From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757440AbdELPV1 (ORCPT ); Fri, 12 May 2017 11:21:27 -0400 Received: from mail-he1eur01on0119.outbound.protection.outlook.com ([104.47.0.119]:30528 "EHLO EUR01-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750713AbdELPVZ (ORCPT ); Fri, 12 May 2017 11:21:25 -0400 Authentication-Results: hallyn.com; dkim=none (message not signed) header.d=none;hallyn.com; dmarc=none action=none header.from=virtuozzo.com; Subject: Re: [PATCH] prctl: Allow local CAP_SYS_ADMIN changing exe_file To: "Eric W. Biederman" References: <149459906128.21666.4535332985674353536.stgit@localhost.localdomain> <87a86i2kez.fsf@xmission.com> CC: , , , , , , , , From: Kirill Tkhai Message-ID: <5d560708-0378-328e-57f2-96d5aa7c072d@virtuozzo.com> Date: Fri, 12 May 2017 18:21:12 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <87a86i2kez.fsf@xmission.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1P18901CA0022.EURP189.PROD.OUTLOOK.COM (10.173.66.160) To HE1PR0801MB1338.eurprd08.prod.outlook.com (10.167.247.156) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 930834f3-cf30-4661-f3d0-08d4994a8b54 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:HE1PR0801MB1338; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1338;3:PHacxHHWOIIEbrhJuSP5p+7+1N0+TgeDRGPy0FHW00z3HmFvJkzgxiuABLm8S4woseMWw8uavANGdmbzHysHGhCr2InBBk1ILX0kBxlT5hYCMvLbym9MHcZFEY4+oJVyxLL4C2PVH1PCGbJxvZe9kDcCNPg9BjoBBv2BXLTKaUR9glhWA2XgYpqcSBFtGeUUH372YTy5RP851Qf1KjBMVMFfsAzAc8yYadI2Eil4lT2i4TjVVIgFWMeS3cds2IOIUYyo9aY55N5OBbQuVz0cEm4tDD2ux7nAu4tkJQPylp/+5zkCYJ7rxlb/xuQn0fElU58kVvjuZUEPw9FePvOkCQ==;25:DrsRODUxt9usZpMl/ZhD6JZM8oDqJ0wQuM01vHkPSIvZ8IitrxqXaPbCx60Iv9m3WDfb5dsbbBlkfnic/kk5/0wA8VJUAfDkS29Tyw3hYiRcZZgF6AvHU0lMbWWR+rmFhGlQ287Flfscl+l1SJZsJN29mJ9h/fqz+RP85WeqV7jtHRmksklcidjIKPnphxHYI/e5EXnhw6wUcKKL1zlg+VPPbtYR0QGBYNsmiLE33sln7qhNsk0jVYmymIvf3vlwd7rus8hhqS+1W38jH2H5A4W/GxPbnpic6fS0+8L+RSwTJXOQNRAFmJCyXEqH/IDhxnlWH2uBjS9jb9EZlX8kDzaJEvZqLo+uspIMXjqdKrUBiZQgFs4E11In1WWPHOUHZu0bxAu6H7jtLjHyinEw/1GZgs/p+vq3tTBFlfxBcd309p7j94Z6rOfMAsa5cvfcjKpN3bEW0WRyyTKuIfezYIM9zHBC+UyghmJla04C8so= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1338;31:8YQyY36vstbXHeTii249JEbL4lOlUiN7vrxhD/742GC1oiHEO1+UwLC/pJW9BI1f1XW8MAQPCXc5YuIJYavF04aF1Ftxwb9ICk6SVjxbYcZMbckblSbZ1X0LHi0ZsWbt16DtslSIRJAAkc0Cb/JhS65aKHSYtqeyjg/dF+297yfrNMhvvje7ioZnxAjrDOhslmKRTkbzeBYJ8y4FGyJxlsMlAB135dBbAE7b0lBWg7A=;20:Q6s1ryWcmHX+KnVLJuiqQkbCEyZNt27Bj4uvm//nZSKK+y3EDtWefns6J9S1AkCy+mTi6jPDHIJrmfj1TB6uuH+MJVedTZYfMN/1mE+kUnZ2n35t7s2xjfS5RysM+gNSgjXJ+QlNPJEIJxP67SQU1GtFgWS53TtRi9o4ydNOGuQIIvX5QZq67Hk1dBLuKmlRnr5n7heyGyyv29n68vZbJGpnIOo2fgdyS5Vwk2BPfFjfBHHZKEoeLlz/3N3uqWRtPtUKbSfGjxcfk6mXJzzir+3xcSszZWvaq6B6ccf99Y9Ko6T9tENv0xX/IZHhpNtRNj9QkCGZo7Za1vZ1+wKHvLxOjM79M/0EdgX2oF1WkPXqRPiTXjKbdOxr2Hvn9ssk+z9z/NGF2MpKszQDQOVDjpPZ0ih4pxCELyHR4nUrbu8= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3002001)(6041248)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123564025)(20161123555025)(20161123562025)(6072148);SRVR:HE1PR0801MB1338;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1338; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1338;4:t9KalhAHGSsK+f5U7FELuq47B+71PtCGIrr0lgY6Sr0sMv15E0tSuMZlvJV+5jxGbPcxlBBDiEfXzmJpHjXHHA28ielDeysY63LQSXCq9gRPtTdIl7o8SnU/wS675U8Kpn8ugHMr6KdlqMxmf1IfmuBBWTFR7v7mKwrPrED9NtgKALvm3hRLffve1fVoSQ/zh/I5BHl+xw4heuw+Ac6WpgVKccZkZOFaAYHlz0X0/h7piehbMW7n1tfKPZo1eoEf1KaVvAG76p+3xQkZauFq3cX9pfsIOLESvcX+zYYaOlmARuUbynNs7e+iGXLjEW7yA7ewP9vw/ib8/lvgo7KDki+wdfdKQ3slurgkK8Sye0Ax4tkC7BY/QsTVq+OfKU2//Z/yh2WrAVl/4J4YlJgAyB1cjWO2K5wmexvc5XQSbqcGmPWqSCnaO1bR8KbURCTPI8UR2fUGQq/20MhUi82NqMJL8BqAxeBFv5AkTOuD1tBaFWkSipYjsI2frFb9LLlsqaMGmzUECgiZA/V+CnDLlkr8EDCahiIOP5eDYSvpWiv5OvR0Cne5NmKMiC6mFlGkZiLjK1R286oXR+8gIOYEi19ssorX5YB3R/xSWnF/qOolQv2TcUK71I4Rl559ZHq3mLCF3o0yS6vlJBuOxxb+7MP77d1goTZy6mv/9pD4YwhsM64xFKAoPC2ULz0Km/Z6XGau31ZM+A6p1BbolcoxvXrCrEtJ/ItWD64TRhCFjrXil+T3EEcHJr/CQ+XfzYDpBnf+Qan0VrYMiqMfyoePg/RQcPLcXtQHi414wzOs3yo= X-Forefront-PRVS: 0305463112 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(39840400002)(39450400003)(39410400002)(39400400002)(24454002)(42186005)(50466002)(65956001)(47776003)(189998001)(66066001)(31696002)(6916009)(2950100002)(6486002)(6666003)(65806001)(90366009)(2906002)(23676002)(77096006)(76176999)(54356999)(50986999)(53936002)(53546009)(478600001)(230700001)(25786009)(229853002)(33646002)(36756003)(4326008)(6116002)(7736002)(3846002)(8676002)(31686004)(305945005)(5660300001)(65826007)(81166006)(38730400002)(6246003)(83506001)(110136004);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1338;H:[172.16.24.209];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtIRTFQUjA4MDFNQjEzMzg7MjM6UkRrZFM4c3JSOGdGbkZmS2xIMzRxVE1G?= =?utf-8?B?MkRlK1FRbU1SUkM4MWlRSkV2NEE5Z0JGQTRWRmQ3UVNSZzRyWDB2WDVmeEhy?= =?utf-8?B?Y2k0TDN6Tm12bTFkZ1UxczFoTnBxVHhvTFFsaDZKK3RYaTdUUmdvQmQvMFBE?= =?utf-8?B?SFJ3M3FJVm1xV3BHRjJDaWZGK1ZQd2UxejVyeFRiOWVhRmYyWEZsV3RsVHFR?= =?utf-8?B?dHdHYXRPbExNMmhkVUJrK05PdTU4Qlc5Q3Y3VjFrYUlQejZjalZWejFuK01p?= =?utf-8?B?d0VIekh4akJOSGx2MDVrSGdDRmdrY293ZFNkcXhIRFE3NXFuYUJjYXVrWi9s?= =?utf-8?B?eUZxa0cvQ2dyQkZtMklNaG9ZSnlHRDhlZkRRNDJjUTN5aHNUaFU0c1VyN3ZY?= =?utf-8?B?NE15MVNrRVIwL2VZOFhZVE90ZmkxZklEckdBd3kyMmFiaVdBbTdCZnY3eU5v?= =?utf-8?B?aG1zQ1NFS2tOd2VWTUtHb3Jkd3lLZVBhWnBiOUprRHg1SXNzcC8xWDBJQndo?= =?utf-8?B?SEZneW5wb1B4UWhpckxodVJScHBmSmM3WkI1YlIweWRPbXJEcE04NlhtOFpT?= =?utf-8?B?VXhZbk5QRUxsS3hPeFVoSWh1VTVlWE1PWFpMdzlha1BkNjYrSFphYzBmOUEx?= =?utf-8?B?eklBN1EvQjZZV2gwRUVkRUw3eW9WbE5EOTBMRjhUMUY4bHFucjhETkhyNUsz?= =?utf-8?B?Tld3bFArWk14SEttdVp1aVRpUXhhMHloMlNsN1lacVVYUjlzLzk3Zi9LVjB6?= =?utf-8?B?bEd3MXBlbnFjblJiaU40Zi9TcVQ2SUtoQVExTFg4cnVlY0JJUytvUHA4UEEv?= =?utf-8?B?eE9FMFZXWkd5aXVsUGxCbFExMTRMcmpKdzlDc2xOL09KRk9uU0dqeXY3dGRP?= =?utf-8?B?cElpZGhORmo4NzBsOGp2SmxIZDJtRFE4Ukc5amNSeGM0SWxoMnNmYTJYYWhN?= =?utf-8?B?aUlFYkREaTNRUHdTZjgwU3hhRFB6czN0T0tXVVU4ci9aUFRwb1ZrcnoybE1B?= =?utf-8?B?WWNNNExseHJBbkE0OW5FS1VobEZhckEyYkowWG9DMlN2M1AwRDUzMFZadVp3?= =?utf-8?B?SXRkUEI4bFRkSDkyZGRPaER5RGUvQjZLQVEwNGVZZXAzdEFNYUpjd3c0QXdQ?= =?utf-8?B?ZEVGYzZTbGZHTkFMY2VMR3ZETElucm5uVjhIOVpmUDBUdTVjYkxpSnRXR1I5?= =?utf-8?B?cTFoYlVnbXorNmxTQ0p1YkVCMDNjdFl0b3lid0ZMZmNMdUd3Szk0dTQydGpi?= =?utf-8?B?bERLZ2Y1RFFEUTNmYUVQYnZmemE4cy90MVpUcnRMZ2xPd1FESFlEQXRtSlRK?= =?utf-8?B?cWV0T09IZmFoR3dDMVQxbHltbEUxQWFVRG0zRGVoOFExcTBST3QzWUVkS0Fz?= =?utf-8?B?ZGYzUmZKZVZvYklxMi9UV0N0RmNUN3paME9MNmNrR2xpSDE1eTZQVC9EZjJ3?= =?utf-8?B?NUZ2NDlETlpPN09sSG0rVE50bGJDalhrV0ZhUW5DNHFJOHNla2dLNE1tdFF3?= =?utf-8?B?Tldzdmc3em1VSC95bWNWQUNxOFh5WGFjNWlYRVRSbXRkTmMwM25qbmZtL21T?= =?utf-8?B?d0Nxb3RURGxKTWJPNnRrWWtHaXIxNG9tRFZFdFhIVWdmNEJUQWt6VDlXb2xm?= =?utf-8?Q?WEb1+0iV1JowE1O7kzGayX?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1338;6:uI6SAZK7sqVbl+poWj3heCqgvVwDbszNQkydQpCxGjYi+98m6u5h9Fe8PP2CSbsIWUctRXjV80syfDgklV+n1tzkLpT1IUmP3jEEtPgNp2MFfvTsgsH+nrpz2VKSf6ftapdIiTmqQwY+vI2WWXMhHUi/scXteSLElNFzMpnVdl3difUTzx3ofNEChEfg+YUPGYQnXvN9XsNwJ47Kce8FmGmNB0aR4Lsv2b0yHJI3/tglit9bRfTvD+4yi9nLz3NOC2ln4+igkrCwJ39dozFUgSIMBtM0F+AbtEYYsP3ojSfTl0D/55WgslPmtQrrPeG+iwnnNM9Rly8dnVZCoxD9EXul72cum81gPb09rS3fSQRMSFRUiYXHH0C87YtppGbn1KRnxcgw0y+dlhYQpC/nnnP/TAm1uCjT6kCP56l1ujZpGMaLQniGp+3JyL/UsAFHG8Nmidijcnftk1Yb1BMPkoqNDsDohxfvCc1+i2mq62HsMgAclkryxWOJuhLiDBj790UkPldSxedq+otmrdu98A==;5:LJBrIKYEUx+sgPbTxysnMrIMiDMxt6FXoKof3/Q5GRRG6/OHeDNSac3UfTHLhOh9Lwif+dsNui9GWzuRVEGAzwNvcC7vVboMSyArX4h4I9UVxMWjLb/ujGzCX8kmJaKSL2KbbEe84Hz7KbjAnBclSQ==;24:NdSyLRHFCBmQ/T0CVHEvWG+7ru9xXDhu9Et0yYuFXiEM8nDPgJ1rRSgM5tvyaBZkcbr2Nh5aeSMQgTWNQmecmVHYm7xKr2BCy1I/LTJ/FmM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1338;7:rQAEGkggVP9NAiYFN+mUyGKWy9TOqW4gf3fAnCa/uQIdRE8DamyAUj5lhnLvyoa9WnjBZFTBsSUYBKpLj3zTQ5OCGyEadFNJYvK9QOK3+xHf5LsA3yOxL+HUT3bkvwwy+cQBaP5YoM6b2FieWcMEWa2DzVXs7wre6BCEmqWDBrIUdm1I9dQ+u4PF95/2R1dzKCG55i0ODaYZ6jZ7g1ytGB7Mn/aAQMQqgg/UNYh61a/hZLk7oh+YT3w34ffngFCZzLobjmZjPNr9mNhs1PciEcAa1/aR5UdXnEx0EUHq2JkvCYzWTOw8PuXjAhZcU3DmP+kBLh8ags0aP25n/jW9vA==;20:rv+OGWBaKaE6zeMwtpUhpcVCQ1ar6KBAHa3q1/Q/Z2wRmK8HM9W2M618QZX0Au47Dx41kqFvFJB6k81R/eBjRLV3/wu9R5mpOvrO1RC+Ex5oDeIse+8Dml1btRIzPImZk8PHX7puQir0SB0QhtO8d99zgPEg7EpAuxGVudPos/g= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 May 2017 15:21:19.8112 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1338 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12.05.2017 17:56, Eric W. Biederman wrote: > Kirill Tkhai writes: > >> During checkpointing and restore of userspace tasks >> we bumped into the situation, that it's not possible >> to restore the tasks, which user namespace does not >> have uid 0 or gid 0 mapped. >> >> People create user namespace mappings like they want, >> and there is no a limitation on obligatory uid and gid >> "must be mapped". So, if there is no uid 0 or gid 0 >> in the mapping, it's impossible to restore mm->exe_file >> of the processes belonging to this user namespace. >> >> Also, there is no a workaround. It's impossible >> to create a temporary uid/gid mapping, because >> only one write to /proc/[pid]/uid_map and gid_map >> is allowed during a namespace lifetime. >> If there is an entry, then no more mapings can't be >> written. If there isn't an entry, we can't write >> there too, otherwise user task won't be able >> to do that in the future. >> >> The patch changes the check, and looks for CAP_SYS_ADMIN >> instead of zero uid and gid. This allows to restore >> a task independently of its user namespace mappings. > > Applied thanks. Testing against 0 in the modern kernel is perhaps the > most bizarre permisssion check I have seen lately. Thank you, Eric! >> >> Signed-off-by: Kirill Tkhai >> CC: Andrew Morton >> CC: Serge Hallyn >> CC: "Eric W. Biederman" >> CC: Oleg Nesterov >> CC: Michal Hocko >> CC: Andrei Vagin >> CC: Cyrill Gorcunov >> CC: Stanislav Kinsburskiy >> CC: Pavel Tikhomirov >> --- >> kernel/sys.c | 8 ++------ >> 1 file changed, 2 insertions(+), 6 deletions(-) >> >> diff --git a/kernel/sys.c b/kernel/sys.c >> index 8a94b4eabcaa..7c6d78148fa0 100644 >> --- a/kernel/sys.c >> +++ b/kernel/sys.c >> @@ -1802,15 +1802,11 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map) >> >> /* >> * Finally, make sure the caller has the rights to >> - * change /proc/pid/exe link: only local root should >> + * change /proc/pid/exe link: only local sys admin should >> * be allowed to. >> */ >> if (prctl_map->exe_fd != (u32)-1) { >> - struct user_namespace *ns = current_user_ns(); >> - const struct cred *cred = current_cred(); >> - >> - if (!uid_eq(cred->uid, make_kuid(ns, 0)) || >> - !gid_eq(cred->gid, make_kgid(ns, 0))) >> + if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN)) >> goto out; >> } >>