From patchwork Tue Aug 27 11:39:49 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Herrmann X-Patchwork-Id: 2850148 Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 42AC29F313 for ; Tue, 27 Aug 2013 11:40:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D944C204DE for ; Tue, 27 Aug 2013 11:40:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 440E420462 for ; Tue, 27 Aug 2013 11:40:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752321Ab3H0LkG (ORCPT ); Tue, 27 Aug 2013 07:40:06 -0400 Received: from mail-ea0-f175.google.com ([209.85.215.175]:53447 "EHLO mail-ea0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752069Ab3H0LkF (ORCPT ); Tue, 27 Aug 2013 07:40:05 -0400 Received: by mail-ea0-f175.google.com with SMTP id m14so2187113eaj.6 for ; Tue, 27 Aug 2013 04:40:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=iZUky1Qw+7JjAwixhEAnkSatifjJ0iBWJihuPaKwWI0=; b=scphRiTjrAFxWms3lnzaOBFFU7tIJBL+47q2DM87a/ynELnPByqzdMOawHdtTv2Tmm CCNZ+/chOvfqnhsP/z+AmpNvWqwkMAcndd1BYx1miWoCbakIaxhSmA6iDUIdmIz/A1lf 4UimZwO8iZWdcbwqhapDZSI3E3uo4eO+Syjn5m2qfPISgCtUFgLOTxYkSwHxbGvABrYm 3YMFktkd5Y6DlnfUR5Z09JGY64bPZJheFzPS1UE15/s0iXExTl+tRAjYumOvrHmjmfLn juAqlXwdFxAIQ9Tt3L4P1YV8074JCHQmMNwI/SgpsEQvhHJb0/iOE19Fe1cWoGM57GMQ 1Okw== X-Received: by 10.14.199.198 with SMTP id x46mr680969een.82.1377603603268; Tue, 27 Aug 2013 04:40:03 -0700 (PDT) Received: from localhost.localdomain (stgt-5f71a868.pool.mediaWays.net. [95.113.168.104]) by mx.google.com with ESMTPSA id x47sm28518535eea.16.1969.12.31.16.00.00 (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 Aug 2013 04:40:02 -0700 (PDT) From: David Herrmann To: linux-input@vger.kernel.org Cc: Dmitry Torokhov , David Herrmann Subject: [PATCH v2] Input: evdev - add EVIOCREVOKE ioctl Date: Tue, 27 Aug 2013 13:39:49 +0200 Message-Id: <1377603589-25501-1-git-send-email-dh.herrmann@gmail.com> X-Mailer: git-send-email 1.8.4 In-Reply-To: <1377602704-23301-1-git-send-email-dh.herrmann@gmail.com> References: <1377602704-23301-1-git-send-email-dh.herrmann@gmail.com> Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Spam-Status: No, score=-9.3 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If we have multiple sessions on a system, we normally don't want background sessions to read input events. Otherwise, it could capture passwords and more entered by the user on the foreground session. This is a real world problem as the recent XMir development showed: http://mjg59.dreamwidth.org/27327.html We currently rely on sessions to release input devices when being deactivated. This relies on trust across sessions. But that's not given on usual systems. We therefore need a way to control which processes have access to input devices. With VTs the kernel simply routed them through the active /dev/ttyX. This is not possible with evdev devices, though. Moreover, we want to avoid routing input-devices through some dispatcher-daemon in userspace (which would add some latency). This patch introduces EVIOCREVOKE. If called on an evdev fd, this revokes device-access irrecoverably for that *single* open-file. Hence, once you call EVIOCREVOKE on any dup()ed fd, all fds for that open-file will be rather useless now (but still valid compared to close()!). This allows us to pass fds directly to session-processes from a trusted source. The source keeps a dup()ed fd and revokes access once the session-process is no longer active. Compared to the EVIOCMUTE proposal, we can avoid the CAP_SYS_ADMIN restriction now as there is no way to revive the fd again. Hence, a user is free to call EVIOCREVOKE themself to kill the fd. Additionally, this ioctl allows multi-layer access-control (again compared to EVIOCMUTE which was limited to one layer via CAP_SYS_ADMIN). A middle layer can simply request a new open-file from the layer above and pass it to the layer below. Now each layer can call EVIOCREVOKE on the fds to revoke access for all layers below, at the expense of one fd per layer. There's already ongoing experimental user-space work which demonstrates how it can be used: http://lists.freedesktop.org/archives/systemd-devel/2013-August/012897.html Signed-off-by: David Herrmann --- v2: - ungrab device during revoke - wake-up blocking read()s of the client - return -EACCES from write() for revoked clients - signal POLLHUP | POLLERR for revoked clients - don't signal POLLOUT for revoked clients drivers/input/evdev.c | 43 ++++++++++++++++++++++++++++++++++++++++--- include/uapi/linux/input.h | 1 + 2 files changed, 41 insertions(+), 3 deletions(-) diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c index d2b34fb..f2abd76 100644 --- a/drivers/input/evdev.c +++ b/drivers/input/evdev.c @@ -48,6 +48,7 @@ struct evdev_client { struct evdev *evdev; struct list_head node; int clkid; + bool revoked; unsigned int bufsize; struct input_event buffer[]; }; @@ -164,6 +165,9 @@ static void evdev_pass_values(struct evdev_client *client, struct input_event event; bool wakeup = false; + if (client->revoked) + return; + event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ? mono : real); @@ -432,6 +436,9 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer, if (!evdev->exist) { retval = -ENODEV; goto out; + } else if (client->revoked) { + retval = -EACCES; + goto out; } while (retval + input_event_size() <= count) { @@ -511,7 +518,7 @@ static ssize_t evdev_read(struct file *file, char __user *buffer, if (!(file->f_flags & O_NONBLOCK)) { error = wait_event_interruptible(evdev->wait, client->packet_head != client->tail || - !evdev->exist); + !evdev->exist || client->revoked); if (error) return error; } @@ -529,7 +536,11 @@ static unsigned int evdev_poll(struct file *file, poll_table *wait) poll_wait(file, &evdev->wait, wait); - mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR; + if (evdev->exist && !client->revoked) + mask = POLLOUT | POLLWRNORM; + else + mask = POLLHUP | POLLERR; + if (client->packet_head != client->tail) mask |= POLLIN | POLLRDNORM; @@ -795,6 +806,17 @@ static int evdev_handle_mt_request(struct input_dev *dev, return 0; } +static int evdev_revoke(struct evdev *evdev, struct evdev_client *client, + struct file *file) +{ + client->revoked = true; + evdev_ungrab(evdev, client); + input_flush_device(&evdev->handle, file); + wake_up_interruptible(&evdev->wait); + + return 0; +} + static long evdev_do_ioctl(struct file *file, unsigned int cmd, void __user *p, int compat_mode) { @@ -808,12 +830,27 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd, unsigned int size; int error; - /* First we check for fixed-length commands */ + /* First check for ioctls allowed while revoked */ switch (cmd) { case EVIOCGVERSION: return put_user(EV_VERSION, ip); + case EVIOCREVOKE: + if (p) + return -EINVAL; + else + return evdev_revoke(evdev, client, file); + + default: + if (client->revoked) + return -EACCES; + break; + } + + /* Then check for fixed-length commands */ + switch (cmd) { + case EVIOCGID: if (copy_to_user(p, &dev->id, sizeof(struct input_id))) return -EFAULT; diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h index 2fb6fae..d61c61c 100644 --- a/include/uapi/linux/input.h +++ b/include/uapi/linux/input.h @@ -152,6 +152,7 @@ struct input_keymap_entry { #define EVIOCGEFFECTS _IOR('E', 0x84, int) /* Report number of effects playable at the same time */ #define EVIOCGRAB _IOW('E', 0x90, int) /* Grab/Release device */ +#define EVIOCREVOKE _IOW('E', 0x91, int) /* Revoke device access */ #define EVIOCSCLOCKID _IOW('E', 0xa0, int) /* Set clockid to be used for timestamps */