Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 8 Dec 2021 11:39:43 -0800 | Subject | Re: [PATCH] exit: Retain nsproxy for exit_task_work() work entries |
| |
On Wed, Dec 8, 2021 at 11:06 AM Tejun Heo <tj@kernel.org> wrote: > > > That said I can't quite tell if the test should be moved into > > cgroup_file_open or if there is a permission entry that would work. > > It can't.
Two options:
(a) anybody doing "current process" permission checks at IO time should then also check that the credentials are still the same as when the file was opened.
(b) alternatively, go ahead and do the permission check at IO time, but do it using "file->f_cred" (ie the open-time permission), not the current process ones.
In the above, (a) and (b) are basically the same: it uses f_cred for permission checking. The only difference is that in (a) you may be using some function that _technically_ uses the implicit "current credentials" (there are many of them), and you just separately make sure that those current credentials are identical to what they were at open time.
Obviously (b) is hugely preferred, but sometimes the code organization (ie "file or f_cred just isn't passed down deep enough") means that (a) might be the only realistic option.
IOW, it's not *wrong* to do permission checking at IO time, but it absolutely needs to be done using the open-time credentials.
Linus
| |