[PATCH] fs/resctrl: Use open-time credentials for task move permission checks

[PATCH] fs/resctrl: Use open-time credentials for task move permission checks

[Hungyu Lin]

Writing a PID to a resctrl group's "tasks" file moves that task into the
group. Whether the move is allowed depends on the PID written, so
rdtgroup_task_write_permission() checks it at write time, making the
same comparisons as __cgroup1_procs_write().

It checks current's credentials. That may allow a less privileged
process to trick a more privileged one into writing into a fd that it
opened. Commit 1756d7994ad8 ("cgroup: Use open-time credentials for
process migraton perm checks") closed the same hole in cgroup by using
the credentials saved at open time. rdtgroup_task_write_permission()
still uses current_cred().

Use of->file->f_cred instead, as cgroup1 does.

Fixes: e02737d5b826 ("x86/intel_rdt: Add tasks files")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
Compile tested only, x86_64 and arm64 with W=1. I don't have hardware
with RDT, PQoS or MPAM to run it on.

By default only root can open the "tasks" file for writing, so this
only matters when write access to a resource group has been handed to
a less privileged user.

This changes the comment that Josef Bacik's "fs/resctrl: use
cred_ids_allow_move()" uses as context. A plain git apply of that patch
on top of this one fails; git am -3 merges the two cleanly.

 fs/resctrl/rdtgroup.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c
index 57ab090072c2..ddaf34548205 100644
--- a/fs/resctrl/rdtgroup.c
+++ b/fs/resctrl/rdtgroup.c
@@ -725,12 +725,14 @@ static int rdtgroup_task_write_permission(struct task_struct *task,
 					  struct kernfs_open_file *of)
 {
 	const struct cred *tcred = get_task_cred(task);
-	const struct cred *cred = current_cred();
+	const struct cred *cred = of->file->f_cred;
 	int ret = 0;

 	/*
 	 * Even if we're attaching all tasks in the thread group, we only
-	 * need to check permissions on one of them.
+	 * need to check permissions on one of them. Check permissions using
+	 * the credentials from file open to protect against inherited fd
+	 * attacks.
 	 */
 	if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
 	    !uid_eq(cred->euid, tcred->uid) &&
--
2.43.0