linux-kernel - [RFC 1/2] cgroup, kthread: do not allow moving kthreads out of the root cgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171012173723.13381-1-guro@fb.com>
Date:   Thu, 12 Oct 2017 18:37:22 +0100
From:   Roman Gushchin <guro@...com>
To:     <linux-kernel@...r.kernel.org>
CC:     Roman Gushchin <guro@...com>, Tejun Heo <tj@...nel.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>, Chris Mason <clm@...com>,
        <kernel-team@...com>
Subject: [RFC 1/2] cgroup, kthread: do not allow moving kthreads out of the root cgroup

Attaching kernel threads to a non-root cgroup is generally a bad
idea. Kernel threads are generally performing the work required
to keep the system working and healthy, and applying various
resource limits may affect system stability and performance.

Some examples of dangerous behavior are limiting CPU time available
to rcu stuff, memory limits applied to almost all kthreads, etc.

To prevent this dangerous behavior, let's deny all kthread
movements between cgroups. Right now only kthreads bounded
to CPUs are not allowed to move, which is not sufficient.

If there are examples of kthreads which can be limited,
and it's guaranteed to be safe, we can allow explicit
exceptions further.

Signed-off-by: Roman Gushchin <guro@...com>
Cc: Tejun Heo <tj@...nel.org>
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Peter Zijlstra (Intel) <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Chris Mason <clm@...com>
Cc: kernel-team@...com
Cc: linux-kernel@...r.kernel.org
---
 kernel/cgroup/cgroup.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c7086c8835da..a3d7a1b5720d 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2629,12 +2629,12 @@ struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup)
 		tsk = tsk->group_leader;
 
 	/*
-	 * kthreads may acquire PF_NO_SETAFFINITY during initialization.
-	 * If userland migrates such a kthread to a non-root cgroup, it can
+	 * If userland migrates a kthread to a non-root cgroup, it can
 	 * become trapped in a cpuset, or RT kthread may be born in a
-	 * cgroup with no rt_runtime allocated.  Just say no.
+	 * cgroup with no rt_runtime allocated, or it can suffer from
+	 * memory shortage, etc. Just say no.
 	 */
-	if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) {
+	if (tsk->flags & (PF_KTHREAD | PF_NO_SETAFFINITY)) {
 		tsk = ERR_PTR(-EINVAL);
 		goto out_unlock_threadgroup;
 	}
-- 
2.13.6