linux-kernel - Re: [PATCH] sched: psi: fix unprivileged polling against cgroups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Oct 2023 17:49:36 +0100
From:   Luca Boccassi <bluca@...ian.org>
To:     Johannes Weiner <hannes@...xchg.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Suren Baghdasaryan <surenb@...gle.com>,
        Domenico Cerasuolo <cerasuolodomenico@...il.com>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] sched: psi: fix unprivileged polling against cgroups

On Thu, 26 Oct 2023 at 17:41, Johannes Weiner <hannes@...xchg.org> wrote:
>
> 519fabc7aaba ("psi: remove 500ms min window size limitation for
> triggers") breaks unprivileged psi polling on cgroups.
>
> Historically, we had a privilege check for polling in the open() of a
> pressure file in /proc, but were erroneously missing it for the open()
> of cgroup pressure files.
>
> When unprivileged polling was introduced in d82caa273565 ("sched/psi:
> Allow unprivileged polling of N*2s period"), it needed to filter
> privileges depending on the exact polling parameters, and as such
> moved the CAP_SYS_RESOURCE check from the proc open() callback to
> psi_trigger_create(). Both the proc files as well as cgroup files go
> through this during write(). This implicitly added the missing check
> for privileges required for HT polling for cgroups.
>
> When 519fabc7aaba ("psi: remove 500ms min window size limitation for
> triggers") followed right after to remove further restrictions on the
> RT polling window, it incorrectly assumed the cgroup privilege check
> was still missing and added it to the cgroup open(), mirroring what we
> used to do for proc files in the past.
>
> As a result, unprivileged poll requests that would be supported now
> get rejected when opening the cgroup pressure file for writing.
>
> Remove the cgroup open() check. psi_trigger_create() handles it.
>
> Fixes: 519fabc7aaba ("psi: remove 500ms min window size limitation for triggers")
> Cc: stable@...r.kernel.org # 6.5+
> Reported-by: Luca Boccassi <bluca@...ian.org>
> Signed-off-by: Johannes Weiner <hannes@...xchg.org>

Acked-by: Luca Boccassi <bluca@...ian.org>

Thank you very much for the quick fix - this was reported originally
on the systemd bug tracker by Daniel Black (I do not have an email
address):

https://github.com/systemd/systemd/issues/29723

It is very important for systemd services to be able to do this
without capabilities, as using capabilities means in turn user
namespaces cannot be used (PrivateUsers=yes in systemd parlance).

Kind regards,
Luca Boccassi