[PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[Hungyu Lin]

Commit d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s
period") moved the CAP_SYS_RESOURCE check for psi triggers from the
open() of the /proc/pressure files to psi_trigger_create(), so that the
credentials of the opener decide whether a trigger is privileged. In
doing so it replaced capable(CAP_SYS_RESOURCE) with a direct test of the
opener's effective capability set:

	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);

Unlike capable(), cap_raised() does not check against the initial user
namespace and does not go through the LSM capable hook. A task that
creates a user namespace has a full effective set inside it, so an
unprivileged user gets privileged triggers on /proc/pressure/* and on
delegated cgroup pressure files: windows that are not a multiple of 2s,
served by the SCHED_FIFO psimon kthread, which the N*2s rule was meant
to keep from unprivileged users. LSM policies that deny CAP_SYS_RESOURCE
are not consulted either.

Use file_ns_capable(), which checks the opener's credentials against the
given user namespace through security_capable(). This brings back the
user namespace and LSM checks of the capable() call it replaced.

Fixes: d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s period")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 kernel/sched/psi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7c5381423334..cf2593183b25 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1347,7 +1347,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf,
 	 * Checking the privilege here on file->f_cred implies that a privileged user
 	 * could open the file and delegate the write to an unprivileged one.
 	 */
-	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
+	privileged = file_ns_capable(file, &init_user_ns, CAP_SYS_RESOURCE);

 	if (sscanf(buf, "some %u %u", &threshold_us, &window_us) == 2)
 		state = PSI_IO_SOME + res * 2;
--
2.43.0

Re: [PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[Mickaël Salaün]

On Fri, Nov 06, 2026 at 12:00:04PM +0000, Hungyu Lin wrote:
> Commit d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s
> period") moved the CAP_SYS_RESOURCE check for psi triggers from the
> open() of the /proc/pressure files to psi_trigger_create(), so that the
> credentials of the opener decide whether a trigger is privileged. In
> doing so it replaced capable(CAP_SYS_RESOURCE) with a direct test of the
> opener's effective capability set:
> 
> 	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
> 
> Unlike capable(), cap_raised() does not check against the initial user
> namespace and does not go through the LSM capable hook. A task that
> creates a user namespace has a full effective set inside it, so an
> unprivileged user gets privileged triggers on /proc/pressure/* and on
> delegated cgroup pressure files: windows that are not a multiple of 2s,
> served by the SCHED_FIFO psimon kthread, which the N*2s rule was meant
> to keep from unprivileged users. LSM policies that deny CAP_SYS_RESOURCE
> are not consulted either.
> 
> Use file_ns_capable(), which checks the opener's credentials against the
> given user namespace through security_capable(). This brings back the
> user namespace and LSM checks of the capable() call it replaced.
> 
> Fixes: d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s period")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

This is directly visible with the new Landlock control of capabilities.

Reviewed-by: Mickaël Salaün <mic@digikod.net>
Tested-by: Mickaël Salaün <mic@digikod.net>

> ---
>  kernel/sched/psi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
> index 7c5381423334..cf2593183b25 100644
> --- a/kernel/sched/psi.c
> +++ b/kernel/sched/psi.c
> @@ -1347,7 +1347,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf,
>  	 * Checking the privilege here on file->f_cred implies that a privileged user
>  	 * could open the file and delegate the write to an unprivileged one.
>  	 */
> -	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
> +	privileged = file_ns_capable(file, &init_user_ns, CAP_SYS_RESOURCE);
> 
>  	if (sscanf(buf, "some %u %u", &threshold_us, &window_us) == 2)
>  		state = PSI_IO_SOME + res * 2;
> --
> 2.43.0