Skip to content

ipc: Fixing the pid namespace support

Eric W. Biederman containers linux-api linux-security-module lkml 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest11 patches 40 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/11sem/security: Pass kern_ipc_perm not sem_array into the sem security hooksinclude/linux/lsm_hooks.h include/linux/security.h ipc/sem.c +3 more+53 -574 replies
2/11shm/security: Pass kern_ipc_perm not shmid_kernel into the shm security hooksinclude/linux/lsm_hooks.h include/linux/security.h ipc/shm.c +3 more+52 -562 replies
3/11msg/security: Pass kern_ipc_perm not msg_queue into the msg_queue security hooksinclude/linux/lsm_hooks.h include/linux/security.h ipc/msg.c +3 more+62 -653 replies
4/11sem: Move struct sem and struct sem_array into ipc/sem.cinclude/linux/sem.h ipc/sem.c+35 -390 replies
5/11shm: Move struct shmid_kernel into ipc/shm.cinclude/linux/shm.h ipc/shm.c+22 -230 replies
6/11msg: Move struct msg_queue into ipc/msg.cinclude/linux/msg.h ipc/msg.c+17 -180 replies
7/11ipc: Move IPCMNI from include/ipc.h into ipc/util.hinclude/linux/ipc.h ipc/util.h+1 -20 replies
8/11ipc/util: Helpers for making the sysvipc operations pid namespace awareipc/util.c ipc/util.h+20 -00 replies
9/11ipc/shm: Fix shmctl(..., IPC_STAT, ...) between pid namespaces.ipc/shm.c+15 -106 replies
10/11ipc/msg: Fix msgctl(..., IPC_STAT, ...) between pid namespacesipc/msg.c+13 -101 reply
11/11ipc/sem: Fix semctl(..., GETPID, ...) between pid namespacesipc/sem.c+12 -1010 replies

Reviews trailers per patch

2 of 11 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchNagarathnam MuthusamyCasey SchauflerJames Morris
SeriesRequested-by Requested-by R-b
1/11
2/11
3/11
4/11
5/11
6/11
7/11
8/11
9/11R-b
10/11R-b
11/11

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.

Read the v1 thread

Cover letter [REVIEW][PATCH 00/11] ipc: Fixing the pid namespace support

While discussing a proposal by Nagarathnam Muthusamy I realized that the ipc namespace has never been given proper pid namespace support. In particular if objects in a single ipc namespace are accessed from different pid namespaces they will return the wrong pids.

Then when trying to test this I discovered that definitions that are only used in msg.c, sem.c, and shm.c are included in linux/sched.h resulting in what should be simple local modifications requring nearly a full kernel rebuild.

So this patchset does several things.
- Changes the types that are passed into the security hooks to struct kern_ipc_perm because that is all the security hooks use.
- Moves definitions from include/{msg,sem,shm}.h into ipc/{msg,sem,shm}.c So the code can be modified without excessive development time.
- Instead of storing pids as intergers stores struct pid * instead.

I took a careful look to see if it seems likely the performance regression in credential passing that af_unix experienced after a similar conversion would be likely, but I don't see it.

So I think the biggest concern is if someone in the last 10 years has come to depend on the buggy behavior. If either the performance is problematic or the there are regression caused by the change in behavior we can revert.

Still I would like to see this fixed and I plan on merging this code.

Eric W. Biederman (11):
sem/security: Pass kern_ipc_perm not sem_array into the sem security hooks shm/security: Pass kern_ipc_perm not shmid_kernel into the shm security hooks msg/security: Pass kern_ipc_perm not msg_queue into the msg_queue security hooks
sem: Move struct sem and struct sem_array into ipc/sem.c
shm: Move struct shmid_kernel into ipc/shm.c
msg: Move struct msg_queue into ipc/msg.c
ipc: Move IPCMNI from include/ipc.h into ipc/util.h
ipc/util: Helpers for making the sysvipc operations pid namespace aware ipc/shm: Fix shmctl(..., IPC_STAT, ...) between pid namespaces. ipc/msg: Fix msgctl(..., IPC_STAT, ...) between pid namespaces ipc/sem: Fix semctl(..., GETPID, ...) between pid namespaces

include/linux/ipc.h | 2 -

 include/linux/lsm_hooks.h  | 32 ++++++++--------
 include/linux/msg.h        | 18 ---------
 include/linux/security.h   | 67 ++++++++++++++++-----------------
 include/linux/sem.h        | 40 +-------------------
 include/linux/shm.h        | 23 ------------
 ipc/msg.c                  | 54 ++++++++++++++++++---------
 ipc/sem.c                  | 73 ++++++++++++++++++++++++++----------
 ipc/shm.c                  | 60 +++++++++++++++++++++---------
 ipc/util.c                 |  9 +++++
 ipc/util.h                 | 12 ++++++
 security/security.c        | 32 ++++++++--------
 security/selinux/hooks.c   | 92 +++++++++++++++++++++++-----------------------
 security/smack/smack_lsm.c | 68 +++++++++++++++++-----------------
 14 files changed, 297 insertions(+), 285 deletions(-)

Eric