[PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[Hungyu Lin]

Commit d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s
period") moved the CAP_SYS_RESOURCE check for psi triggers from the
open() of the /proc/pressure files to psi_trigger_create(), so that the
credentials of the opener decide whether a trigger is privileged. In
doing so it replaced capable(CAP_SYS_RESOURCE) with a direct test of the
opener's effective capability set:

	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);

Unlike capable(), cap_raised() does not check against the initial user
namespace and does not go through the LSM capable hook. A task that
creates a user namespace has a full effective set inside it, so an
unprivileged user gets privileged triggers on /proc/pressure/* and on
delegated cgroup pressure files: windows that are not a multiple of 2s,
served by the SCHED_FIFO psimon kthread, which the N*2s rule was meant
to keep from unprivileged users. LSM policies that deny CAP_SYS_RESOURCE
are not consulted either.

Use file_ns_capable(), which checks the opener's credentials against the
given user namespace through security_capable(). This brings back the
user namespace and LSM checks of the capable() call it replaced.

Fixes: d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s period")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 kernel/sched/psi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7c5381423334..cf2593183b25 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1347,7 +1347,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf,
 	 * Checking the privilege here on file->f_cred implies that a privileged user
 	 * could open the file and delegate the write to an unprivileged one.
 	 */
-	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
+	privileged = file_ns_capable(file, &init_user_ns, CAP_SYS_RESOURCE);

 	if (sscanf(buf, "some %u %u", &threshold_us, &window_us) == 2)
 		state = PSI_IO_SOME + res * 2;
--
2.43.0