> On Nov 5, 2019, at 9:02 AM, Daniel Colascione <dancol@xxxxxxxxxx> wrote: > > On Tue, Nov 5, 2019 at 8:56 AM Andrea Arcangeli <aarcange@xxxxxxxxxx> wrote: >> >>> On Tue, Nov 05, 2019 at 08:39:26AM -0800, Daniel Colascione wrote: >>> I'm not suggesting that we fail userfaultfd(2) without CAP_SYS_PTRACE. >>> That would, as you point out, break things. I'm talking about >>> recording *whether* we had CAP_SYS_PTRACE in an internal flag in the >>> uffd context when we create the thing --- and then, at ioctl time, >>> checking that flag, not the caller's CAP_SYS_PTRACE, to see whether >>> UFFD_FEATURE_EVENT_FORK should be made available. This way, the >>> security check hinges on whether the caller *at create time* was >>> privileged. >> >> Until now it wasn't clear to me you still wanted to do the permission >> check in UFFDIO_API time, and you only intended to move the >> "measurement" of the capability to the syscall. >> >> So you're suggesting to add more kernel complexity to code pending for >> removal to achieve a theoretically more pure solution in the band-aid >> required to defer the removal of the posix-breaking read >> implementation of the uffd fork feature? > > And you're suggesting making a security check work weirdly unlike most > other security checks because you hope it'll get removed one day? > Temporary solutions aren't, and if something goes into the kernel at > all, it's worth getting right. The general rule is that access checks > happen at open time. The kernel has already been bitten by UFFD > exempting itself from the normal rules (e.g., the > read(2)-makes-a-file-descriptor thing) in the name of expediency. > There shouldn't be any more exceptions. I don’t think ioctl() checking permission is particularly unusual. In principle, it’s better than open for a retrofit — open didn’t capture this permission in the past, so adding it makes an existing capability stronger than it was, which isn’t fantastic.
