From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.133]) by sourceware.org (Postfix) with ESMTPS id 4F5FC3857009 for ; Fri, 6 Nov 2020 09:12:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 4F5FC3857009 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=cygwin.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=corinna-cygwin@cygwin.com Received: from calimero.vinschen.de ([24.134.7.25]) by mrelayeu.kundenserver.de (mreue009 [212.227.15.167]) with ESMTPSA (Nemesis) id 1McY0L-1k2juG45Er-00cuWU for ; Fri, 06 Nov 2020 10:12:42 +0100 Received: by calimero.vinschen.de (Postfix, from userid 500) id C5EB9A80E0B; Fri, 6 Nov 2020 10:12:40 +0100 (CET) Date: Fri, 6 Nov 2020 10:12:40 +0100 From: Corinna Vinschen To: cygwin-developers@cygwin.com Subject: Re: AF_UNIX status report Message-ID: <20201106091240.GT33165@calimero.vinschen.de> Reply-To: cygwin-developers@cygwin.com Mail-Followup-To: cygwin-developers@cygwin.com References: <1d0ea5dc-7e9b-d8fe-5f6e-da7a799a3b13@cornell.edu> <20201027094340.GJ5492@calimero.vinschen.de> <0f945b4c-aa30-e08e-9f86-d4b41279ba10@pismotec.com> <20201030092019.GW5492@calimero.vinschen.de> <38e33f7a-e87d-fea8-ac9e-826f94c189d4@cornell.edu> <20201104120304.GF33165@calimero.vinschen.de> <88b3dfe6-a67d-c597-afe2-4edb13cee5d7@cornell.edu> <20201105172140.GP33165@calimero.vinschen.de> <80cb96b8-065d-b146-b879-170031ba28b5@cornell.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <80cb96b8-065d-b146-b879-170031ba28b5@cornell.edu> X-Provags-ID: V03:K1:uTZZsud4WUniaIyfpZIuYFurhFL12WUIDIOiSL71z9vkpretrX9 +5kJo3EuoSPhwd/lxK7pwGUzoYq3CajtNAro9edEL81X0NAmfbHujHfu8PMxW7K3oRC830O xki3kgtIEbrSeuWO66NHtv3+iexzHI9RxxSnPI+soOVVwEWXy36fPJu4v7kH7T7f6+RybpA HU0CTjH41V+mnFu5AJQvg== X-UI-Out-Filterresults: notjunk:1;V03:K0:Q1PtE1cgPA4=:BhA3kzeFpCSFd/8WI27GLA vxnmnxhYOErfBE/reH3LsinbSXCGl9TfZZXZe+6J5Y4c5AkSAXhgZjBHl6YHHpWWQ+boz2O1n IyTAZIqM+qOnDJonFehESsmFwDpFKh+WBpIjg8QslSqOq6QoXV6XwSMoZSG7ZcYgO/SJO+nzR KShAh871A7yvXMSf/icQ9fv0+YXhb+E//EwE0lcmWIWvFdrgzLGschJSPmgn9BsqMkW9wTv5r ifLrWqttvGaQAeHy42ktBVZzq2wmnS3cJl79989zl3qI7+E8g0vDLa1xy0vwjDJuHUNLiBcVo vVa7WgvVhhuC0t9jVoUZ0ihtNyf0enwACYJwG6srqSr29WC34IrdESogbtAGQSD2pRJZC+L2+ GgOOidg6TFgGg+JusDw31MwQSpC4A1PwWDotSzfOKsvf1VxSei43rzkmCHxSZ9dZyFS1vKJ4L BHn1ERtSog== X-Spam-Status: No, score=-100.9 required=5.0 tests=BAYES_00, GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_STATUS, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NEUTRAL, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: cygwin-developers@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Cygwin core component developers mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Nov 2020 09:12:45 -0000 On Nov 5 18:41, Ken Brown via Cygwin-developers wrote: > On 11/5/2020 12:21 PM, Corinna Vinschen wrote: > > On Nov 5 09:23, Ken Brown via Cygwin-developers wrote: > > > OK, here's how I imagine this working: > > > > > > A process wants to send a file descriptor fd, so it creates a msghdr with an > > > SCM_RIGHTS cmsghdr and calls sendmsg. The latter creates and sends an admin > > > packet A containing the fhandler for fd, and then it sends the original > > > packet P. > > > > > > At the receiving end, recvmsg sees packet A first (recvmsg is always > > > checking for admin packets anyway whenever it's called). It stores the > > > fhandler somewhere. When it then reads packet P, it retrieves the stored > > > fhandler, fiddles with it (duplicating handles, etc.), and creates the new > > > file descriptor. > > > > Actually, this needs to be implemented in a source/dest-independent > > manner. Only the server of the named pipe can impersonate the client. > > So the server side should do the job of duplicating the handles. If the > > sever is also the source of SCM_RIGHTS, it should send the fhandler with > > already duplicated handles. > > The only example of pipe client impersonation I can find in the Cygwin code > is in fhandler_pty_master::pty_master_thread. Is this a good model to > follow? If not, can you point me to other examples somewhere? > > AFAICT, the only reason for the impersonation is to check that the client > has appropriate permissions before trying to duplicate handles from the > server process to the client process. Is that right? What would go wrong > if we didn't check this? Is the issue that the client process would have > handles that it can't access? Maybe I'm overthinking this. A typical scenario for SCM_RIGHTS involves a privileged and an unprivileged process. The privileged process sends an fd to the unprivileged process. In this case the sending process has admin rights anyway and can duplicate the handles into the receiving process without having to impersonate. Either way, if both processes are running under the same user, or at least one of the processes has admin rights, no impersonation is required. But since we don't know if the admin process is the sender or the receiver, both sides must be capable of duplicating the handles. So, only if both processes are unprivileged, we would need to impersonate. This will almost always fail, unless both processes have been started from (for instance) the same ssh session or one of the user accounts has the SeImpersonatePrivilege privilege. Maybe we should just skip the latter scenario for a start. Corinna