linux-kernel - Re: [RFC][PATCH 0/3] fork: Add the ability to create tasks with given pids

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111121225019.GQ25776@google.com>
Date:	Mon, 21 Nov 2011 14:50:19 -0800
From:	Tejun Heo <tj@...nel.org>
To:	Pavel Emelyanov <xemul@...allels.com>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alan Cox <alan@...ux.intel.com>,
	Roland McGrath <roland@...k.frob.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Cyrill Gorcunov <gorcunov@...nvz.org>,
	James Bottomley <jbottomley@...allels.com>
Subject: Re: [RFC][PATCH 0/3] fork: Add the ability to create tasks with
 given pids

Hello, Pavel.

On Mon, Nov 21, 2011 at 01:15:02PM +0400, Pavel Emelyanov wrote:
> Then I introduce the kernel.ns_last_pid sysctl that is allows for MAY_OPEN | MAP_WRITE for
> the namespace's init only and allows for MAY_WRITE for anyone else. Thus, if we want to
> write to this file from non-init task it must have the respective fd inherited from the init
> on fork. It works OK for checkpoint/restore.
> 
> The patch is:
> 
> 
> diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
> index e9c9adc..3686a07 100644
> --- a/kernel/pid_namespace.c
> +++ b/kernel/pid_namespace.c
> @@ -15,6 +15,7 @@
>  #include <linux/acct.h>
>  #include <linux/slab.h>
>  #include <linux/proc_fs.h>
> +#include <linux/sysctl.h>
>  
>  #define BITS_PER_PAGE		(PAGE_SIZE*8)
>  
> @@ -191,9 +192,54 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
>  	return;
>  }
>  
> +static int pid_ns_ctl_permissions(struct nsproxy *namespaces,
> +			struct ctl_table *table, int op)
> +{
> +	int mode = 0644;
> +
> +	if ((op & MAY_OPEN) &&
> +			current != namespaces->pid_ns->child_reaper)
> +		/*
> +		 * Writing to this sysctl is allowed only for init
> +		 * and to whoever it grands the open file
> +		 */
> +		mode &= ~0222;
> +
> +	return sysctl_test_perm(mode, op);
> +}
> +
> +static struct ctl_table_root pid_ns_root = {
> +	.permissions = pid_ns_ctl_permissions,
> +};

Hmmm... I hope this could be prettier.  I'm having trouble following
where the MAY_OPEN comes from.  Can you please explain?  Can't we for
now allow this for root and then later allow CAP_CHECKPOINT that
Cyrill suggested?  Or do we want to allow setting pids even w/o CR for
NS creator?

> +static int pid_ns_ctl_handler(struct ctl_table *table, int write,
> +		     void __user *buffer, size_t *lenp, loff_t *ppos)
> +{
> +	struct ctl_table tmp = *table;
> +	tmp.data = &current->nsproxy->pid_ns->last_pid;
> +	return proc_dointvec(&tmp, write, buffer, lenp, ppos);
> +}

Probably better to call set_last_pid() on write path instead?

> Well, after a bit more thinking I found one more pros for this
> sysctl - when restoring a container we'll have the possibility to
> set the last_pid to what we want to prevent the pids reuse after the
> restore.

Hmmm... I personally like this one better.  Restoring multilevel pids
would be more tedious but should still be possible and I really like
that it's staying out of clone path and all modifications are to ns
and pid code.  Oleg, what do you think?

Thank you.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/