Commit f9436a5d authored by Alexey Gladkov's avatar Alexey Gladkov Committed by Andrew Morton
Browse files

sysctl: allow to change limits for posix messages queues 

All parameters of posix messages queues (queues_max/msg_max/msgsize_max)
end up being limited by RLIMIT_MSGQUEUE.  The code in mqueue_get_inode is
where that limiting happens.

The RLIMIT_MSGQUEUE is bound to the user namespace and is counted
hierarchically.

We can allow root in the user namespace to modify the posix messages
queues parameters.

Link: https://lkml.kernel.org/r/6ad67f23d1459a4f4339f74aa73bac0ecf3995e1.1705333426.git.legion@kernel.org


Signed-off-by: default avatarAlexey Gladkov <legion@kernel.org>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Link: https://lkml.kernel.org/r/7eb21211c8622e91d226e63416b1b93c079f60ee.1663756794.git.legion@kernel.org


Cc: Christian Brauner <brauner@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Joel Granados <joel.granados@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 9220066e

ipc/mq_sysctl.c

+36 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <linux/stat.h>

#include <linux/capability.h>

#include <linux/slab.h>

#include <linux/cred.h>



static int msg_max_limit_min = MIN_MSGMAX;

static int msg_max_limit_max = HARD_MSGMAX;
@@ -76,8 +77,43 @@ static int set_is_seen(struct ctl_table_set *set) 
	return &current->nsproxy->ipc_ns->mq_set == set;

}



static void mq_set_ownership(struct ctl_table_header *head,

			     struct ctl_table *table,

			     kuid_t *uid, kgid_t *gid)

{

	struct ipc_namespace *ns =

		container_of(head->set, struct ipc_namespace, mq_set);



	kuid_t ns_root_uid = make_kuid(ns->user_ns, 0);

	kgid_t ns_root_gid = make_kgid(ns->user_ns, 0);



	*uid = uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;

	*gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;

}



static int mq_permissions(struct ctl_table_header *head, struct ctl_table *table)

{

	int mode = table->mode;

	kuid_t ns_root_uid;

	kgid_t ns_root_gid;



	mq_set_ownership(head, table, &ns_root_uid, &ns_root_gid);



	if (uid_eq(current_euid(), ns_root_uid))

		mode >>= 6;



	else if (in_egroup_p(ns_root_gid))

		mode >>= 3;



	mode &= 7;



	return (mode << 6) | (mode << 3) | mode;

}



static struct ctl_table_root set_root = {

	.lookup = set_lookup,

	.permissions = mq_permissions,

	.set_ownership = mq_set_ownership,

};



bool setup_mq_sysctls(struct ipc_namespace *ns)