linux-kernel - [RFC/RFT PATCH] cgroup: enable write permission for the group of users

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 1 Feb 2011 10:02:09 +0100
From:	Jordi Pujol <jordipujolp@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	Ingo Molnar <mingo@...e.hu>, Mike Galbraith <efault@....de>
Subject: [RFC/RFT PATCH] cgroup: enable write permission for the group of users

Hello,

Working in a development that uses control groups and libcgroup, I have found 
that the files in control groups directories need write permission for the 
group of users also.

In example,
here is an excerpt of the configuration of libcgroup, from file 
"/etc/cgconfig.conf"
******** BEGIN OF EXCERPT
group realtime {
	perm {
		task {
			uid = root;
			gid = audio;
		}
		admin {
			uid = root;
			gid = jobadmin;
		}
	}
	cpu {
		cpu.policy = 1;
		cpu.shares = 800;
		cpu.rt_runtime_us = 900000;
	}
	memory {
		memory.swappiness = 10;
	}
}
group usr {
  ....
}

# batch processes
group usr/batch {
	perm {
		task {
			uid = root;
			gid = users;
		}
		admin {
			uid = root;
			gid = jobadmin;
		}
	}
	cpu {
		cpu.policy = 3;
		cpu.shares = 400;
	}
	memory {
		memory.swappiness = 60;
	}
}
******* END OF EXCERPT

In cgroup "realtime" We obtain from this configuration that the user "root" is 
the owner of the cgroup's files, the admins are users in the "jobadmin" group 
and the users are the "audio" group.
the users that are members of group audio must have write permission to the 
tasks file to add jobs to this cgroup. And the members of group jobadmin need 
write permission to the cgroup control files.

Here is attached a near trivial patch to enable it.
******** BEGIN OF PATCH
--- linux-2.6.37/kernel/cgroup.c
+++ linux-2.6.37/kernel/cgroup.c	2011-01-30 15:16:00.556562499 +0100
@@ -1441,7 +1441,7 @@ static int cgroup_set_super(struct super
 static int cgroup_get_rootdir(struct super_block *sb)
 {
 	struct inode *inode =
-		cgroup_new_inode(S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR, sb);
+		cgroup_new_inode(S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR | S_IWGRP, 
sb);
 	struct dentry *dentry;
 
 	if (!inode)
@@ -2265,9 +2265,9 @@ static int cgroup_create_dir(struct cgro
  * @cft: the control file in question
  *
  * returns cft->mode if ->mode is not 0
- * returns S_IRUGO|S_IWUSR if it has both a read and a write handler
+ * returns S_IRUGO|S_IWUSR|S_IWGRP if it has both a read and a write handler
  * returns S_IRUGO if it has only a read handler
- * returns S_IWUSR if it has only a write hander
+ * returns S_IWUSR|S_IWGRP if it has only a write hander
  */
 static mode_t cgroup_file_mode(const struct cftype *cft)
 {
@@ -2281,8 +2281,10 @@ static mode_t cgroup_file_mode(const str
 		mode |= S_IRUGO;
 
 	if (cft->write || cft->write_u64 || cft->write_s64 ||
-	    cft->write_string || cft->trigger)
+	    cft->write_string || cft->trigger) {
 		mode |= S_IWUSR;
+		mode |= S_IWGRP;
+	}
 
 	return mode;
 }
@@ -3244,7 +3246,7 @@ static struct cftype files[] = {
 		.open = cgroup_tasks_open,
 		.write_u64 = cgroup_tasks_write,
 		.release = cgroup_pidlist_release,
-		.mode = S_IRUGO | S_IWUSR,
+		.mode = S_IRUGO | S_IWUSR | S_IWGRP,
 	},
 	{
 		.name = CGROUP_FILE_GENERIC_PREFIX "procs",
******** END OF PATCH

see a more complete explanation of the development and the related code in 
following URL.

http://livenet.selfip.com/?content=06utilitats-Ccgroups

http://livenet.selfip.com/ftp/debian/cgroups-daemon/

Jordi Pujol

Live never ending Tale
GNU/Linux Live forever!
http://livenet.selfip.com

View attachment "cgroups-perm-wgrp.patch" of type "text/x-patch" (1628 bytes)