Re: [RFC][PATCH 1/4] checkpoint-restart: general infrastructure

From: Arnd Bergmann <arnd@arndb.de>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>,
	containers@lists.linux-foundation.org,
	Theodore Tso <tytso@mit.edu>,
	linux-kernel@vger.kernel.org
Subject: Re: [RFC][PATCH 1/4] checkpoint-restart: general infrastructure
Date: Mon, 11 Aug 2008 18:53:13 +0200	[thread overview]
Message-ID: <200808111853.13854.arnd@arndb.de> (raw)
In-Reply-To: <20080811152201.GB25930@us.ibm.com>

On Monday 11 August 2008, Serge E. Hallyn wrote:
> At the restart end, every resource which was checkpointed will have to
> be re-created, and permissions checked against the privilege of the
> task which did the restart.  We may end up having to make use of the new
> credentials for this.
> 
> This could become unpleasant: if an unprivileged task asked a privileged
> helper to create something for the unprivileged task to use (i.e. a
> raw socket), then the user needs to be privileged to re-created the
> resource.  But it's necessary.

Right. Of course, the hard part here will be to make it obvious to
be safe. Having to check all sorts of permissions means there will
be many opportunities for exploitable bugs.

The best way I can think of for this would be to use existing syscalls
(e.g. sched_setscheduler, setfsuid, ...) from user space whereever
possible and do only the bare minimum for the restart part in the kernel.

	Arnd <><