Re: [PATCH 3.12 32/64] unix: properly account for FDs passed over unix sockets

On 02/11/2016, 06:32 PM, Willy Tarreau wrote:

Hi Jiri,

On Thu, Feb 11, 2016 at 02:59:08PM +0100, Jiri Slaby wrote:

quoted

From: willy tarreau <w@1wt.eu>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 712f4aad406bb1ed67f3f98d04c044191f0ff593 ]

It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.

This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.

Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <redacted>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <redacted>

A possible issue was reported regarding this patch, and Hannes
implemented a fix that's not yet in mainline. I guess it's
preferable to postpone this patch for now.

Hi,

yes definitely. Thanks for noting.

For reference:
http://article.gmane.org/gmane.linux.kernel/2142236

thanks,
-- 
js
suse labs