NaKYPTkwCvIh2/f5W/yXPUOA+xtCxgk3w9HPRjwr?=
 =?us-ascii?Q?ivs2n0G2qKcLY7czmToF27Wg8R2NNBOsm4h6+QrIZCYiB81h3maQKc/7s2xF?=
 =?us-ascii?Q?1YC9NkCDYIwCnDvdzoM1fpAq78FZeZ0F2E/JoMVwFADXCCI9E+2mK5al/RkU?=
 =?us-ascii?Q?66keUrNYrQ11O7vGAYYghenFwzjDObTiToDcQHSTly4fpJ429yupzSLwQWN1?=
 =?us-ascii?Q?dU6rfyivrS6vjRLd45M7MHnBHKPeMNgOFNgf2UY7dPoeNEPX9U/N7mECXRWf?=
 =?us-ascii?Q?tqeaJad2AsK2D95Toy0Ny5MWcIJPHmvEMF5NdpFL4JUsQ9rJ/arvZhJhZ+Fc?=
 =?us-ascii?Q?t+ifqzIKVcjkOYmwBe0RXuCH5rIDYAHTvsHVQEUnOyfofgv170+TsORSiGlG?=
 =?us-ascii?Q?hlAF55IxlyJg7eGfghT0w1pnxJ5Sh+4I/JQkBQszKXXXXMbtRHXnD7R/ofG1?=
 =?us-ascii?Q?wSBiepi/YZitmr9ShDJf8dOunpqEW3X05kmFBijpiUzjxU+hpN6NQHpIb3oa?=
 =?us-ascii?Q?olwn05dWRwdvVs+3O2YB8qM+AUaivCuIkak5xRqzKtz3HXEfVdWZzAZKy2Sp?=
 =?us-ascii?Q?LWsexHaRGqGmLkX80S4S5ZTNOamccOabXOgCRnbgSQyI5WsaE3I1HG4LFd4Z?=
 =?us-ascii?Q?tkSOEXIgUeyR4+9IEbyM8dzSu/fSiBu7i0gVuqek5Mts+1kp+gonleh4dSDX?=
 =?us-ascii?Q?NhCpJX9mUYbNua5EpJFDxh8pRi4+TJf9bpTELQT9y4+kzqUe7HjPKKG8FJRy?=
 =?us-ascii?Q?+ckIH831L4ldePQbhG1Izc9uPBC/o9rn7B6k4IrNEmPpU87junyH46043cB2?=
 =?us-ascii?Q?F8UvRJXj2y7BCE2h06lJNlziyNCdXOtV97If66eqyMvt/JmTMSJpY251Kdbn?=
 =?us-ascii?Q?NZyRnw642DLKEDRolQC7XSAdNbE1DzZ5D8pQqi4vAhpg7Y69amjc8ltwohTL?=
 =?us-ascii?Q?rg8sML8YlVks1MrnVOIl1lirKMBgq8k1K5o8hGOYCozfqWmT14XlVFbx4hBa?=
 =?us-ascii?Q?FZnyBhjjFvtQzS08c3+3WhIfMzOZqhVnOSW7haegqyuVObR7qb4l67yGqqDT?=
 =?us-ascii?Q?V37/OkMiaO/y3IxwfdzEi0Kv2xtPPPP4i2o42uU6TAnFwUwkON/ehUcvz6gg?=
 =?us-ascii?Q?t6JHG/7+mcejOy8jvv0EYElCumHQLmDuPRNlPqIpon28YPyV+Huo2LJk0RZw?=
 =?us-ascii?Q?HDBFGTaj14ZyhtX+P8Kc3la6R7mNFVnAD6taPS0TUFFt?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AD87CC0145A06E458186C690FB77050C@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?9rU3vxIQgWpjvhtgwxE6K9Ew3oiZInB3skL3X75asL/M+uzmR6jEdKEmQoLk?=
 =?us-ascii?Q?KOyV5sOm0ESic6sh1VSpQcfURFsNZifluRnuYWbmTfr0GwTqnRvycDX0/IW1?=
 =?us-ascii?Q?UZH+8APy0+RZmp1BtAEZioJC25PuQfrEWVQZbksYxeSo43lYyoPNhRGbD0bl?=
 =?us-ascii?Q?l4e8nT0wK4QGtJr2crDkzbM017R5APFxgfqCQKYabRAJI0zfLaB+yBMnYi7L?=
 =?us-ascii?Q?JH/uHIWeV5dzSKLEw1A4nS24hHVw9/YS5NJXQVTuMvRhKs51Bss8chMvpTCK?=
 =?us-ascii?Q?CEDEgNpr55o0IQbuAowC0pybYORwwdu3nwlGhpWqZcfE1c3uH7b8XV8rbAyB?=
 =?us-ascii?Q?432WykTX7e7soiw3nrNxydAf0D+WDQEHTPUlnAgX+YmwuivC8BgQHs6Aiptv?=
 =?us-ascii?Q?+9057MePAPUbCl8CcBs0Pl6OJ1mLNR6fcLfa2U+mNM6IUbR8qkn0YZknvCVE?=
 =?us-ascii?Q?69ROdiNS+eVnarc7bGlJ45ZksWPJgp4S6Xwj0K8WkWWohn+s8NyIdiCDrMVu?=
 =?us-ascii?Q?K3b/UTLk2J0mSxCWPMWxptbxWlpISIkM38vCCkamB2TkB9mGfv1Ktp+Z0fst?=
 =?us-ascii?Q?s/3looe0FMQ+JgvAiISVMseiBEylE4wKTqzeYwZWqJqMBjD5ORXjwIJYgoJV?=
 =?us-ascii?Q?ocVOHUZWAehD03jJGdvjo/iPRq5vSq4w6DBA+DSizxbAFdODEZtePCn86iet?=
 =?us-ascii?Q?jVgnlTKGznfZkMUmCg16PKJPiu+OWPzT2EFt4U4b/j4qVMVm64sVSsk9poSd?=
 =?us-ascii?Q?dST8HotKKIF22PDAawJz+9Xh0YPK1WhsxFmhwlFMCCzhAuu9ODWAxB736xMa?=
 =?us-ascii?Q?EC16pWw5r8V1pDJ5eJDp3/4Ev8uqmhV4RJ0Ae/zQGyFHzNC7N9o0xC/AMfTy?=
 =?us-ascii?Q?zdD4/jfEltSX2CZtnzwgZ8y45FJDUpHQ/JS0j1LLaC+mrqOZrtOmAm7arB3e?=
 =?us-ascii?Q?3Jgc/PIHta+i2/ZF4rbIIKA+SwhPEmpkz9pkr5tupGQVc8857q3m5ZxeP6jo?=
 =?us-ascii?Q?zETFOFOXdBbmrG7uqUYX1lxVQHFn074PQrX9dnQ54485jOhR106d6kKCY30h?=
 =?us-ascii?Q?BRpOS0aurfIOWHtN1StMDus464RtSw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4129.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4e970ac9-e106-44a9-f6b0-08db32df744d
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2023 18:32:31.3385
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: cVROXJYWJq6kw9C0cEbID2IjeTxkdzaDdni4FZ3duSSVFXyKXyVIbDxo355Wd2MNzzXRLZhEshImhlblFp6euxRIBI1OxBZxdbh8OkZ/z48=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB6250
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-31_07,2023-03-31_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 phishscore=0
 suspectscore=0 adultscore=0 mlxlogscore=999 bulkscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000
 definitions=main-2304010168
X-Proofpoint-GUID: dwMAR6ht2szuxVN6hBTSo-cgrgyZt5Xp
X-Proofpoint-ORIG-GUID: dwMAR6ht2szuxVN6hBTSo-cgrgyZt5Xp
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Mar 14, 2023, at 1:38 AM, Christian Brauner <brauner@kernel.org> wrote=
:
>=20
> On Mon, Mar 13, 2023 at 05:24:41PM -0700, Jakub Kicinski wrote:
>> On Fri, 10 Mar 2023 14:15:44 -0800 Anjali Kulkarni wrote:
>>> diff --git a/include/linux/connector.h b/include/linux/connector.h
>>> index 487350bb19c3..1336a5e7dd2f 100644
>>> --- a/include/linux/connector.h
>>> +++ b/include/linux/connector.h
>>> @@ -96,7 +96,11 @@ void cn_del_callback(const struct cb_id *id);
>>> *
>>> * If there are no listeners for given group %-ESRCH can be returned.
>>> */
>>> -int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid, u32 =
group, gfp_t gfp_mask);
>>> +int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid,
>>> +			 u32 group, gfp_t gfp_mask,
>>> +			 int (*filter)(struct sock *dsk, struct sk_buff *skb,
>>> +				 void *data),
>>> +			 void *filter_data);
>>=20
>> kdoc needs to be extended
>=20
> just a thought from my side. I think giving access to unprivileged users
> will require a little thought as that's potentially sensitive.
>=20
> If possible I would think that the patches that don't lead to a
> behavioral change should go in completely independently and then we can
> discuss the non-root access change.

Hi Christian,

Could you take a look at v4 and let me know your thoughts, so we can start =
a discussion on that thread? Do we need more filtering based on user ID /ot=
her parameters for exit status? Can we allow just non-zero notification (no=
t the exact exit status but just whether it was a 0 or a non-zero exit) be =
available to non-root users?=20

Do other folks have any more comments/suggestions?

Thanks
Anjali