| Message ID | 20210210120425.53438-3-lmb@cloudflare.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | Expose network namespace cookies to user space | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | fail | Series targets non-next tree, but doesn't contain any Fixes tags |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for bpf |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | warning | 5 maintainers not CCed: yhs@fb.com kafai@fb.com songliubraving@fb.com kpsingh@kernel.org john.fastabend@gmail.com |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 7519 this patch: 7519 |
| netdev/kdoc | success | Errors and warnings before: 2 this patch: 2 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 51 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 7926 this patch: 7926 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
Hi Lorenz,
I love your patch! Yet something to improve:
[auto build test ERROR on bpf/master]
url: https://github.com/0day-ci/linux/commits/Lorenz-Bauer/Expose-network-namespace-cookies-to-user-space/20210210-201857
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
config: microblaze-randconfig-r003-20210209 (attached as .config)
compiler: microblaze-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/ec096a87ec268b0634a140515fb54b21a2c67036
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Lorenz-Bauer/Expose-network-namespace-cookies-to-user-space/20210210-201857
git checkout ec096a87ec268b0634a140515fb54b21a2c67036
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=microblaze
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
microblaze-linux-ld: fs/nsfs.o: in function `ns_ioctl':
>> (.text+0x1618): undefined reference to `__net_gen_cookie'
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Hi Lorenz,
I love your patch! Yet something to improve:
[auto build test ERROR on bpf/master]
url: https://github.com/0day-ci/linux/commits/Lorenz-Bauer/Expose-network-namespace-cookies-to-user-space/20210210-201857
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
config: s390-randconfig-r002-20210209 (attached as .config)
compiler: s390-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/ec096a87ec268b0634a140515fb54b21a2c67036
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Lorenz-Bauer/Expose-network-namespace-cookies-to-user-space/20210210-201857
git checkout ec096a87ec268b0634a140515fb54b21a2c67036
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=s390
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
s390-linux-ld: kernel/dma/coherent.o: in function `dma_init_coherent_memory':
coherent.c:(.text+0x208): undefined reference to `memremap'
s390-linux-ld: coherent.c:(.text+0x2d2): undefined reference to `memunmap'
s390-linux-ld: kernel/dma/coherent.o: in function `dma_declare_coherent_memory':
coherent.c:(.text+0x6c2): undefined reference to `memunmap'
s390-linux-ld: fs/nsfs.o: in function `ns_ioctl':
>> nsfs.c:(.text+0x6fe): undefined reference to `__net_gen_cookie'
s390-linux-ld: drivers/irqchip/irq-al-fic.o: in function `al_fic_init_dt':
irq-al-fic.c:(.init.text+0x46): undefined reference to `of_iomap'
s390-linux-ld: irq-al-fic.c:(.init.text+0x2a4): undefined reference to `iounmap'
s390-linux-ld: drivers/char/xillybus/xillybus_of.o: in function `xilly_drv_probe':
xillybus_of.c:(.text+0x146): undefined reference to `devm_platform_ioremap_resource'
s390-linux-ld: drivers/pcmcia/cistpl.o: in function `set_cis_map':
cistpl.c:(.text+0x386): undefined reference to `ioremap'
s390-linux-ld: cistpl.c:(.text+0x3c0): undefined reference to `iounmap'
s390-linux-ld: cistpl.c:(.text+0x3f2): undefined reference to `iounmap'
s390-linux-ld: cistpl.c:(.text+0x404): undefined reference to `ioremap'
s390-linux-ld: drivers/pcmcia/cistpl.o: in function `release_cis_mem':
cistpl.c:(.text+0xe56): undefined reference to `iounmap'
s390-linux-ld: drivers/input/serio/apbps2.o: in function `apbps2_of_probe':
apbps2.c:(.text+0x286): undefined reference to `devm_ioremap_resource'
s390-linux-ld: drivers/input/touchscreen/imx6ul_tsc.o: in function `imx6ul_tsc_probe':
imx6ul_tsc.c:(.text+0x256): undefined reference to `devm_platform_ioremap_resource'
s390-linux-ld: imx6ul_tsc.c:(.text+0x2bc): undefined reference to `devm_platform_ioremap_resource'
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
On Wed, Feb 10, 2021 at 12:04:23PM +0000, Lorenz Bauer wrote: > Network namespaces have a globally unique non-zero identifier aka a > cookie, in line with socket cookies. Add an ioctl to retrieve the > cookie from user space without going via BPF. > > Cc: linux-api@vger.kernel.org > Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> > --- > fs/nsfs.c | 9 +++++++++ > include/net/net_namespace.h | 11 +++++++++++ > include/uapi/linux/nsfs.h | 2 ++ > 3 files changed, 22 insertions(+) > > diff --git a/fs/nsfs.c b/fs/nsfs.c > index 800c1d0eb0d0..d7865e39c049 100644 > --- a/fs/nsfs.c > +++ b/fs/nsfs.c > @@ -11,6 +11,7 @@ > #include <linux/user_namespace.h> > #include <linux/nsfs.h> > #include <linux/uaccess.h> > +#include <net/net_namespace.h> > > #include "internal.h" > > @@ -191,6 +192,8 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, > struct user_namespace *user_ns; > struct ns_common *ns = get_proc_ns(file_inode(filp)); > uid_t __user *argp; > + struct net *net_ns; > + u64 cookie; > uid_t uid; > > switch (ioctl) { > @@ -209,6 +212,12 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, > argp = (uid_t __user *) arg; > uid = from_kuid_munged(current_user_ns(), user_ns->owner); > return put_user(uid, argp); > + case NS_GET_COOKIE: > + if (ns->ops->type != CLONE_NEWNET) > + return -EINVAL; > + net_ns = container_of(ns, struct net, ns); > + cookie = net_gen_cookie(net_ns); > + return put_user(cookie, (u64 __user *)arg); Hey Lorenz, Just to make sure: is it intentional that any user can retrieve the cookie associated with any network namespace, i.e. you don't require any form of permission checking in the owning user namespace of the network namespace? Christian
On Mon, 1 Mar 2021 at 10:04, Christian Brauner <christian.brauner@ubuntu.com> wrote: > > Hey Lorenz, > > Just to make sure: is it intentional that any user can retrieve the > cookie associated with any network namespace, i.e. you don't require any > form of permission checking in the owning user namespace of the network > namespace? > > Christian Hi Christian, I've decided to drop the patch set for now, but that was my intention, yes. Is there a downside I'm not aware of? Lorenz
On Tue, Mar 02, 2021 at 09:47:10AM +0000, Lorenz Bauer wrote: > On Mon, 1 Mar 2021 at 10:04, Christian Brauner > <christian.brauner@ubuntu.com> wrote: > > > > Hey Lorenz, > > > > Just to make sure: is it intentional that any user can retrieve the > > cookie associated with any network namespace, i.e. you don't require any > > form of permission checking in the owning user namespace of the network > > namespace? > > > > Christian > > Hi Christian, > > I've decided to drop the patch set for now, but that was my intention, yes. Is > there a downside I'm not aware of? It depends on whether this cookie is in any way security or at least information sensitive. For example, would leaking it between unprivileged containers with different user+network namespace pairs allow one container to gain access to information about the other container that it shouldn't. Christian
diff --git a/fs/nsfs.c b/fs/nsfs.c index 800c1d0eb0d0..d7865e39c049 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -11,6 +11,7 @@ #include <linux/user_namespace.h> #include <linux/nsfs.h> #include <linux/uaccess.h> +#include <net/net_namespace.h> #include "internal.h" @@ -191,6 +192,8 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, struct user_namespace *user_ns; struct ns_common *ns = get_proc_ns(file_inode(filp)); uid_t __user *argp; + struct net *net_ns; + u64 cookie; uid_t uid; switch (ioctl) { @@ -209,6 +212,12 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, argp = (uid_t __user *) arg; uid = from_kuid_munged(current_user_ns(), user_ns->owner); return put_user(uid, argp); + case NS_GET_COOKIE: + if (ns->ops->type != CLONE_NEWNET) + return -EINVAL; + net_ns = container_of(ns, struct net, ns); + cookie = net_gen_cookie(net_ns); + return put_user(cookie, (u64 __user *)arg); default: return -ENOTTY; } diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index 29567875f428..bbd22dfa9345 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -226,6 +226,17 @@ struct net *get_net_ns_by_fd(int fd); u64 __net_gen_cookie(struct net *net); +static inline u64 net_gen_cookie(struct net *net) +{ + u64 cookie; + + preempt_disable(); + cookie = __net_gen_cookie(net); + preempt_enable(); + + return cookie; +} + #ifdef CONFIG_SYSCTL void ipx_register_sysctl(void); void ipx_unregister_sysctl(void); diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h index a0c8552b64ee..86611c2cf908 100644 --- a/include/uapi/linux/nsfs.h +++ b/include/uapi/linux/nsfs.h @@ -15,5 +15,7 @@ #define NS_GET_NSTYPE _IO(NSIO, 0x3) /* Get owner UID (in the caller's user namespace) for a user namespace */ #define NS_GET_OWNER_UID _IO(NSIO, 0x4) +/* Returns a unique non-zero identifier for a network namespace */ +#define NS_GET_COOKIE _IO(NSIO, 0x5) #endif /* __LINUX_NSFS_H */
Network namespaces have a globally unique non-zero identifier aka a cookie, in line with socket cookies. Add an ioctl to retrieve the cookie from user space without going via BPF. Cc: linux-api@vger.kernel.org Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> --- fs/nsfs.c | 9 +++++++++ include/net/net_namespace.h | 11 +++++++++++ include/uapi/linux/nsfs.h | 2 ++ 3 files changed, 22 insertions(+)