From: Ferruh Yigit <ferruh.yigit@amd.com>
To: Junxiao Shi <git@mail1.yoursunny.com>
Cc: dev@dpdk.org, Stephen Hemminger <stephen@networkplumber.org>
Subject: Re: [RFC PATCH v3] net/memif: change socket listener owner uid/gid
Date: Wed, 7 Dec 2022 11:43:57 +0000 [thread overview]
Message-ID: <4000a9ee-a48b-6c1c-5839-0fc135eb347a@amd.com> (raw)
In-Reply-To: <c079afbbff6669ab@cs.arizona.edu>
On 11/16/2022 5:14 PM, Junxiao Shi wrote:
> This allows a DPDK application running with root privilege to create a
> memif socket listener with non-root owner uid and gid, which can be
> connected from client applications running without root privilege.
>
+1 to idea
As Stephen mentioned, how this is tested?
Do you have simple memif client that we can use it to verify the work?
> Signed-off-by: Junxiao Shi <git@mail1.yoursunny.com>
> ---
> doc/guides/nics/memif.rst | 2 ++
> drivers/net/memif/memif_socket.c | 13 +++++++--
> drivers/net/memif/rte_eth_memif.c | 48 +++++++++++++++++++++++++++++--
> drivers/net/memif/rte_eth_memif.h | 2 ++
> 4 files changed, 60 insertions(+), 5 deletions(-)
>
> diff --git a/doc/guides/nics/memif.rst b/doc/guides/nics/memif.rst
> index aca843640b..8a8141aa72 100644
> --- a/doc/guides/nics/memif.rst
> +++ b/doc/guides/nics/memif.rst
> @@ -44,6 +44,8 @@ client.
> "rsize=11", "Log2 of ring size. If rsize is 10, actual ring size is 1024", "10", "1-14"
> "socket=/tmp/memif.sock", "Socket filename", "/tmp/memif.sock", "string len 108"
> "socket-abstract=no", "Set usage of abstract socket address", "yes", "yes|no"
> + "uid=1000", "Set socket listener owner uid. Only relevant to server with socket-abstract=no", "unchanged", "uid_t"
> + "gid=1000", "Set socket listener owner gid. Only relevant to server with socket-abstract=no", "unchanged", "gid_t"
The options are "owner-uid" & "owner-gid"
> "mac=01:23:45:ab:cd:ef", "Mac address", "01:ab:23:cd:45:ef", ""
> "secret=abc123", "Secret is an optional security option, which if specified, must be matched by peer", "", "string len 24"
> "zero-copy=yes", "Enable/disable zero-copy client mode. Only relevant to client, requires '--single-file-segments' eal argument", "no", "yes|no"
> diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
> index 7886644412..c2b038d01a 100644
> --- a/drivers/net/memif/memif_socket.c
> +++ b/drivers/net/memif/memif_socket.c
> @@ -889,7 +889,7 @@ memif_listener_handler(void *arg)
> }
>
> static struct memif_socket *
> -memif_socket_create(char *key, uint8_t listener, bool is_abstract)
> +memif_socket_create(char *key, uint8_t listener, bool is_abstract, uid_t owner_uid, gid_t owner_gid)
> {
> struct memif_socket *sock;
> struct sockaddr_un un = { 0 };
> @@ -941,6 +941,14 @@ memif_socket_create(char *key, uint8_t listener, bool is_abstract)
>
> MIF_LOG(DEBUG, "Memif listener socket %s created.", sock->filename);
>
> + if (!is_abstract && (owner_uid != (uid_t)-1 || owner_gid != (gid_t)-1)) {
> + ret = chown(sock->filename, owner_uid, owner_gid);
> + if (ret < 0) {
> + MIF_LOG(ERR, "Failed to change listener socket owner %d", errno);
When you see the error message it is not clear what is printed '%d' part is.
I can see rest of the driver structured this as:
"<message> : %s, strerror(errno)"
perhaps same can be used here.
> + goto error;
This path also prints a error log and it also prints 'strerror(errno)',
perhaps 'strerror(errno)' part can be droppped from above log.
<...>
> @@ -1855,6 +1887,14 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
> &memif_set_is_socket_abstract, &flags);
> if (ret < 0)
> goto exit;
> + ret = rte_kvargs_process(kvlist, ETH_MEMIF_OWNER_UID_ARG,
> + &memif_set_owner, &owner_uid);
> + if (ret < 0)
> + goto exit;
> + ret = rte_kvargs_process(kvlist, ETH_MEMIF_OWNER_GID_ARG,
> + &memif_set_owner, &owner_gid);
> + if (ret < 0)
> + goto exit;
> ret = rte_kvargs_process(kvlist, ETH_MEMIF_MAC_ARG,
> &memif_set_mac, ether_addr);
Unrelated with this patch, but memif checks for valid args and ignores
all silently when at least of them is invalid [1].
Since you are already there, if you have time, can you add a log for the
case when there is invalid argument provided and arguments are ignored?
Thanks,
ferruh
[1]
kvlist = rte_kvargs_parse(rte_vdev_device_args(vdev), valid_arguments);
if (kvlist != NULL) {
< parse args>
}
prev parent reply other threads:[~2022-12-07 11:44 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-15 20:44 [RFC PATCH] " Junxiao Shi
2022-11-15 23:53 ` Stephen Hemminger
2022-11-16 13:09 ` [RFC PATCH v2] " Junxiao Shi
2022-11-16 17:04 ` Stephen Hemminger
2022-11-16 17:14 ` [RFC PATCH v3] " Junxiao Shi
2022-11-16 17:14 ` [PATCH] " Junxiao Shi
2022-12-07 14:28 ` Ferruh Yigit
2022-12-07 14:41 ` [PATCH v2] " Junxiao Shi
2022-12-07 15:43 ` Ferruh Yigit
2022-12-07 16:56 ` Ferruh Yigit
2022-12-07 17:48 ` Junxiao Shi
2022-12-08 14:29 ` Ferruh Yigit
2022-12-07 15:53 ` [PATCH v3] " Junxiao Shi
2022-12-08 16:25 ` Ferruh Yigit
2022-12-08 16:25 ` Ferruh Yigit
2022-11-16 17:52 ` [RFC PATCH " Stephen Hemminger
2022-12-07 11:43 ` Ferruh Yigit [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4000a9ee-a48b-6c1c-5839-0fc135eb347a@amd.com \
--to=ferruh.yigit@amd.com \
--cc=dev@dpdk.org \
--cc=git@mail1.yoursunny.com \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).