From patchwork Thu May 21 03:41:13 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 48843 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-la0-f71.google.com (mail-la0-f71.google.com [209.85.215.71]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 7E28921411 for ; Thu, 21 May 2015 03:41:57 +0000 (UTC) Received: by laat2 with SMTP id t2sf22970537laa.2 for ; Wed, 20 May 2015 20:41:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :list-post:list-help:list-archive:list-unsubscribe; bh=nS6DkWwMuf6SqcayASMoruD+o0eRPIP3MdFZKLewhI0=; b=fjfOKIEPUULHeC6R2cQvokFH153A4/9ZK/UcuU+9c+e0EgCZfw7A57NVATP2V7RGsS FXdBX2l8MlOhWuSAS2iNVNgZ+TcrLObGwGCJOvL0tEW8AnQtHJDJhFD7eQKjG5vFwGBV grK2F9fZjTXlMfFkIoPwLfIKFG0p5gQErZXpgFSqyjzdOIKAzMeLNXYNThgh9Wn01OxI zZpDulclz5t3kvSiNCs7k6eCRiIbM5lcPFfsrvyAHshtqaDMdhOtu5gtGN2CmU4WtzLF uh2gOrxx/nMzPOYKNQRG+N+rOufYdxNYZGV8jrB6dLG77AthF5V7zLpQrdLqMqTx9RlS O3dw== X-Gm-Message-State: ALoCoQn9ctLnEu42R6Q+513lS5m8HEk4r5/wkGJ30SsB7exy4mIuNkJmlC6r3PVk+Ph9jLBYd0a7 X-Received: by 10.112.93.203 with SMTP id cw11mr692551lbb.0.1432179716473; Wed, 20 May 2015 20:41:56 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.29.36 with SMTP id g4ls290466lah.33.gmail; Wed, 20 May 2015 20:41:56 -0700 (PDT) X-Received: by 10.153.6.36 with SMTP id cr4mr496936lad.56.1432179716263; Wed, 20 May 2015 20:41:56 -0700 (PDT) Received: from mail-lb0-f179.google.com (mail-lb0-f179.google.com. [209.85.217.179]) by mx.google.com with ESMTPS id j2si12411675lbd.98.2015.05.20.20.41.56 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 May 2015 20:41:56 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.179 as permitted sender) client-ip=209.85.217.179; Received: by lbbqq2 with SMTP id qq2so8694583lbb.3 for ; Wed, 20 May 2015 20:41:56 -0700 (PDT) X-Received: by 10.152.2.227 with SMTP id 3mr457866lax.73.1432179716127; Wed, 20 May 2015 20:41:56 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.112.108.230 with SMTP id hn6csp257994lbb; Wed, 20 May 2015 20:41:55 -0700 (PDT) X-Received: by 10.68.87.35 with SMTP id u3mr1294619pbz.127.1432179714429; Wed, 20 May 2015 20:41:54 -0700 (PDT) Received: from mail-pd0-f175.google.com (mail-pd0-f175.google.com. [209.85.192.175]) by mx.google.com with ESMTPS id a16si27902016pbu.52.2015.05.20.20.41.53 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 May 2015 20:41:54 -0700 (PDT) Received-SPF: pass (google.com: domain of john.stultz@linaro.org designates 209.85.192.175 as permitted sender) client-ip=209.85.192.175; Received: by pdfh10 with SMTP id h10so92599432pdf.3 for ; Wed, 20 May 2015 20:41:53 -0700 (PDT) X-Received: by 10.70.138.8 with SMTP id qm8mr1404086pdb.96.1432179713425; Wed, 20 May 2015 20:41:53 -0700 (PDT) Received: from localhost.localdomain (c-67-170-153-23.hsd1.or.comcast.net. [67.170.153.23]) by mx.google.com with ESMTPSA id l10sm12131773pbq.87.2015.05.20.20.41.52 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 20 May 2015 20:41:52 -0700 (PDT) From: John Stultz To: lkml Cc: Colin Cross , Tejun Heo , Li Zefan , Jonathan Corbet , cgroups@vger.kernel.org, Android Kernel Team , Rom Lemarchand , John Stultz Subject: [RFC][PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks Date: Wed, 20 May 2015 20:41:13 -0700 Message-Id: <1432179674-19154-2-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1432179674-19154-1-git-send-email-john.stultz@linaro.org> References: <1432179674-19154-1-git-send-email-john.stultz@linaro.org> X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: john.stultz@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.179 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Colin Cross Rather than using explicit euid == 0 checks when trying to move tasks into a cgroup, move permission checks into each specific cgroup subsystem. If a subsystem does not specify a 'allow_attach' handler, then we fall back to doing the checks the old way. This patch adds a 'allow_attach' handler instead of reusing the 'can_attach' handler, since if the 'can_attach' handler was reused, a new cgroup that implements 'can_attach' but not the permission checks could end up with no permission checks at all. Cc: Tejun Heo Cc: Li Zefan Cc: Jonathan Corbet Cc: cgroups@vger.kernel.org Cc: Android Kernel Team Cc: Rom Lemarchand Cc: Colin Cross Original-Author: San Mehat Signed-off-by: Colin Cross [jstultz: Rewording of commit message] Signed-off-by: John Stultz --- Documentation/cgroups/cgroups.txt | 9 +++++++++ include/linux/cgroup.h | 2 ++ kernel/cgroup.c | 39 ++++++++++++++++++++++++++++++++++++--- 3 files changed, 47 insertions(+), 3 deletions(-) diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt index f935fac..88af0f0 100644 --- a/Documentation/cgroups/cgroups.txt +++ b/Documentation/cgroups/cgroups.txt @@ -578,6 +578,15 @@ is completely unused; @cgrp->parent is still valid. (Note - can also be called for a newly-created cgroup if an error occurs after this subsystem's create() method has been called for the new cgroup). +int allow_attach(struct cgroup *cgrp, struct cgroup_taskset *tset) +(cgroup_mutex held by caller) + +Called prior to moving a task into a cgroup; if the subsystem +returns an error, this will abort the attach operation. Used +to extend the permission checks - if all subsystems in a cgroup +return 0, the attach will be allowed to proceed, even if the +default permission check (root or same user) fails. + int can_attach(struct cgroup *cgrp, struct cgroup_taskset *tset) (cgroup_mutex held by caller) diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index b9cb94c..0ea785d 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -643,6 +643,8 @@ struct cgroup_subsys { void (*css_reset)(struct cgroup_subsys_state *css); void (*css_e_css_changed)(struct cgroup_subsys_state *css); + int (*allow_attach)(struct cgroup_subsys_state *css, + struct cgroup_taskset *tset); int (*can_attach)(struct cgroup_subsys_state *css, struct cgroup_taskset *tset); void (*cancel_attach)(struct cgroup_subsys_state *css, diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 29a7b2c..57e0fd7 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2376,6 +2376,25 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp, return ret; } +static int cgroup_allow_attach(struct cgroup *cgrp, struct cgroup_taskset *tset) +{ + struct cgroup_subsys_state *css; + int i; + int ret; + + for_each_css(css, i, cgrp) { + if (css->ss->allow_attach) { + ret = css->ss->allow_attach(css, tset); + if (ret) + return ret; + } else { + return -EACCES; + } + } + + return 0; +} + /* * Find the task_struct of the task to attach by vpid and pass it along to the * function to attach either it or all tasks in its threadgroup. Will lock @@ -2414,9 +2433,23 @@ retry_find_task: if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && !uid_eq(cred->euid, tcred->suid)) { - rcu_read_unlock(); - ret = -EACCES; - goto out_unlock_cgroup; + /* + * if the default permission check fails, give each + * cgroup a chance to extend the permission check + */ + struct cgroup_taskset tset = { + .src_csets = LIST_HEAD_INIT(tset.src_csets), + .dst_csets = LIST_HEAD_INIT(tset.dst_csets), + .csets = &tset.src_csets, + }; + struct css_set *cset; + cset = task_css_set(tsk); + list_add(&cset->mg_node, &tset.src_csets); + ret = cgroup_allow_attach(cgrp, &tset); + if (ret) { + rcu_read_unlock(); + goto out_unlock_cgroup; + } } } else tsk = current;