From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754996AbdELOdp (ORCPT ); Fri, 12 May 2017 10:33:45 -0400 Received: from mail-eopbgr20127.outbound.protection.outlook.com ([40.107.2.127]:51711 "EHLO EUR02-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753875AbdELOdn (ORCPT ); Fri, 12 May 2017 10:33:43 -0400 Authentication-Results: suse.com; dkim=none (message not signed) header.d=none;suse.com; dmarc=none action=none header.from=virtuozzo.com; Subject: [PATCH] prctl: Allow local CAP_SYS_ADMIN changing exe_file From: Kirill Tkhai To: , , , , , , , , , , Date: Fri, 12 May 2017 17:33:36 +0300 Message-ID: <149459906128.21666.4535332985674353536.stgit@localhost.localdomain> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: AM4PR0101CA0038.eurprd01.prod.exchangelabs.com (2603:10a6:200:2e::48) To DB6PR0801MB1334.eurprd08.prod.outlook.com (2603:10a6:4:a::28) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 88d9702e-4572-46d5-861a-08d49943e299 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:DB6PR0801MB1334; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1334;3:spCyi4/3PugfS224LPxdF5YzQuyIYwJKweGzyy7YTdfA3gnzSS4zPfQ6Bb0GMgYHM7/HnBW9UQt+vX8kxTyjctMZTopyuZeE2F28A+hfRdzx5sHYmiPU96pmQlwK/NzVNKhk5JtIEsjYGt0XUT74TPAhijmcweB0SRSo0+thUnvP5v2QPJUuO7XPacRlNAvoWEaU0V9FEZTYFkPCiU1FtC/LyGXi0A2klHMSRPnua995E0QATjoKBZgtW8sfsQ5U8HCnLMXE3YTNO/3RtGzCJ3cUjIz6aaVPrr7Ke4jLZLo+k+t7pdpsGn5Mrinq3qbbn45atzhF7o+xwSkh5NL++A==;25:22cJ9QgR4nQOWz1JH1exdCNAyZP3TAoaZrc+F0L6P53SHRSu1nQ7TLkGlPETCDYGFZrphWRsxzAJ7kv9cPRYbDMvoC1oRdBK54hNqrWGexbBWVHrhfH6SjkBy69GOmh3W190T6jcpRa2VD2mOFRnyo5u/oWzKPx9kTQQMXPUxSTdAerw12C1x7hqWcaGB7BY7gov6lxMV+HRWfP3fNY9dZF5oC/vkeHBjk/31UC0kvO6g7Zt78dTPIIA0Hf6LwRbmmcEa0iwXoIR77B3HdaGaIkzIy6PaRoY9DEM57+3SZWyeqXj0dkBx1bDWpnpNUfbNoLNUmz3/GXXgcSLlWUucalGLlgW76J3ZicFaO8mO+UWcUC8PxoaFNtzmBo37Pj01AvR8/sBsbOURnax1TIsEKbn+sbg15qa+ogqAF+6jQXHRxVtZF/zzQL4BsdDlZ7rtBU8+/FpTQ6F1+DI8Aa6i3icWSRIF2w6+ODMhYB8F04= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1334;31:emUxLfchrr8oX/ANqT/XXfmL/ZQIUUgvDXjR7ye7IAETVCOudmM1SAKHMNB9/VbFhovF/K1ZPZYYNjYL0UpBHQ7GpMLVqUqLzL/xO7FTiMyUdjBGvLa4vLSfvsJYUWwa0D5peE03AjB1JnkuTtOdimfUr8IJU+wdv9wqwn1b/hCK2jy9jFhXvaELKEnM+9NkdSsNfUyATNr3YOQFI8sPGzhoMErmySVnm1BY1p6cZN8=;20:y4ktO8IXaH9sjksEPkEHefxMQUyfbL8DDk9AqCLLR6yugk3d/Zsra2gXVXprRDELrk7WqyXFiiuvG1anNqhGQ0nmmWgysZ1tPzeyXkxnBRjB5fOV8rwz6sGJy7WxDe1FBZHjZvelEaflHGh5R9Y/bMsjLI5Y8D0mU3ndXw17rB2AEnflezuws6yTkyYXPQUY7OR0qgpnp4NqNNLyd/pem/uhJbgn/sF5tNwD721EyEV2htLeedzPSzSLQwugyy0WrpwhO6heJPISaCelMkylSjZPSAfckb2W3KLYgr/cV/cN42zs64HYq8IPDGRZHYN8ijwjz+1UGQ5hZnh3/7yWaIeR+EfBDBzCqL7oh5WGxSXgj9fxPYtDqcTcL1dera4zqdnEHYv/S+oPxotu3zAEVJ7yxUsCT48czjRoQ0FwoCM= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(93006095)(93001095)(3002001)(10201501046)(6041248)(20161123560025)(20161123564025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(6072148);SRVR:DB6PR0801MB1334;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1334; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1334;4:2CUrMiZeV4wf8GN5IP3ewbjkte/Nc6/VXby9BzGIx91uh9ovQxjayat/DU3RlsydGxLHsRKzVtAjDiJDwgaFBUmHJR4eQ59ISayY4krub+gcn8i/FEkIEC19tKyFrrAKnBGTzQfmQBEpXPlwpOfWEQ6dNw7pGbE/DDolgrjuUAI8EXEgb2VkyeN34VsdxiF4H5kj0Zzla1l7DgwiBuMywNNmSqMaPdWVlXnm20c97VwLowQRsS4yrzTnkakpY64w2XuWTHBneXzWpj5quqOjYf4tPI61p2Y92aN/s57U4JIRP4uFOn0dMOj4NfgcIUe2qYd44gINGwFlXJMf2PmAFrZyi4OKURbqw0JgNWCibEbZ2XFHAa83efbMtf+RfkfmaX6tXj5Y8yxqrNtwTIrjIsTslC/vjfcviQdaq3UOcEHjGV38iHIk9aKa+2Yqfhf3hP4VtNp9GOK6Sr67oY/VMBksoE0ZuyxOsPILA1TQRvaFP7LoQ++W2iAAEgVfx+O/LmbUDmIYzQSOBiUqs/VtN9/nILmlNd93IHqDOHYK3t4FUtiP9iCabjD5nW5ChUHfNwOGWDtchSz0wycvvbjXYXdNyecqtNqaEBB6r5nfmCvGDRdHRxmPHcvkR0pUIY2M7Mfr3/CmkF7GRBqdDf/zcO6QFSHR1Fpsv4O/eEVXzOmJm9KSNAL6A4tvVNFqkBRZAN539Iwo7P1d9o7+7sdm7z9bajGTagFyJm8kINvDSWK7NlwMYHXRrZeDO7DnQ/o63eJa8YncMKeS/Se+3lpFjTlVXRHR3PCK1/KsFXFKvSo= X-Forefront-PRVS: 0305463112 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(39400400002)(39840400002)(39450400003)(39410400002)(50466002)(6116002)(3846002)(47776003)(83506001)(2906002)(81166006)(23676002)(6506006)(53936002)(230700001)(55016002)(2201001)(66066001)(305945005)(9686003)(7736002)(42186005)(189998001)(61506002)(478600001)(5660300001)(50986999)(8676002)(38730400002)(54356999)(103116003)(33646002)(25786009)(6666003)(921003)(1121003);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB1334;H:localhost.localdomain;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtEQjZQUjA4MDFNQjEzMzQ7MjM6VE9ZN3Nsc0VMcUcyajdsMUJCekZ0enhw?= =?utf-8?B?bGN2YXRKRVFybWxaQkcvdE1Xa3dmOURrVEZKUmlSeXRXUzdSUHVLV3cyZFIy?= =?utf-8?B?ckNsWTVCN1REd0g4Um92WkpOejlZcjdoL1FLTVA5Q2d4dWFtTXhaR0dlSjBk?= =?utf-8?B?L3lUN0J3ZWpMakxZLzlzT081S2pyYVgwTzVSbkdyMTQwT2txRTh1KzBjYXAr?= =?utf-8?B?Q2w1Sys2K2J3dGxRU2lWd3k4a1kvdTFQTEJIbUJ3cWQ1WlNzemc3UjRlaHJv?= =?utf-8?B?c3FweTdVWFlqMXNIYTIrV2VEMkdRVFk2WTN4cW1IOXVKZEc4NE13SDVidG5y?= =?utf-8?B?YVpTcWJxeEF1bm92Z3I1U01FL3NkVTJ0N093VFpNTVMxRFFPTHREVXQrdnBw?= =?utf-8?B?Zm5ML2haNlJXZFZwNkdKcmxySmFTWFJmOE11cUgrVVRpR2VzQkg5cG9RaXFX?= =?utf-8?B?VjF6Qnp4Z3E3dCtGcXhjVVQ1VGk3NWhyUnJhbmx0R0c3OXNPeEVOUS9zaTJt?= =?utf-8?B?d1V3bkNaYXMzSXFMaVBmbFVZbzAzeDJoaFQxL2UzajUyRnZrREpTMU5RWmpK?= =?utf-8?B?SnFCVG0vc0tRL0x4U1cvejZpN2x6SVprdzA2NGJIbWdoY3VNeEZTaXpUdFJH?= =?utf-8?B?UmtpZkgvNXp2My8vMVEyWEl3WDNFNHlnc2NNaTRIa0F5ODBXbVUvYkphV2hx?= =?utf-8?B?R0lyYzFUSDNhbjI4WWZaWkU4aUI1Z2FNV3E3Tys4T0doUzRya2pCV0NIM2g2?= =?utf-8?B?dW9VTjlIMWNYRzgxMU55SWpZRWQ4MUd5TzloMWp4SDBpc3hrTlBzdHk1cGlt?= =?utf-8?B?eDNVSGw0NWkyczVseE15d3hmLzlhcmpRV09RNXZPd245Z25SVFRnSDMxUTk0?= =?utf-8?B?L1hRK0V2NFpzK1FwQ2ZkTjZEOUFPOHRoVHl1UXgwQXd3aHNHWDEzbGMyRUhK?= =?utf-8?B?MXBqc0tNdjBzdWVKVU9tSjZZSUh4RXhXR1JtSERQNW1yanM2VCtWdWxnTHc4?= =?utf-8?B?VENPenVyWVUyalQ2QjE0SXpJUmRFT0Z0N1FSVFJZR3VXWXczekYreDVlazZu?= =?utf-8?B?RUsybFBLbFljTHJRbG9TS21ZZ25uc1BxcFI3ZmVsejlnQ2VrOVdsSHZJSDk2?= =?utf-8?B?WXZuTkxscWtTQUFoK2RtUmExZmhTd3ljUzJ4L2RzeVYxM2VCc0JDcm9rR2o5?= =?utf-8?B?MlV3RVdZMlEwVTE4RTZDVUpKMmZrTVJIYzQvbDFDQkZmZFdMb1B3M0E1UlNi?= =?utf-8?B?Yit5WTdKMEY4ZTVlUVBycnYzcFIwSDdFcUxYTHF5MlNpazJDYnpnazQwKzFG?= =?utf-8?Q?0zpfJK6d9wIUrEfn0BR6eMdKQeuhMSW/sE=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1334;6:fl+mh/zELIW9A4xyARqOvIv1iOFC+6En7wiGnZ+vTchjNa7GiDIOM/vRFtf8arh7Xcj/6M4qP+nLhCKwHFSu/AnCKVKrckz+KeksE9SPQ6h3r0l0CAtejjPfvCy1rXndZkX2pv8insdTz1M/IV2C0fN7/3+KCgIWmH4wNoQsIyUjf4dkyQbDISGy0SCRCwOIf2GLNcF7QUMQepqvJcTPnfUJnq+5WNH803wK7tNa4193qPeRLyV2GWGD3zOK5c1cMq5BPBTBdI/aWrUBn22NGFITUyVsveQdFzlWdBIatNfBQTckBBDnpq8UVzn4+hbLmA+JwOv72Q6wLk9ry6FU+/ak6b3QHcdh3GaRzfuoO7vt7RpJwztrmY3sNxHkOB7bX9LMdfD2UopehbR3nqHeF6WO+S8INHpUIixlW4JCy9NKs0f/D1U2aF9kpEwRnaebu+D4F8qpfq2RiO3ZYoqOSKwz8YExPPpL3N4y/XmGJxocZ5TM5L41u5ynIquyjB4MTmlSObEha2LGsdohATn52R5d98sIQ1wNvAr8gpAZHfKzwlQKHQ2M7siKR6oc5RhM;5:D0xa+LASHZpaLLN7xQeYfiv9tD5DWoEPvHQRv5D2gqrfpv6iBjYb4TYPkX44885RZ/9p1CerLpTEu0aTbePen4dMUl2kCHheTUZrc4pcAtmY82MJjzv1TzRXAgeK1ZfByG508cjEBo95oCuOkzWN9g==;24:12fa63ka7fy9S+gDdhA0RuOuD1tsFVSbdMhK3wotn0jAUzbeegKCQx5yoeYzbEtigUtyXJQtZkEE43SwbGqNgbP4q3mQZkyIBZJlGhtqlbM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1334;7:f7IRyIChb71QuA7BzBxNRQLdBcGwDtiQ67dEpl8QLjtnXR80T3THERAGttA/O+NMPFvVIbm5ieEQNi6gziFijFar4kz1YFjHFZP833AqA9xThsOoVLIZbYe6OPNCcVZCUhruegSfKD3vWgmfI/ZdJKYDe6xJlob2nSWfupk3krFB7OA4qHPW28WoJGBQOernV+/iRVwGm3DK2vOiYoNYs0uQ/5cORQzizPZobij3I+ytD/QKHFpyUKtoYwXTj4+fs0byetK2EXNyESEVcgzsHBO4d1KKkecQh9l+DBWcv/0zGtNTwgvBv/eZnPwjHRSUo2B2aGEDgsss1/Fiue/9fg==;20:hRp7kYis/v3zpYOD6zJlLI93LqLUNum/2xMqt0fxR6wVSbmB0P3Tr7d7lBeLcRHCdkk+JDm6gWoOmDUuzeoWNa3qfVzn7IAkAzUiyQBvj/8Lx/p7qcBd+7ODM5AtStP6s8Awk612+7WMjJ0x0ZdQo7jmMB/+27JvubEBtVBsslU= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 May 2017 14:33:40.1684 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1334 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org During checkpointing and restore of userspace tasks we bumped into the situation, that it's not possible to restore the tasks, which user namespace does not have uid 0 or gid 0 mapped. People create user namespace mappings like they want, and there is no a limitation on obligatory uid and gid "must be mapped". So, if there is no uid 0 or gid 0 in the mapping, it's impossible to restore mm->exe_file of the processes belonging to this user namespace. Also, there is no a workaround. It's impossible to create a temporary uid/gid mapping, because only one write to /proc/[pid]/uid_map and gid_map is allowed during a namespace lifetime. If there is an entry, then no more mapings can't be written. If there isn't an entry, we can't write there too, otherwise user task won't be able to do that in the future. The patch changes the check, and looks for CAP_SYS_ADMIN instead of zero uid and gid. This allows to restore a task independently of its user namespace mappings. Signed-off-by: Kirill Tkhai CC: Andrew Morton CC: Serge Hallyn CC: "Eric W. Biederman" CC: Oleg Nesterov CC: Michal Hocko CC: Andrei Vagin CC: Cyrill Gorcunov CC: Stanislav Kinsburskiy CC: Pavel Tikhomirov --- kernel/sys.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/kernel/sys.c b/kernel/sys.c index 8a94b4eabcaa..7c6d78148fa0 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1802,15 +1802,11 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map) /* * Finally, make sure the caller has the rights to - * change /proc/pid/exe link: only local root should + * change /proc/pid/exe link: only local sys admin should * be allowed to. */ if (prctl_map->exe_fd != (u32)-1) { - struct user_namespace *ns = current_user_ns(); - const struct cred *cred = current_cred(); - - if (!uid_eq(cred->uid, make_kuid(ns, 0)) || - !gid_eq(cred->gid, make_kgid(ns, 0))) + if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN)) goto out; }