On Tue, Nov 5, 2019 at 8:00 AM Andy Lutomirski <luto@xxxxxxxxxx> wrote: > > On Tue, Nov 5, 2019 at 7:55 AM Daniel Colascione <dancol@xxxxxxxxxx> wrote: > > > > On Tue, Nov 5, 2019 at 7:29 AM Mike Rapoport <rppt@xxxxxxxxxxxxx> wrote: > > > > > > Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file > > > descriptor table from the read() implementation of uffd, which may have > > > security implications for unprivileged use of the userfaultfd. > > > > > > Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have > > > CAP_SYS_PTRACE. > > > > Thanks. But shouldn't we be doing the capability check at > > userfaultfd(2) time (when we do the other permission checks), not > > later, in the API ioctl? > > The ioctl seems reasonable to me. In particular, if there is anyone > who creates a userfaultfd as root and then drop permissions, a later > ioctl could unexpectedly enable FORK. Sure, but the same argument applies to all the other permission checks that we do at open time, not at ioctl time. For better or for worse, the DAC-ish model used in most places is that access checks happen at file object creation time and anyone who has the FD can perform those operations later. Confusing the model by doing *some* permission checks at open time and *some* permission checks at usage time makes the system harder to understand.
