linux-kernel - PSI poll() support for unprivileged users

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200424153859.GA1481119@chrisdown.name>
Date:   Fri, 24 Apr 2020 16:38:59 +0100
From:   Chris Down <chris@...isdown.name>
To:     Suren Baghdasaryan <surenb@...gle.com>
Cc:     Johannes Weiner <hannes@...xchg.org>,
        Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org
Subject: PSI poll() support for unprivileged users

Hi Suren,

I noticed that one restriction of the PSI poll() interface is that currently 
only root can set up new triggers. Talking to Johannes, it seems the reason for 
this was that you end up with a realtime kernel thread for every cgroup where a 
trigger is set, and this could be used by unprivileged users to sap resources.

I'm building a userspace daemon for desktop users which notifies based on 
pressure events, and it's particularly janky to ask people to run such a 
notifier as root: the notification mechanism is usually tied to the user's 
display server auth, and the surrounding environment is generally pretty 
important to maintain. In addition to this, just in general this doesn't feel 
like the kind of feature that by its nature needs to be restricted to root -- 
it seems reasonable that there would be unprivileged users which want to use 
this, and that not using RT threads would be acceptable in that scenario.

Have you considered making the per-cgroup RT threads optional? If the 
processing isn't done in the FIFO kthread for unprivileged users, I think it 
should be safe to allow them to write to pressure files (perhaps with some 
additional limits or restrictions on things like the interval, as needed).

Thanks!

Chris