mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-08 17:49:45 +00:00
c21a6970ae
Patch series "sysvipc: introduce STAT_ANY commands", v2. The following patches adds the discussed (see [1]) new command for shm as well as for sems and msq as they are subject to the same discrepancies for ipc object permission checks between the syscall and via procfs. These new commands are justified in that (1) we are stuck with this semantics as changing syscall and procfs can break userland; and (2) some users can benefit from performance (for large amounts of shm segments, for example) from not having to parse the procfs interface. Once merged, I will submit the necesary manpage updates. But I'm thinking something like: : diff --git a/man2/shmctl.2 b/man2/shmctl.2 : index 7bb503999941..bb00bbe21a57 100644 : --- a/man2/shmctl.2 : +++ b/man2/shmctl.2 : @@ -41,6 +41,7 @@ : .\" 2005-04-25, mtk -- noted aberrant Linux behavior w.r.t. new : .\" attaches to a segment that has already been marked for deletion. : .\" 2005-08-02, mtk: Added IPC_INFO, SHM_INFO, SHM_STAT descriptions. : +.\" 2018-02-13, dbueso: Added SHM_STAT_ANY description. : .\" : .TH SHMCTL 2 2017-09-15 "Linux" "Linux Programmer's Manual" : .SH NAME : @@ -242,6 +243,18 @@ However, the : argument is not a segment identifier, but instead an index into : the kernel's internal array that maintains information about : all shared memory segments on the system. : +.TP : +.BR SHM_STAT_ANY " (Linux-specific)" : +Return a : +.I shmid_ds : +structure as for : +.BR SHM_STAT . : +However, the : +.I shm_perm.mode : +is not checked for read access for : +.IR shmid , : +resembing the behaviour of : +/proc/sysvipc/shm. : .PP : The caller can prevent or allow swapping of a shared : memory segment with the following \fIcmd\fP values: : @@ -287,7 +300,7 @@ operation returns the index of the highest used entry in the : kernel's internal array recording information about all : shared memory segments. : (This information can be used with repeated : -.B SHM_STAT : +.B SHM_STAT/SHM_STAT_ANY : operations to obtain information about all shared memory segments : on the system.) : A successful : @@ -328,7 +341,7 @@ isn't accessible. : \fIshmid\fP is not a valid identifier, or \fIcmd\fP : is not a valid command. : Or: for a : -.B SHM_STAT : +.B SHM_STAT/SHM_STAT_ANY : operation, the index value specified in : .I shmid : referred to an array slot that is currently unused. This patch (of 3): There is a permission discrepancy when consulting shm ipc object metadata between /proc/sysvipc/shm (0444) and the SHM_STAT shmctl command. The later does permission checks for the object vs S_IRUGO. As such there can be cases where EACCESS is returned via syscall but the info is displayed anyways in the procfs files. While this might have security implications via info leaking (albeit no writing to the shm metadata), this behavior goes way back and showing all the objects regardless of the permissions was most likely an overlook - so we are stuck with it. Furthermore, modifying either the syscall or the procfs file can cause userspace programs to break (ie ipcs). Some applications require getting the procfs info (without root privileges) and can be rather slow in comparison with a syscall -- up to 500x in some reported cases. This patch introduces a new SHM_STAT_ANY command such that the shm ipc object permissions are ignored, and only audited instead. In addition, I've left the lsm security hook checks in place, as if some policy can block the call, then the user has no other choice than just parsing the procfs file. [1] https://lkml.org/lkml/2017/12/19/220 Link: http://lkml.kernel.org/r/20180215162458.10059-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Kees Cook <keescook@chromium.org> Cc: Robert Kettler <robert.kettler@outlook.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
109 lines
3.6 KiB
C
109 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef _UAPI_LINUX_SHM_H_
|
|
#define _UAPI_LINUX_SHM_H_
|
|
|
|
#include <linux/ipc.h>
|
|
#include <linux/errno.h>
|
|
#include <asm-generic/hugetlb_encode.h>
|
|
#ifndef __KERNEL__
|
|
#include <unistd.h>
|
|
#endif
|
|
|
|
/*
|
|
* SHMMNI, SHMMAX and SHMALL are default upper limits which can be
|
|
* modified by sysctl. The SHMMAX and SHMALL values have been chosen to
|
|
* be as large possible without facilitating scenarios where userspace
|
|
* causes overflows when adjusting the limits via operations of the form
|
|
* "retrieve current limit; add X; update limit". It is therefore not
|
|
* advised to make SHMMAX and SHMALL any larger. These limits are
|
|
* suitable for both 32 and 64-bit systems.
|
|
*/
|
|
#define SHMMIN 1 /* min shared seg size (bytes) */
|
|
#define SHMMNI 4096 /* max num of segs system wide */
|
|
#define SHMMAX (ULONG_MAX - (1UL << 24)) /* max shared seg size (bytes) */
|
|
#define SHMALL (ULONG_MAX - (1UL << 24)) /* max shm system wide (pages) */
|
|
#define SHMSEG SHMMNI /* max shared segs per process */
|
|
|
|
/* Obsolete, used only for backwards compatibility and libc5 compiles */
|
|
struct shmid_ds {
|
|
struct ipc_perm shm_perm; /* operation perms */
|
|
int shm_segsz; /* size of segment (bytes) */
|
|
__kernel_time_t shm_atime; /* last attach time */
|
|
__kernel_time_t shm_dtime; /* last detach time */
|
|
__kernel_time_t shm_ctime; /* last change time */
|
|
__kernel_ipc_pid_t shm_cpid; /* pid of creator */
|
|
__kernel_ipc_pid_t shm_lpid; /* pid of last operator */
|
|
unsigned short shm_nattch; /* no. of current attaches */
|
|
unsigned short shm_unused; /* compatibility */
|
|
void *shm_unused2; /* ditto - used by DIPC */
|
|
void *shm_unused3; /* unused */
|
|
};
|
|
|
|
/* Include the definition of shmid64_ds and shminfo64 */
|
|
#include <asm/shmbuf.h>
|
|
|
|
/*
|
|
* shmget() shmflg values.
|
|
*/
|
|
/* The bottom nine bits are the same as open(2) mode flags */
|
|
#define SHM_R 0400 /* or S_IRUGO from <linux/stat.h> */
|
|
#define SHM_W 0200 /* or S_IWUGO from <linux/stat.h> */
|
|
/* Bits 9 & 10 are IPC_CREAT and IPC_EXCL */
|
|
#define SHM_HUGETLB 04000 /* segment will use huge TLB pages */
|
|
#define SHM_NORESERVE 010000 /* don't check for reservations */
|
|
|
|
/*
|
|
* Huge page size encoding when SHM_HUGETLB is specified, and a huge page
|
|
* size other than the default is desired. See hugetlb_encode.h
|
|
*/
|
|
#define SHM_HUGE_SHIFT HUGETLB_FLAG_ENCODE_SHIFT
|
|
#define SHM_HUGE_MASK HUGETLB_FLAG_ENCODE_MASK
|
|
|
|
#define SHM_HUGE_64KB HUGETLB_FLAG_ENCODE_64KB
|
|
#define SHM_HUGE_512KB HUGETLB_FLAG_ENCODE_512KB
|
|
#define SHM_HUGE_1MB HUGETLB_FLAG_ENCODE_1MB
|
|
#define SHM_HUGE_2MB HUGETLB_FLAG_ENCODE_2MB
|
|
#define SHM_HUGE_8MB HUGETLB_FLAG_ENCODE_8MB
|
|
#define SHM_HUGE_16MB HUGETLB_FLAG_ENCODE_16MB
|
|
#define SHM_HUGE_256MB HUGETLB_FLAG_ENCODE_256MB
|
|
#define SHM_HUGE_1GB HUGETLB_FLAG_ENCODE_1GB
|
|
#define SHM_HUGE_2GB HUGETLB_FLAG_ENCODE_2GB
|
|
#define SHM_HUGE_16GB HUGETLB_FLAG_ENCODE_16GB
|
|
|
|
/*
|
|
* shmat() shmflg values
|
|
*/
|
|
#define SHM_RDONLY 010000 /* read-only access */
|
|
#define SHM_RND 020000 /* round attach address to SHMLBA boundary */
|
|
#define SHM_REMAP 040000 /* take-over region on attach */
|
|
#define SHM_EXEC 0100000 /* execution access */
|
|
|
|
/* super user shmctl commands */
|
|
#define SHM_LOCK 11
|
|
#define SHM_UNLOCK 12
|
|
|
|
/* ipcs ctl commands */
|
|
#define SHM_STAT 13
|
|
#define SHM_INFO 14
|
|
#define SHM_STAT_ANY 15
|
|
|
|
/* Obsolete, used only for backwards compatibility */
|
|
struct shminfo {
|
|
int shmmax;
|
|
int shmmin;
|
|
int shmmni;
|
|
int shmseg;
|
|
int shmall;
|
|
};
|
|
|
|
struct shm_info {
|
|
int used_ids;
|
|
__kernel_ulong_t shm_tot; /* total allocated shm */
|
|
__kernel_ulong_t shm_rss; /* total resident shm */
|
|
__kernel_ulong_t shm_swp; /* total swapped shm */
|
|
__kernel_ulong_t swap_attempts;
|
|
__kernel_ulong_t swap_successes;
|
|
};
|
|
|
|
|
|
#endif /* _UAPI_LINUX_SHM_H_ */
|