From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1426287AbcFHXJG (ORCPT ); Wed, 8 Jun 2016 19:09:06 -0400 Received: from mail-pa0-f45.google.com ([209.85.220.45]:32884 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1424499AbcFHXJE (ORCPT ); Wed, 8 Jun 2016 19:09:04 -0400 From: Eric Caruso To: Thomas Gleixner Cc: Todd Poynor , linux-kernel@vger.kernel.org, Eric Caruso Subject: [PATCH] fs/timerfd: reject ALARM timerfds without CAP_WAKE_ALARM Date: Wed, 8 Jun 2016 16:08:59 -0700 Message-Id: <1465427339-96209-1-git-send-email-ejcaruso@chromium.org> X-Mailer: git-send-email 2.1.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Caruso timerfd gives processes a way to set wake alarms, but unlike timers made using timer_create, timerfds don't check whether the process has CAP_WAKE_ALARM before setting alarm-time timers. CAP_WAKE_ALARM is supposed to gate this behavior and so it makes sense that we should deny permission to create such timerfds if the process doesn't have this capability. Signed-off-by: Eric Caruso --- fs/timerfd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/timerfd.c b/fs/timerfd.c index 053818d..9ae4abb 100644 --- a/fs/timerfd.c +++ b/fs/timerfd.c @@ -390,6 +390,11 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags) clockid != CLOCK_BOOTTIME_ALARM)) return -EINVAL; + if (!capable(CAP_WAKE_ALARM) && + (clockid == CLOCK_REALTIME_ALARM || + clockid == CLOCK_BOOTTIME_ALARM)) + return -EPERM; + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); if (!ctx) return -ENOMEM; @@ -433,6 +438,11 @@ static int do_timerfd_settime(int ufd, int flags, return ret; ctx = f.file->private_data; + if (!capable(CAP_WAKE_ALARM) && isalarm(ctx)) { + fdput(f); + return -EPERM; + } + timerfd_setup_cancel(ctx, flags); /* -- 2.8.0.rc3.226.g39d4020