From: Tejun Heo <tj@kernel.org>
To: torvalds@linuxfoundation.org, ebiederm@xmission.com,
mkoutny@suse.com, axboe@kernel.dk, keescook@chromium.org,
oleg@redhat.com, peterz@infradead.org, tglx@linutronix.de,
jnewsome@torproject.org, legion@kernel.org, luto@amacapital.net,
jannh@google.com
Cc: linux-kernel@vger.kernel.org, security@kernel.org, kernel-team@fb.com
Subject: [PATCHSET cgroup/for-5.16-fixes] cgroup: Use open-time creds and namespace for migration perm checks
Date: Thu, 9 Dec 2021 11:47:01 -1000 [thread overview]
Message-ID: <20211209214707.805617-1-tj@kernel.org> (raw)
Hello,
cgroup process migration permission checks are performed at write time as
whether a given operation is allowed or not is dependent on the content of
the write - the PID. This currently uses current's credentials and cgroup
namespace which is a potential security weakness as it may allow scenarios
where a less privileged process tricks a more privileged one into writing
into a fd that it created.
This patchset make the perm checks use credentials and cgroup namespace
stored at the time of open and contains the following patches.
0001-cgroup-Use-open-time-credentials-for-process-migrato.patch
0002-cgroup-Allocate-cgroup_file_ctx-for-kernfs_open_file.patch
0003-cgroup-Use-open-time-cgroup-namespace-for-process-mi.patch
0004-selftests-cgroup-Make-cg_create-use-0755-for-permiss.patch
0005-selftests-cgroup-Test-open-time-credential-usage-for.patch
0006-selftests-cgroup-Test-open-time-cgroup-namespace-usa.patch
The patchset is also available in the following git branch.
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git review-migration-perms
Michal, does this also fix the original bug you were trying to fix? For now,
I didn't add Fixes / stable tags. If ppl are okay with the patchset, I'll
route it through cgroup/for-5.16-fixes.
diffstat follows. Thanks.
kernel/cgroup/cgroup-internal.h | 14 ++++
kernel/cgroup/cgroup-v1.c | 7 +-
kernel/cgroup/cgroup.c | 82 ++++++++++++++++++-------
tools/testing/selftests/cgroup/cgroup_util.c | 2
tools/testing/selftests/cgroup/test_core.c | 165 ++++++++++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 244 insertions(+), 26 deletions(-)
--
tejun
next reply other threads:[~2021-12-09 21:47 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-09 21:47 Tejun Heo [this message]
2021-12-09 21:47 ` [PATCH 1/6] cgroup: Use open-time credentials for process migraton perm checks Tejun Heo
2021-12-10 17:41 ` Linus Torvalds
2021-12-09 21:47 ` [PATCH 2/6] cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv Tejun Heo
2021-12-10 17:53 ` Linus Torvalds
2021-12-10 18:38 ` Tejun Heo
2021-12-10 18:45 ` Linus Torvalds
2021-12-10 19:06 ` Tejun Heo
2021-12-10 19:14 ` Linus Torvalds
2021-12-09 21:47 ` [PATCH 3/6] cgroup: Use open-time cgroup namespace for process migration perm checks Tejun Heo
2021-12-09 21:47 ` [PATCH 4/6] selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 Tejun Heo
2021-12-09 21:47 ` [PATCH 5/6] selftests: cgroup: Test open-time credential usage for migration checks Tejun Heo
2021-12-09 21:47 ` [PATCH 6/6] selftests: cgroup: Test open-time cgroup namespace " Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211209214707.805617-1-tj@kernel.org \
--to=tj@kernel.org \
--cc=axboe@kernel.dk \
--cc=ebiederm@xmission.com \
--cc=jannh@google.com \
--cc=jnewsome@torproject.org \
--cc=keescook@chromium.org \
--cc=kernel-team@fb.com \
--cc=legion@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mkoutny@suse.com \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=security@kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.