Re: [PATCH v3 03/10] net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD

From: Christian Brauner <brauner@kernel.org>

Currently, SCM_PIDFD carries a pidfd for the thread-group leader. A
broker or the coredump server cannot learn the identity of the specific
thread that sent a given message. Now that both struct pids are recorded
a receiver can ask for the specific identity it needs.

So add SO_PASSPIDFD_THREAD as a sibling of SO_PASSPIDFD.
SO_PASSPIDFD_THREAD delivers an SCM_PIDFD_THREAD, i.e. scoped
to the specific thread sending. This is completely independent of
SO_PASSPIDFD, meaning you can use both options and get both cmsgs.

On SOCK_STREAM sockets recvmsg() only stops merging data at a thread
boundary when the receiver asked for a thread pidfd. For SO_PASSCRED and
SO_PASSPIDFD receivers all threads of one process remain a single
writer.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Co-developed-by: Andrew Halaney <redacted>
Signed-off-by: Andrew Halaney <redacted>
---
 arch/alpha/include/uapi/asm/socket.h  |  2 ++
 arch/mips/include/uapi/asm/socket.h   |  2 ++
 arch/parisc/include/uapi/asm/socket.h |  2 ++
 arch/sparc/include/uapi/asm/socket.h  |  2 ++
 include/linux/socket.h                |  9 +++++----
 include/net/sock.h                    | 14 +++++++++++++-
 include/uapi/asm-generic/socket.h     |  2 ++
 net/core/scm.c                        | 27 +++++++++++++++++++--------
 net/core/sock.c                       | 14 ++++++++++++++
 net/unix/af_unix.c                    | 12 +++++++++---
 10 files changed, 70 insertions(+), 16 deletions(-)

diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index 946a5fad2691..bb3d534826bb 100644
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h

@@ -157,6 +157,8 @@

 #define SO_RIGHTS_NOTRUNC      85

+#define SO_PASSPIDFD_THREAD    86
+
 #if !defined(__KERNEL__)

 #if __BITS_PER_LONG == 64

diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index f1641dde135f..269badcaa086 100644
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h

@@ -168,6 +168,8 @@

 #define SO_RIGHTS_NOTRUNC      85

+#define SO_PASSPIDFD_THREAD    86
+
 #if !defined(__KERNEL__)

 #if __BITS_PER_LONG == 64

diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index f3a3815c7dc2..313aee10a52c 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h

@@ -149,6 +149,8 @@

 #define SO_RIGHTS_NOTRUNC      0x4053

+#define SO_PASSPIDFD_THREAD    0x4054
+
 #if !defined(__KERNEL__)

 #if __BITS_PER_LONG == 64

diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index 7907f3b1f0ee..bd3e69bcce7a 100644
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h

@@ -150,6 +150,8 @@

 #define SO_RIGHTS_NOTRUNC        0x005e

+#define SO_PASSPIDFD_THREAD      0x005f
+
 #if !defined(__KERNEL__)

diff --git a/include/linux/socket.h b/include/linux/socket.h
index 5a5eb1250103..b17fdb7d38a7 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h

@@ -189,10 +189,11 @@ static inline size_t msg_data_left(const struct msghdr *msg)

 /* "Socket"-level control message types: */

-#define        SCM_RIGHTS      0x01            /* rw: access rights (array of int) */
-#define SCM_CREDENTIALS 0x02           /* rw: struct ucred             */
-#define SCM_SECURITY   0x03            /* rw: security label           */
-#define SCM_PIDFD      0x04            /* ro: pidfd (int)              */
+#define        SCM_RIGHTS              0x01    /* rw: access rights (array of int) */
+#define SCM_CREDENTIALS                0x02    /* rw: struct ucred             */
+#define SCM_SECURITY           0x03    /* rw: security label           */
+#define SCM_PIDFD              0x04    /* ro: pidfd (int)              */
+#define SCM_PIDFD_THREAD       0x05    /* ro: thread pidfd (int)       */

 struct ucred {
        __u32   pid;

diff --git a/include/net/sock.h b/include/net/sock.h
index 60ea55dc1885..14df0fb68259 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h

@@ -356,6 +356,7 @@ struct sk_filter;
   *    @sk_scm_security: flagged by SO_PASSSEC to recv SCM_SECURITY
   *    @sk_scm_pidfd: flagged by SO_PASSPIDFD to recv SCM_PIDFD
   *    @sk_scm_rights: flagged by SO_PASSRIGHTS to recv SCM_RIGHTS
+  *    @sk_scm_pidfd_thread: flagged by SO_PASSPIDFD_THREAD to recv a thread SCM_PIDFD
   *    @sk_scm_unused: unused flags for scm_recv()
   *    @ns_tracker: tracker for netns reference
   *    @sk_user_frags: xarray of pages the user is holding a reference on.

@@ -562,7 +563,8 @@ struct sock {
                                sk_scm_security : 1,
                                sk_scm_pidfd : 1,
                                sk_scm_rights : 1,
-                               sk_scm_unused : 4;
+                               sk_scm_pidfd_thread : 1,
+                               sk_scm_unused : 3;
                };
        };
        u8                      sk_clockid;

@@ -2988,6 +2990,16 @@ static inline bool sk_is_stream_unix(const struct sock *sk)
        return sk_is_unix(sk) && sk->sk_type == SOCK_STREAM;
 }

+static inline bool sk_scm_pidfd_wanted(const struct sock *sk)
+{
+       return sk->sk_scm_pidfd;
+}
+
+static inline bool sk_scm_pidfd_thread_wanted(const struct sock *sk)
+{
+       return sk->sk_scm_pidfd_thread;
+}

+
 static inline bool sk_is_vsock(const struct sock *sk)
 {
        return sk->sk_family == AF_VSOCK;

diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 84ea7b92936e..d1e5c6de146d 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h

@@ -152,6 +152,8 @@

 #define SO_RIGHTS_NOTRUNC      85

+#define SO_PASSPIDFD_THREAD    86
+
 #if !defined(__KERNEL__)

 #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))

diff --git a/net/core/scm.c b/net/core/scm.c
index 9b9e119c353a..ba43d76027af 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c

@@ -499,11 +499,16 @@ static bool scm_has_secdata(struct sock *sk)
 }
 #endif

-static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm)
+static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm,
+                          enum pid_type type, int cmsg_type)
 {
+       unsigned int flags = PIDFD_STALE;
        struct file *pidfd_file = NULL;
+       struct pid *pid;
        int len, pidfd;

+       pid = scm->pid[type];
+
        /* put_cmsg() doesn't return an error if CMSG is truncated,
         * that's why we need to opencode these checks here.
         */

@@ -517,12 +522,15 @@ static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm)
                return;
        }

-       if (!scm->pid[PIDTYPE_TGID])
+       if (!pid)
                return;

-       pidfd = pidfd_prepare(scm->pid[PIDTYPE_TGID], PIDFD_STALE, &pidfd_file);
+       if (type == PIDTYPE_PID)
+               flags |= PIDFD_THREAD;

-       if (put_cmsg(msg, SOL_SOCKET, SCM_PIDFD, sizeof(int), &pidfd)) {
+       pidfd = pidfd_prepare(pid, flags, &pidfd_file);
+
+       if (put_cmsg(msg, SOL_SOCKET, cmsg_type, sizeof(int), &pidfd)) {
                if (pidfd_file) {
                        put_unused_fd(pidfd);
                        fput(pidfd_file);

@@ -539,8 +547,8 @@ static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
                              struct scm_cookie *scm, int flags)
 {
        if (!msg->msg_control) {
-               if (sk->sk_scm_credentials || sk->sk_scm_pidfd ||
-                   scm->fp || scm_has_secdata(sk))
+               if (sk->sk_scm_credentials || sk_scm_pidfd_wanted(sk) ||
+                   sk_scm_pidfd_thread_wanted(sk) || scm->fp || scm_has_secdata(sk))
                        msg->msg_flags |= MSG_CTRUNC;

                scm_destroy(scm);

@@ -586,8 +594,11 @@ void scm_recv_unix(struct socket *sock, struct msghdr *msg,
                scm_detach_fds(msg, scm, READ_ONCE(u->scm_rights_notrunc));
        }

-       if (sock->sk->sk_scm_pidfd)
-               scm_pidfd_recv(msg, scm);
+       if (sk_scm_pidfd_wanted(sock->sk))
+               scm_pidfd_recv(msg, scm, PIDTYPE_TGID, SCM_PIDFD);
+
+       if (sk_scm_pidfd_thread_wanted(sock->sk))
+               scm_pidfd_recv(msg, scm, PIDTYPE_PID, SCM_PIDFD_THREAD);

        scm_destroy_cred(scm);
 }

diff --git a/net/core/sock.c b/net/core/sock.c
index d23333bb4f3f..3b5f28573752 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c

@@ -1578,6 +1578,13 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
                        ret = -EOPNOTSUPP;
                break;

+       case SO_PASSPIDFD_THREAD:
+               if (sk_is_unix(sk))
+                       sk->sk_scm_pidfd_thread = valbool;
+               else
+                       ret = -EOPNOTSUPP;
+               break;
+
        case SO_PASSRIGHTS:
                if (sk_is_unix(sk))
                        sk->sk_scm_rights = valbool;

@@ -1893,6 +1900,13 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
                v.val = sk->sk_scm_pidfd;
                break;

+       case SO_PASSPIDFD_THREAD:
+               if (!sk_is_unix(sk))
+                       return -EOPNOTSUPP;
+
+               v.val = sk->sk_scm_pidfd_thread;
+               break;
+
        case SO_PASSRIGHTS:
                if (!sk_is_unix(sk))
                        return -EOPNOTSUPP;

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c7d423465859..6cc2873d9a4f 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c

@@ -803,7 +803,8 @@ static void copy_peercred(struct sock *sk, struct sock *peersk)

 static bool unix_may_passcred(const struct sock *sk)
 {
-       return sk->sk_scm_credentials || sk->sk_scm_pidfd;
+       return sk->sk_scm_credentials || sk_scm_pidfd_wanted(sk) ||
+               sk_scm_pidfd_thread_wanted(sk);
 }

 static int unix_listen(struct socket *sock, int backlog)

@@ -2048,9 +2049,14 @@ static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
        return 0;
 }

-static bool unix_skb_scm_eq(struct sk_buff *skb,
+static bool unix_skb_scm_eq(const struct sock *sk, struct sk_buff *skb,
                            struct scm_cookie *scm)
 {
+       /* Only a thread pidfd receiver can tell threads of one process apart. */
+       if (sk->sk_scm_pidfd_thread &&
+           UNIXCB(skb).pid[PIDTYPE_PID] != scm->pid[PIDTYPE_PID])
+               return false;
+
        return UNIXCB(skb).pid[PIDTYPE_TGID] == scm->pid[PIDTYPE_TGID] &&
               uid_eq(UNIXCB(skb).uid, scm->creds.uid) &&
               gid_eq(UNIXCB(skb).gid, scm->creds.gid) &&

@@ -3033,7 +3039,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,

                if (check_creds) {
                        /* Never glue messages from different writers */
-                       if (!unix_skb_scm_eq(skb, &scm))
+                       if (!unix_skb_scm_eq(sk, skb, &scm))
                                break;
                } else if (unix_may_passcred(sk)) {
                        /* Copy credentials */

--

2.55.0