userfaultfd: open userfaultfds with O_RDONLY
authorOndrej Mosnacek <omosnace@redhat.com>
Fri, 8 Jul 2022 09:34:51 +0000 (11:34 +0200)
committerPaul Moore <paul@paul-moore.com>
Tue, 30 Aug 2022 20:04:31 +0000 (16:04 -0400)
commitabec3d015fdfb7c63105c7e1c956188bf381aa55
tree0b08d9667430f799571ac6ffaef6c04210c8e873
parented5d44d42c95e8a13bb54e614d2269c8740667f9
userfaultfd: open userfaultfds with O_RDONLY

Since userfaultfd doesn't implement a write operation, it is more
appropriate to open it read-only.

When userfaultfds are opened read-write like it is now, and such fd is
passed from one process to another, SELinux will check both read and
write permissions for the target process, even though it can't actually
do any write operation on the fd later.

Inspired by the following bug report, which has hit the SELinux scenario
described above:
https://bugzilla.redhat.com/show_bug.cgi?id=1974559

Reported-by: Robert O'Callahan <roc@ocallahan.org>
Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>
fs/userfaultfd.c