From patchwork Mon Oct 17 22:35:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 77866 Delivered-To: patches@linaro.org Received: by 10.140.97.247 with SMTP id m110csp602224qge; Mon, 17 Oct 2016 15:35:29 -0700 (PDT) X-Received: by 10.66.88.231 with SMTP id bj7mr33989693pab.91.1476743729409; Mon, 17 Oct 2016 15:35:29 -0700 (PDT) Return-Path: Received: from mail-pa0-x22d.google.com (mail-pa0-x22d.google.com. [2607:f8b0:400e:c03::22d]) by mx.google.com with ESMTPS id i7si32502244pfe.46.2016.10.17.15.35.29 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 17 Oct 2016 15:35:29 -0700 (PDT) Received-SPF: pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c03::22d as permitted sender) client-ip=2607:f8b0:400e:c03::22d; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c03::22d as permitted sender) smtp.mailfrom=john.stultz@linaro.org; dmarc=pass (p=NONE dis=NONE) header.from=linaro.org Received: by mail-pa0-x22d.google.com with SMTP id ry6so65637463pac.3 for ; Mon, 17 Oct 2016 15:35:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=IcPTNPYFa7NhC6YaW9p41gi51Y07szqZ4tVdDAIhTb4=; b=WWufQyC0lZ+WX8xQ0RWBd/WJkvMdBCCslnhRZxWiYdkDsO/AiBCftfYZKBn5urIhnm Wx1SnJxhCZphepRblbrwK7nGGaMiHqeUSzQaEEiDnHSYJuuMFw5Qih5YuQPY+c09npzR 6XtYlx0gfqGkKJlD+U0lunaJ1MutSsS1PfEoQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=IcPTNPYFa7NhC6YaW9p41gi51Y07szqZ4tVdDAIhTb4=; b=a2MMuAqEBVcg/TqaCE2ooy3VwXatIoflDFVb+ZfGnu90A/tjn/vP2vSKSi4vQv+MAB c0xC4KRvPTCxnkre2hW7jV6cAdm3c+20gKLOGxql0ySM4HHx9HLVRdZzTWjPKFwX67Q1 qj9CiHEPvqcWxs4m/NU4gBG/iGkBw6oTpY34mjbgt+BehIn+xx3x3AyBmixVF9A6I0He lr8tlTRFqRJlO3rpv29htiAd4z2VmgM0qli0ude/+21CoaPx3szziU2x35MfjQtcsq3l tejpiOfsaQ0PAPKFF8/FZIovF0N/+w6lM6fcaRPBosoEaS1tO1aSTH49WzuMh5k896q1 LuWw== X-Gm-Message-State: AA6/9RnVn8+NEozA/3OMZKPf3MQYh77NA0J7dAzqKgoB43L15rlGI4b5N/sRpMK9l+CB6dMc64g= X-Received: by 10.66.88.40 with SMTP id bd8mr34237675pab.6.1476743729069; Mon, 17 Oct 2016 15:35:29 -0700 (PDT) Return-Path: Received: from localhost.localdomain ([2601:1c2:1002:83f0:4e72:b9ff:fe99:466a]) by smtp.gmail.com with ESMTPSA id a4sm50593984pax.8.2016.10.17.15.35.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 17 Oct 2016 15:35:28 -0700 (PDT) From: John Stultz To: lkml Cc: John Stultz , Tejun Heo , Li Zefan , Jonathan Corbet , cgroups@vger.kernel.org, Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Ricky Zhou , Dmitry Torokhov , Todd Kjos , Christian Poetzsch , Amit Pundir , "Serge E . Hallyn" , linux-api@vger.kernel.org Subject: [PATCH] cgroup: Add new capability to allow a process to migrate other tasks between cgroups Date: Mon, 17 Oct 2016 15:35:24 -0700 Message-Id: <1476743724-9104-1-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 2.7.4 This patch adds CAP_GROUP_MIGRATE and logic to allows a process to migrate other tasks between cgroups. In Android (where this feature originated), the ActivityManager tracks various application states (TOP_APP, FOREGROUND, BACKGROUND, SYSTEM, etc), and then as applications change states, the SchedPolicy logic will migrate the application tasks between different cgroups used to control the different application states (for example, there is a background cpuset cgroup which can limit background tasks to stay on one low-power cpu, and the bg_non_interactive cpuctrl cgroup can then further limit those background tasks to a small percentage of that one cpu's cpu time). However, for security reasons, Android doesn't want to make the system_server (the process that runs the ActivityManager and SchedPolicy logic), run as root. So in the Android common.git kernel, they have some logic to allow cgroups to loosen their permissions so CAP_SYS_NICE tasks can migrate other tasks between cgroups. The approach taken there overloads CAP_SYS_NICE a bit much, and is maybe more complicated then needed. So this patch, as suggested by Tejun, simply adds a new process capability flag (CAP_CGROUP_MIGRATE), and uses it when checking if a task can migrate other tasks between cgroups. I've tested this with AOSP master (though its a bit hacked in as I still need to properly get the selinux bits aware of the new capability bit) with selinux set to permissive and it seems to be working well. Thoughts and feedback would be appreciated! Cc: Tejun Heo Cc: Li Zefan Cc: Jonathan Corbet Cc: cgroups@vger.kernel.org Cc: Android Kernel Team Cc: Rom Lemarchand Cc: Colin Cross Cc: Dmitry Shmidt Cc: Ricky Zhou Cc: Dmitry Torokhov Cc: Todd Kjos Cc: Christian Poetzsch Cc: Amit Pundir Cc: Serge E. Hallyn Cc: linux-api@vger.kernel.org Signed-off-by: John Stultz --- v2: Renamed to just CAP_CGROUP_MIGRATE as reccomended by Tejun --- include/uapi/linux/capability.h | 5 ++++- kernel/cgroup.c | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) -- 2.7.4 diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h index 49bc062..44d7ff4 100644 --- a/include/uapi/linux/capability.h +++ b/include/uapi/linux/capability.h @@ -349,8 +349,11 @@ struct vfs_cap_data { #define CAP_AUDIT_READ 37 +/* Allow migrating tasks between cgroups */ -#define CAP_LAST_CAP CAP_AUDIT_READ +#define CAP_CGROUP_MIGRATE 38 + +#define CAP_LAST_CAP CAP_CGROUP_MIGRATE #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 85bc9be..09f84d2 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2856,7 +2856,8 @@ static int cgroup_procs_write_permission(struct task_struct *task, */ if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && - !uid_eq(cred->euid, tcred->suid)) + !uid_eq(cred->euid, tcred->suid) && + !ns_capable(tcred->user_ns, CAP_CGROUP_MIGRATE)) ret = -EACCES; if (!ret && cgroup_on_dfl(dst_cgrp)) {