linux-kernel - Re: adjust /proc/PID/oom_score_adj with CAP_SYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG5DWoidrQiWJpcyzoXseXc8F2h2oLzBbN16FtGQBSTbPtSiGg@mail.gmail.com>
Date:	Sun, 20 Oct 2013 14:10:56 +0400
From:	Azat Khuzhin <a.khuzhin@...rush.com>
To:	open list <linux-kernel@...r.kernel.org>
Subject: Re: adjust /proc/PID/oom_score_adj with CAP_SYS_RESOURCE

On Sun, Oct 20, 2013 at 12:33 AM, Azat Khuzhin <a.khuzhin@...rush.com> wrote:
> Recently I needed in adjusting /proc/PID/oom_score_adj to disable oom killer,
> but I didn't want to add suid/or run from root that binary.
>
> I decided to use CAP_SYS_RESOURCE. However it didn't work.
>
> I gdb/strace/printk a lot, and finally found the reason,
> the process can't open this file for writing because pid_revalidate()
> change i_uid/i_gid for it to GLOBAL_ROOT_UID/GID.

Here is some more information:

For binary with CAP_SYS_RESOURCE we have
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 204
(gdb) p (task->mm->flags & 3)
$86 = 0
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 0
$87 = 0

For binary without:
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 205
(gdb) p (task->mm->flags & 3)
$86 = 1
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 1
$87 = 1

(Where 3 is MMF_DUMPABLE_MASK.)
In pid_revalidate() checks does $87 != 0, if so, set i_{uid,gid} from
cred, otherwise set it to 0.

And that's why process can open "oom_score_adj" without capabilities
(but can't write to it)

> And to bypass this check I must to use CAP_DAC_OVERRIDE, which is not so good,
> because this will allow more capabilities than I need for that binary.
>
> Is this works by design,
> and/or is there another way to do this without suid/root?
>
> Thanks!
>
> --
> Respectfully
> Azat Khuzhin



-- 
Respectfully
Azat Khuzhin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/