AF_UNIX status report

[Ken Brown]

On 11/5/2020 2:54 PM, Joe Lowe wrote:
> 
> 
> On 2020-11-05 11:01, Ken Brown via Cygwin-developers wrote:
>> On 11/5/2020 12:21 PM, Corinna Vinschen wrote:
>>> On Nov  5 09:23, Ken Brown via Cygwin-developers wrote:
>>>> OK, here's how I imagine this working:
>>>>
>>>> A process wants to send a file descriptor fd, so it creates a msghdr with an
>>>> SCM_RIGHTS cmsghdr and calls sendmsg.  The latter creates and sends an admin
>>>> packet A containing the fhandler for fd, and then it sends the original
>>>> packet P.
>>>>
>>>> At the receiving end, recvmsg sees packet A first (recvmsg is always
>>>> checking for admin packets anyway whenever it's called).  It stores the
>>>> fhandler somewhere.  When it then reads packet P, it retrieves the stored
>>>> fhandler, fiddles with it (duplicating handles, etc.), and creates the new
>>>> file descriptor.
>>>
>>> Actually, this needs to be implemented in a source/dest-independent
>>> manner.  Only the server of the named pipe can impersonate the client.
>>> So the server side should do the job of duplicating the handles.  If the
>>> sever is also the source of SCM_RIGHTS, it should send the fhandler with
>>> already duplicated handles.
>>
>> Ah, OK.  I was thinking of it differently.  Rather than having the server 
>> impersonate the client, I was thinking that the sender would send its winpid 
>> as part of its admin packet, which the receiver could then use to get a handle 
>> to the sender's process.  The receiver could then duplicate the handles.  But 
>> maybe your approach is better.  I'll have to rethink it.
> 
> SCM_RIGHTS on *nix; fd are retained by message buffering in the kernel. A 
> sending process can close an fd after sendmsg is called, before recvmsg is 
> called in the receiving process.

I hadn't thought about that.

> SCM_RIGHTS on *nix; fd are not added to a receiving process fd table until the 
> SCM_RIGHTS message is read. This is a consideration for DOS attacks.
> 
> So I expect it is necessary to create a temp copy of each fd being sent, so the 
> sender can close the original.

Sounds right.

Ken