From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B60BC433ED for ; Thu, 1 Apr 2021 04:37:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4009A610CA for ; Thu, 1 Apr 2021 04:37:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232800AbhDAEgn (ORCPT ); Thu, 1 Apr 2021 00:36:43 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:33168 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229539AbhDAEgi (ORCPT ); Thu, 1 Apr 2021 00:36:38 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lRp4N-00AFhJ-Tx; Wed, 31 Mar 2021 22:36:36 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=fess.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lRp4K-007N3W-EJ; Wed, 31 Mar 2021 22:36:35 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Josh Hunt Cc: Ingo Molnar , Peter Zijlstra , References: <20210401033156.7262-1-johunt@akamai.com> Date: Wed, 31 Mar 2021 23:36:28 -0500 In-Reply-To: <20210401033156.7262-1-johunt@akamai.com> (Josh Hunt's message of "Wed, 31 Mar 2021 23:31:56 -0400") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1lRp4K-007N3W-EJ;;;mid=;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/B65/rNB3ftoATqolMFHoRXiQZiFhOC5w= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH] psi: allow unprivileged users with CAP_SYS_RESOURCE to write psi files X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Josh Hunt writes: > Currently only root can write files under /proc/pressure. Relax this to > allow tasks running as unprivileged users with CAP_SYS_RESOURCE to be > able to write to these files. The test for CAP_SYS_RESOURCE really needs to be in open rather than in write. Otherwise a suid root executable could have stdout redirected into these files. Eric > Signed-off-by: Josh Hunt > --- > kernel/sched/psi.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c > index b1b00e9bd7ed..98ff7baf1ba8 100644 > --- a/kernel/sched/psi.c > +++ b/kernel/sched/psi.c > @@ -1270,6 +1270,9 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf, > if (!nbytes) > return -EINVAL; > > + if (!capable(CAP_SYS_RESOURCE)) > + return -EPERM; > + > buf_size = min(nbytes, sizeof(buf)); > if (copy_from_user(buf, user_buf, buf_size)) > return -EFAULT; > @@ -1353,9 +1356,9 @@ static int __init psi_proc_init(void) > { > if (psi_enable) { > proc_mkdir("pressure", NULL); > - proc_create("pressure/io", 0, NULL, &psi_io_proc_ops); > - proc_create("pressure/memory", 0, NULL, &psi_memory_proc_ops); > - proc_create("pressure/cpu", 0, NULL, &psi_cpu_proc_ops); > + proc_create("pressure/io", 0666, NULL, &psi_io_proc_ops); > + proc_create("pressure/memory", 0666, NULL, &psi_memory_proc_ops); > + proc_create("pressure/cpu", 0666, NULL, &psi_cpu_proc_ops); > } > return 0; > }