From patchwork Tue Dec 6 18:23:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tejun Heo X-Patchwork-Id: 703296 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3tY9464fjKz9t0J for ; Wed, 7 Dec 2016 05:23:34 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="eYvPnSeG"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752434AbcLFSXV (ORCPT ); Tue, 6 Dec 2016 13:23:21 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:36224 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751327AbcLFSXS (ORCPT ); Tue, 6 Dec 2016 13:23:18 -0500 Received: by mail-pg0-f65.google.com with SMTP id x23so20561104pgx.3; Tue, 06 Dec 2016 10:23:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=k9otvE7fRPEzbPvCLTr4mLXi7N745x2Q1qOiUkr2j7M=; b=eYvPnSeGreiKKuiXElPJQ92+Y26HmbNuLvDqrHZwW7V4pWteC9Dqr3zGAkcoa2xvhP ct78VVxSMIGFPZhkJqcFNF8cZtkYM9KBadU/APj6hEIzLZub9RB9IV7s/7tsvc2kKqvH F3/StwDlwHa+6Fn33YwGeD8zhFA+/K+Z3XE19+Yb0rZk4711bJBmaDSvvdci23Z+Cq4A LumGJn//E9yTy1JlT4zM87UAT8+tQJ7b0Z/r90I7Mj4YnvvaEonhXMF0En3BAKm1ORMn XO6TdVwdGPvtuSLVcpZAGUabEukLHqF6XMXC9tydS1WUDY7G1nl6qCpSUhqjxe+bJvDs nAPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=k9otvE7fRPEzbPvCLTr4mLXi7N745x2Q1qOiUkr2j7M=; b=V+jixtjNc/qoeSZae0Ko/e1CBsDTaH7L51tBCzDKJQgaVdAsrs5XQOlF10iyJTAW+w f2xv/MxN9xkzzYApUrySGFo/re/zACoDTWHB285Iit0WXJ4DcrYzq0AnSlrD/JIb1cLs 3/6Yogb2ATHJNpLW8/Q9LK6GPnKdDnr+8q5u4dCv9gfiXHzGKdW0WcHdRaNFqBr+f75m avB2GCK3R8/q23P4xfXxP0aSsQHdY6WFw7Mb0CpU9b4O6BVy0mJG4CdDbdJw08MKm+9O UQYAX/rcnD+6cPWyHYzUDNguf2Mujfx21nNMoTUFWuH1xeyKNsyRFnJnfvG22AYWlk+V SFSA== X-Gm-Message-State: AKaTC03f3rHRBcDUWIPjtd/TZdhi0h/WO+W9OHNy1VbW5vVmZF+B86XObY3WwYNduJ8MVw== X-Received: by 10.84.138.165 with SMTP id 34mr139084412plp.20.1481048597839; Tue, 06 Dec 2016 10:23:17 -0800 (PST) Received: from localhost ([2620:10d:c090:180::1:5419]) by smtp.gmail.com with ESMTPSA id r124sm36670731pgr.6.2016.12.06.10.23.16 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 06 Dec 2016 10:23:17 -0800 (PST) Date: Tue, 6 Dec 2016 13:23:15 -0500 From: Tejun Heo To: Andy Lutomirski Cc: John Stultz , Alexei Starovoitov , Andy Lutomirski , =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= , Daniel Mack , "David S. Miller" , kafai@fb.com, Florian Westphal , Harald Hoyer , Network Development , Sargun Dhillon , Pablo Neira Ayuso , lkml , Li Zefan , Jonathan Corbet , "open list:CONTROL GROUP (CGROUP)" , Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , Linux API Subject: Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a process to migrate other tasks between cgroups Message-ID: <20161206182315.GB2625@mtj.duckdns.org> References: <20161109000342.GA42532@ast-mbp.thefacebook.com> <20161206165519.GA17648@mtj.duckdns.org> <20161206181221.GA2625@mtj.duckdns.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.1 (2016-10-04) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hello, On Tue, Dec 06, 2016 at 10:13:53AM -0800, Andy Lutomirski wrote: > > Delegation is an explicit operation and reflected in the ownership of > > the subdirectories and cgroup interface files in them. The > > subhierarchy containment is achieved by requiring the user who's > > trying to migrate a process to have write perm on cgroup.procs on the > > common ancestor of the source and target in addition to the target. > > OK, I see what you're doing. That's interesting. It's something born out of usages of cgroup v1. People used it that way (chowning files and directories) and combined with the uid checksn it yielded something which is useful sometimes, but it always had issues with hierarchical behaviors, which files to chmod and the weird combination of uid checks. cgroup v2 has a clear delegation model but the uid checks are still left in as not changing was the default. It's not necessary and I'm thinking about queueing something like the following in the next cycle. As for the android CAP discussion, I think it'd be nice to share an existing CAP but if we can't find a good one to share, let's create a new one. Thanks. diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt index 4cc07ce..34b4b44 100644 --- a/Documentation/cgroup-v2.txt +++ b/Documentation/cgroup-v2.txt @@ -328,14 +328,12 @@ a process with a non-root euid to migrate a target process into a cgroup by writing its PID to the "cgroup.procs" file, the following conditions must be met. -- The writer's euid must match either uid or suid of the target process. - - The writer must have write access to the "cgroup.procs" file. - The writer must have write access to the "cgroup.procs" file of the common ancestor of the source and destination cgroups. -The above three constraints ensure that while a delegatee may migrate +The above two constraints ensure that while a delegatee may migrate processes around freely in the delegated sub-hierarchy it can't pull in from or push out to outside the sub-hierarchy. @@ -350,10 +348,10 @@ all processes under C0 and C1 belong to U0. Let's also say U0 wants to write the PID of a process which is currently in C10 into "C00/cgroup.procs". U0 has write access to the -file and uid match on the process; however, the common ancestor of the -source cgroup C10 and the destination cgroup C00 is above the points -of delegation and U0 would not have write access to its "cgroup.procs" -files and thus the write will be denied with -EACCES. +file; however, the common ancestor of the source cgroup C10 and the +destination cgroup C00 is above the points of delegation and U0 would +not have write access to its "cgroup.procs" files and thus the write +will be denied with -EACCES. 2-6. Guidelines diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 85bc9be..49384ff 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2854,12 +2854,18 @@ static int cgroup_procs_write_permission(struct task_struct *task, * even if we're attaching all tasks in the thread group, we only * need to check permissions on one of them. */ - if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && - !uid_eq(cred->euid, tcred->uid) && - !uid_eq(cred->euid, tcred->suid)) - ret = -EACCES; - if (!ret && cgroup_on_dfl(dst_cgrp)) { + /* root is allowed to do anything */ + if (uid_eq(cred->euid, GLOBAL_ROOT_UID)) + goto out; + + /* + * On v2, follow the delegation model. Inside a delegated subtree, + * the delegatee can move around the processes however it sees fit. + * + * On v1, a process should match one of the target's uids. + */ + if (cgroup_on_dfl(dst_cgrp)) { struct super_block *sb = of->file->f_path.dentry->d_sb; struct cgroup *cgrp; struct inode *inode; @@ -2877,8 +2883,11 @@ static int cgroup_procs_write_permission(struct task_struct *task, ret = inode_permission(inode, MAY_WRITE); iput(inode); } + } else if (!uid_eq(cred->euid, tcred->uid) && + !uid_eq(cred->euid, tcred->suid)) { + ret = -EACCES; } - +out: put_cred(tcred); return ret; }