Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On Tue, Jan 23, 2024 at 5:43 PM Jens Axboe wrote: > On 1/23/24 3:40 PM, Jens Axboe wrote: > > On 1/23/24 3:35 PM, Jens Axboe wrote: > >> > >> On Tue, 23 Jan 2024 16:55:02 -0500, Paul Moore wrote: > >>> We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL > >>> command to take into

Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On 1/23/24 3:40 PM, Jens Axboe wrote: > On 1/23/24 3:35 PM, Jens Axboe wrote: >> >> On Tue, 23 Jan 2024 16:55:02 -0500, Paul Moore wrote: >>> We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL >>> command to take into account the security implications of making an >>>

Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On 1/23/24 3:35 PM, Jens Axboe wrote: > > On Tue, 23 Jan 2024 16:55:02 -0500, Paul Moore wrote: >> We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL >> command to take into account the security implications of making an >> io_uring-private file descriptor generally accessible to a

Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On Tue, 23 Jan 2024 16:55:02 -0500, Paul Moore wrote: > We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL > command to take into account the security implications of making an > io_uring-private file descriptor generally accessible to a userspace > task. > > The first change in

Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On 1/23/24 2:57 PM, Paul Moore wrote: > On Tue, Jan 23, 2024 at 4:55?PM Paul Moore wrote: >> >> We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL >> command to take into account the security implications of making an >> io_uring-private file descriptor generally accessible to a

Re: [PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

On Tue, Jan 23, 2024 at 4:55 PM Paul Moore wrote: > > We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL > command to take into account the security implications of making an > io_uring-private file descriptor generally accessible to a userspace > task. > > The first change in this

[PATCH] io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

We need to correct some aspects of the IORING_OP_FIXED_FD_INSTALL command to take into account the security implications of making an io_uring-private file descriptor generally accessible to a userspace task. The first change in this patch is to enable auditing of the FD_INSTALL operation as