Received-SPF: pass (google.com: domain of linux-kernel+bounces-107568-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Tue, 19 Mar 2024 14:07:16 +0100
From: Joel Granados <j.granados@samsung.com>
To: Thomas =?utf-8?Q?Wei=C3=9Fschuh?= <linux@weissschuh.net>
CC: "David S. Miller" <davem@davemloft.net>, Eric Dumazet
	<edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni
	<pabeni@redhat.com>, Dmitry Torokhov <dmitry.torokhov@gmail.com>, "Eric W.
 Biederman" <ebiederm@xmission.com>, <netdev@vger.kernel.org>,
	<linux-kernel@vger.kernel.org>, Luis Chamberlain <mcgrof@kernel.org>
Subject: Re: [PATCH] net: always initialize sysctl ownership
Message-ID: <20240319130716.vne4nhb3mbwtabfb@joelS2.panther.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="77xvdswkctbb3d3j"
Content-Disposition: inline
In-Reply-To: <20240315-sysctl-net-ownership-v1-1-2b465555a292@weissschuh.net>
CMS-TYPE: 201P
References: <CGME20240315162041eucas1p1b9254ef7e70f21b24b88d0999c34e9bd@eucas1p1.samsung.com>
	<20240315-sysctl-net-ownership-v1-1-2b465555a292@weissschuh.net>

--77xvdswkctbb3d3j
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 15, 2024 at 05:20:31PM +0100, Thomas Wei=DFschuh wrote:
> The sysctl core does not initialize these fields when the set_ownership
> callback is present.
This is a bit ambiguous as these values get set in the new_inode(sb)
call. What is really happening is that the GLOBAL_ROOT_[U|G]ID is not
getting the correct default.

> So always do it in the callback.
>=20
> Fixes: e79c6a4fc923 ("net: make net namespace sysctls belong to container=
's owner")
I think this is incorrect and here is why:
1. At the point of committing this code, the default behavior was
   dictated by the new_inode call. Which calculated the value from
   super_block *sb. This was Aug 10 2016 (approx).
2. The issue comes when a new default behavior is added by setting
   GLOBAL_ROOT_[U|G]ID in 5ec27ec735ba0 ("fs/proc/proc_sysctl.c: fix the
   default values of i_uid/i_gid on /proc/sys inodes"). This commit was
   in 2019 and missed adjusting net_ctl_set_ownership.

> Signed-off-by: Thomas Wei=DFschuh <linux@weissschuh.net>
> ---
>  net/sysctl_net.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
>=20
> diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> index 051ed5f6fc93..03e320ddacc9 100644
> --- a/net/sysctl_net.c
> +++ b/net/sysctl_net.c
> @@ -62,12 +62,10 @@ static void net_ctl_set_ownership(struct ctl_table_he=
ader *head,
>  	kgid_t ns_root_gid;
> =20
>  	ns_root_uid =3D make_kuid(net->user_ns, 0);
> -	if (uid_valid(ns_root_uid))
> -		*uid =3D ns_root_uid;
> +	*uid =3D uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
> =20
>  	ns_root_gid =3D make_kgid(net->user_ns, 0);
> -	if (gid_valid(ns_root_gid))
> -		*gid =3D ns_root_gid;
> +	*gid =3D gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
>  }
> =20
>  static struct ctl_table_root net_sysctl_root =3D {
>=20
> ---
> base-commit: e5eb28f6d1afebed4bb7d740a797d0390bd3a357
> change-id: 20240315-sysctl-net-ownership-bc4e17eaeea6
>=20
> Best regards,
> --=20
> Thomas Wei=DFschuh <linux@weissschuh.net>
>=20

--=20

Joel Granados

--77xvdswkctbb3d3j
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGyBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmX5jgIACgkQupfNUreW
QU9aBQv4y/kPkCfk3e1MiGhyEft349vB7oaq5TDecvH3jR+qdMK7I45JAJYT8FIh
nfuQEbUynAleV37MLpjGyMYfRCLeIZz/Lq3U35qqdbR/1qDCzaKLRXZy6LteIn6D
kjQ2A8F/HFNELD1zouCdYEBGkSgjXXuUWxQW78/JPuKQzQd4GcezlJAnn9J0nvJL
heG00PUNuEskrEPPQhxN2mxbQ0hs2RHZx5XVquBstCGMhOVNgWnpiR5267JpH8sN
khRQSr0XsSF8bn5rGteOm1WFiPt5cUJVZFj/XbJfEi/Qw+gPGtqNCXhl5gYvKhl6
f3fuAR1K5EM1nAFXd114hVIE6O8xMYCSnOwK7rUCZ9qQ2P6m8KrA8X47YygqT3GG
m8E5unPdQTp7oUNCAU+3AkJ3tXToxhD7xPS4QmwRrZH2BFCoHCMUhsNcX2myYfd8
5A5V1ypil7iBoCuAK0qWzrL3YDhO+rvv9T2Gtce5HJ5g+RqEaGnwTxnc2FYbsxzC
CGJcQIA=
=jgTh
-----END PGP SIGNATURE-----

--77xvdswkctbb3d3j--