lkml.org 
[lkml]   [2020]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v6 0/7] Add seccomp notifier ioctl that enables adding fds
    Date
    Hello!

    v6:
    - fix missing fput()
    - API name change: s/fd_install_received/receive_fd/
    v5: https://lore.kernel.org/lkml/20200617220327.3731559-1-keescook@chromium.org/

    This continues the thread-merge between [1] and [2]. tl;dr: add a way for
    a seccomp user_notif process manager to inject files into the managed
    process in order to handle emulation of various fd-returning syscalls
    across security boundaries. Containers folks and Chrome are in need
    of the feature, and investigating this solution uncovered (and fixed)
    implementation issues with existing file sending routines.

    I intend to carry this in the for-next/seccomp tree, unless someone
    has objections. :) Please review and test!

    -Kees

    [1] https://lore.kernel.org/lkml/20200603011044.7972-1-sargun@sargun.me/
    [2] https://lore.kernel.org/lkml/20200610045214.1175600-1-keescook@chromium.org/


    Kees Cook (5):
    net/scm: Regularize compat handling of scm_detach_fds()
    fs: Move __scm_install_fd() to __receive_fd()
    fs: Add receive_fd() wrapper for __receive_fd()
    pidfd: Replace open-coded partial receive_fd()
    fs: Expand __receive_fd() to accept existing fd

    Sargun Dhillon (2):
    seccomp: Introduce addfd ioctl to seccomp user notifier
    selftests/seccomp: Test SECCOMP_IOCTL_NOTIF_ADDFD

    fs/file.c | 67 +++++
    include/linux/file.h | 19 ++
    include/linux/net.h | 9 +
    include/uapi/linux/seccomp.h | 22 ++
    kernel/pid.c | 13 +-
    kernel/seccomp.c | 172 ++++++++++++-
    net/compat.c | 55 ++---
    net/core/scm.c | 50 +---
    tools/testing/selftests/seccomp/seccomp_bpf.c | 229 ++++++++++++++++++
    9 files changed, 554 insertions(+), 82 deletions(-)

    --
    2.25.1

    \
     
     \ /
      Last update: 2020-07-06 22:19    [W:8.258 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site