Received-SPF: pass (google.com: domain of linux-kernel+bounces-42945-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Tue, 30 Jan 2024 01:56:47 +1100
From: Aleksa Sarai <cyphar@cyphar.com>
To: =?utf-8?B?5a2f5pWs5ae/?= <mengjingzi@iie.ac.cn>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: Identified Redundant Capability Check in File Access under
 /proc/sys
Message-ID: <20240129.145132-coarse.snow.stunned.whim-FB0Em3Z0Yuv@cyphar.com>
References: <30b59a4.19708.18d4f3f3620.Coremail.mengjingzi@iie.ac.cn>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="vo4uela55g3d7y46"
Content-Disposition: inline
In-Reply-To: <30b59a4.19708.18d4f3f3620.Coremail.mengjingzi@iie.ac.cn>


--vo4uela55g3d7y46
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2024-01-28, =E5=AD=9F=E6=95=AC=E5=A7=BF <mengjingzi@iie.ac.cn> wrote:
> Hello developers,
>=20
> I hope this message finds you well. I wanted to bring to your
> attention an observation regarding file access under /proc/sys in the
> kernel source code.
>=20
> Upon review, it appears that certain files are protected by
> capabilities in the kernel source code; however, the capability check
> does not seem to be effectively enforced during file access.
>=20
> For example, I noticed this inconsistency in the access functions of some=
 special files:
> 1. The access function mmap_min_addr_handler() in /proc/sys/vm/mmap_min_a=
ddr utilizes the CAP_SYS_RAWIO check.
> 2. The access function proc_dointvec_minmax_sysadmin() in /proc/sys/kerne=
l/kptr_restrict requires the CAP_SYS_ADMIN check.
>=20
> Despite these capability checks in the source code, when accessing a
> file, it undergoes a UGO permission check before triggering these
> specialized file access functions. The UGO permissions for these files
> are configured as root:root rw- r-- r--, meaning only the root user
> can pass the UGO check.
>=20
> As a result, to access these files, one must be the root user, who
> inherently possesses all capabilities. Consequently, the capabilities
> check in the file access function seems redundant.
>=20
> Please consider reviewing and adjusting the capability checks in the
> mentioned access functions for better alignment with the UGO
> permissions.

These are not redundant -- opening a file and writing to a file
descriptor are different operations that can be done by:

 1. The same process with the same credential set (what you're
    describing);
 2. The same process but with the write operation happening after a
    setuid() or similar operation that changed its credentials; or
 3. A different process that has been given access to the file
    descriptor (passing it as an open file to a subprocess, SCM_RIGHTS,
	etc.)

On Unix, access checks when opening a file for writing are different to
access checks when doing a write operation. For some sysctls, it is
prudent to restrict both the open and write operations to privileged
users.

> Thank you for your attention to this matter.
>=20
> Best regards,
> Jingzi Meng

--=20
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
<https://www.cyphar.com/>

--vo4uela55g3d7y46
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQS2TklVsp+j1GPyqQYol/rSt+lEbwUCZbe8pwAKCRAol/rSt+lE
b03fAP9VH1smXUs1qIwNgPTer9MEUBsfNyy+gb3uI+c1f4aS4wD/f65WIy2NbxTm
3VSOsgoc5IKkS2GKXtl9+06x4L55gg8=
=IQ1h
-----END PGP SIGNATURE-----

--vo4uela55g3d7y46--