Received-SPF: pass (google.com: domain of linux-kernel+bounces-107583-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Tue, 19 Mar 2024 14:21:58 +0100
From: Joel Granados <j.granados@samsung.com>
To: Kuniyuki Iwashima <kuniyu@amazon.com>
CC: <linux@weissschuh.net>, <davem@davemloft.net>,
	<dmitry.torokhov@gmail.com>, <ebiederm@xmission.com>, <edumazet@google.com>,
	<kuba@kernel.org>, <linux-kernel@vger.kernel.org>, <mcgrof@kernel.org>,
	<netdev@vger.kernel.org>, <pabeni@redhat.com>
Subject: Re: [PATCH] net: always initialize sysctl ownership
Message-ID: <20240319132158.37aitf2ysxqcd3bt@joelS2.panther.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="wcyzp5c3nczdoa42"
Content-Disposition: inline
In-Reply-To: <20240316003958.65385-1-kuniyu@amazon.com>
CMS-TYPE: 201P
References: <20240315-sysctl-net-ownership-v1-1-2b465555a292@weissschuh.net>
	<CGME20240316004018eucas1p20c4854c7493c28aa1943faa589a3b33e@eucas1p2.samsung.com>
	<20240316003958.65385-1-kuniyu@amazon.com>

--wcyzp5c3nczdoa42
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 15, 2024 at 05:39:58PM -0700, Kuniyuki Iwashima wrote:
> From: Thomas Wei=DFschuh <linux@weissschuh.net>
> Date: Fri, 15 Mar 2024 17:20:31 +0100
> > The sysctl core does not initialize these fields when the set_ownership
> > callback is present.
> > So always do it in the callback.
>=20
> Could you add few more words here to explain what the problem is
> like commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default
> values of i_uid/i_gid on /proc/sys inodes.").
I second this proposal. There is more to the story than a simple setting
of default values. IMO, you should mention how the missbehavior was
introduced in 5ec27ec735ba0 (fs/proc/proc_sysctl.c: fix the default
values of i_uid/i_gid on /proc/sys inodes.)

>=20
> BTW, it seems that we can change the value even if the uid/gid is
> invalid unlike the issue mentioned in 5ec27ec735ba.
Indeed and I think it is because net_ctl_permissions set the mode in the
same way as test_perm does. Therefore regardless of the tests against
GLOBAL_ROOT_[U|G]ID being true or false mode gets right shifted by 6 and
3.

>=20
> So, the problem is just the invalid uid/gid exposed to userspace
> or am I missing something ?
That seems to be the case. I think that should just be
GLOBAL_ROOT_[G|U]ID. Please correct me if I'm wrong.

>=20
> ---8<---
> [root@localhost ~]# unshare --user --keep-caps
> [nobody@localhost ~]$ id
> uid=3D65534(nobody) gid=3D65534(nobody) groups=3D65534(nobody)
> [nobody@localhost ~]$ unshare --net --keep-caps
> [nobody@localhost ~]$ stat /proc/sys/net/core/somaxconn
>   File: /proc/sys/net/core/somaxconn
>   Size: 0         	Blocks: 0          IO Block: 1024   regular empty file
> Device: 13h/19d	Inode: 3726        Links: 1
> Access: (0644/-rw-r--r--)  Uid: (65534/  nobody)   Gid: (65534/  nobody)
> Access: 2024-03-16 00:28:51.937789000 +0000
> Modify: 2024-03-16 00:28:51.937789000 +0000
> Change: 2024-03-16 00:28:51.937789000 +0000
>  Birth: -
> [nobody@localhost ~]$ cat /proc/sys/net/core/somaxconn
> 4096
> [nobody@localhost ~]$ echo 2048 > /proc/sys/net/core/somaxconn
> [nobody@localhost ~]$ cat /proc/sys/net/core/somaxconn
> 2048
> ---8<---
>=20
>=20
> >=20
> > Fixes: e79c6a4fc923 ("net: make net namespace sysctls belong to contain=
er's owner")
> > Signed-off-by: Thomas Wei=DFschuh <linux@weissschuh.net>
> > ---
> >  net/sysctl_net.c | 6 ++----
> >  1 file changed, 2 insertions(+), 4 deletions(-)
> >=20
> > diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> > index 051ed5f6fc93..03e320ddacc9 100644
> > --- a/net/sysctl_net.c
> > +++ b/net/sysctl_net.c
> > @@ -62,12 +62,10 @@ static void net_ctl_set_ownership(struct ctl_table_=
header *head,
> >  	kgid_t ns_root_gid;
> > =20
> >  	ns_root_uid =3D make_kuid(net->user_ns, 0);
> > -	if (uid_valid(ns_root_uid))
> > -		*uid =3D ns_root_uid;
> > +	*uid =3D uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
> > =20
> >  	ns_root_gid =3D make_kgid(net->user_ns, 0);
> > -	if (gid_valid(ns_root_gid))
> > -		*gid =3D ns_root_gid;
> > +	*gid =3D gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
> >  }
>=20
> How about setting the default in proc_sys_make_inode() instead ?
> because the default value configured by new_inode() is not
> appropriate for procfs, IIUC.
Are you proposing something like this in proc_sys_make_inode/

inode->i_uid =3D GLOBAL_ROOT_UID;
inode->i_gid =3D GLOBAL_ROOT_GID;
if (root->set_ownership)
    root->set_ownership(head, table, &indoe->i_uid, &inode->i_gid)

?

>=20
> Thanks!
>=20
> > =20
> >  static struct ctl_table_root net_sysctl_root =3D {
> >=20
> > ---
> > base-commit: e5eb28f6d1afebed4bb7d740a797d0390bd3a357
> > change-id: 20240315-sysctl-net-ownership-bc4e17eaeea6
> >=20
> > Best regards,
> > --=20
> > Thomas Wei=DFschuh <linux@weissschuh.net>

--=20

Joel Granados

--wcyzp5c3nczdoa42
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmX5kXUACgkQupfNUreW
QU+sEAv+K1Rgd2l+2cBLVkK04hjTwfhbAdy6iMinBFG5mgYvoJO7m3+Eq4SeSydv
ZEZvy0zoMgqcLyN/fXTKw5GnrcG5mNdIXgKCoV7VH0HT1qelY1mp9k6E8cUp2Vc2
rEvdE000hn+sQlbhnPlYfq3FtQP41I6gGQpRRDN7Qw9YXo2LnRYdolN7APswvpxt
HbBPZpWdzlMaLV0W+Y5WUaqQx8yn8hyQF0J8o8vLPiE9+fAfjB0MF0PXlmj2R4om
5VqKxaBeAXM0mzFrZSQZyxDFgmt8Qft5O1+BkteiuKF+O2Q1z+2rwPf3tpme+S7m
HJ6EwfNPawUNGHBsznyIl+DB4CI2O+HyeolHjIoYFbL+yVJcLbFX8fOc1xnyr376
4BJ+b6ce2hWHMcpDd5iDiEK3QF/LNMmeODOYE9pg8su0jQb7orG3KCrUNhGMlwLa
5qAYkz4O94urq4bokTYa31oZgOtY0cVE1wM+EsF7y2V5flzlPjbLspsRVMqPX09n
uMtYymwu
=uDuO
-----END PGP SIGNATURE-----

--wcyzp5c3nczdoa42--