From patchwork Tue Dec 13 01:39:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 87785 Delivered-To: patches@linaro.org Received: by 10.140.20.101 with SMTP id 92csp1962749qgi; Mon, 12 Dec 2016 17:39:11 -0800 (PST) X-Received: by 10.98.133.9 with SMTP id u9mr99050232pfd.137.1481593151008; Mon, 12 Dec 2016 17:39:11 -0800 (PST) Return-Path: Received: from mail-pg0-x231.google.com (mail-pg0-x231.google.com. [2607:f8b0:400e:c05::231]) by mx.google.com with ESMTPS id m29si45711778pgd.248.2016.12.12.17.39.10 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 12 Dec 2016 17:39:10 -0800 (PST) Received-SPF: pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c05::231 as permitted sender) client-ip=2607:f8b0:400e:c05::231; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c05::231 as permitted sender) smtp.mailfrom=john.stultz@linaro.org; dmarc=pass (p=NONE dis=NONE) header.from=linaro.org Received: by mail-pg0-x231.google.com with SMTP id p66so41471972pga.2 for ; Mon, 12 Dec 2016 17:39:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=sZpfRMlU+cPrR06RogZHc3KMNtFRSSfeu6smfh/3n4A=; b=YP6dfeI5MzadmCdfhxQVUiYofUOEMoh4tvrfJFiomsBu8pEjxSfyAqiEDFpur7ZqGz /D9CL5qowy5F49KkdEZQ0Yje+ZrDbvzdTZSd4Ol0jHDDT6NinuDkmwthABNMCZnTY6+x 0VdgjIUamfIZB0jPjvqd3mibcXmKT2PjxZWoE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=sZpfRMlU+cPrR06RogZHc3KMNtFRSSfeu6smfh/3n4A=; b=Jl6QZSJBlJUrfIS4vyV/6GUg9I3tFOm6L06f4UZw2x8mCKJx9jiL6gO2id58HY0zn2 vLu+tWFpcIG8NKYTgzKJlVNP3y3U4sME6soDmPdWi3sUafFclRCNqcQ3Z7AlAhptR5IQ UANOo2OYyRsDpietJbh1Fdz7CAoKm+5OulaSTkX4/lPR6pbvKsTgp1tJEPobR+7APMzY Z/soDvltaJL4Nn6e8eMManmqDdQvwu/aODiGDa5TgaZ9v9fWZ7yCvBzoyj101ERJk3aA hlSIW0M6gp04mNHkqDUGeRD4y4NG97W28c6/OjGEFpQytb99zmjlNUTGksIIPrFv8f0L yauw== X-Gm-Message-State: AKaTC01Gk3VxBxuFpv3YDmz6SH6aOrQb0JplkGsF0LkyJsEjav2A1iya0gDTa7Gt8J+D9ybSROA= X-Received: by 10.98.252.75 with SMTP id e72mr37876004pfh.6.1481593150577; Mon, 12 Dec 2016 17:39:10 -0800 (PST) Return-Path: Received: from localhost.localdomain ([2601:1c2:1002:83f0:4e72:b9ff:fe99:466a]) by smtp.gmail.com with ESMTPSA id w17sm78628345pgm.18.2016.12.12.17.39.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 12 Dec 2016 17:39:09 -0800 (PST) From: John Stultz To: lkml Cc: John Stultz , Tejun Heo , Li Zefan , Jonathan Corbet , cgroups@vger.kernel.org, Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , Andy Lutomirski , linux-api@vger.kernel.org Subject: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups Date: Mon, 12 Dec 2016 17:39:03 -0800 Message-Id: <1481593143-18756-1-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 2.7.4 This patch adds CAP_GROUP_MIGRATE and logic to allows a process to migrate other tasks between cgroups. In Android (where this feature originated), the ActivityManager tracks various application states (TOP_APP, FOREGROUND, BACKGROUND, SYSTEM, etc), and then as applications change states, the SchedPolicy logic will migrate the application tasks between different cgroups used to control the different application states (for example, there is a background cpuset cgroup which can limit background tasks to stay on one low-power cpu, and the bg_non_interactive cpuctrl cgroup can then further limit those background tasks to a small percentage of that one cpu's cpu time). However, for security reasons, Android doesn't want to make the system_server (the process that runs the ActivityManager and SchedPolicy logic), run as root. So in the Android common.git kernel, they have some logic to allow cgroups to loosen their permissions so CAP_SYS_NICE tasks can migrate other tasks between cgroups. I feel the approach taken there overloads CAP_SYS_NICE a bit much for non-android environments. Efforts to re-use CAP_SYS_RESOURCE for this purpose (which Android has since adopted) was also stymied by concerns about risks from future cgroups that could be considered "dangerous" by how they might change system semantics. So to avoid overlapping usage, this patch adds a brand new process capability flag (CAP_CGROUP_MIGRATE), and uses it when checking if a task can migrate other tasks between cgroups. I've tested this with AOSP master (though its a bit hacked in as I still need to properly get the selinux bits aware of the new capability bit) with selinux set to permissive and it seems to be working well. Thoughts and feedback would be appreciated! Cc: Tejun Heo Cc: Li Zefan Cc: Jonathan Corbet Cc: cgroups@vger.kernel.org Cc: Android Kernel Team Cc: Rom Lemarchand Cc: Colin Cross Cc: Dmitry Shmidt Cc: Todd Kjos Cc: Christian Poetzsch Cc: Amit Pundir Cc: Dmitry Torokhov Cc: Kees Cook Cc: Serge E. Hallyn Cc: Andy Lutomirski Cc: linux-api@vger.kernel.org Acked-by: Serge Hallyn Signed-off-by: John Stultz --- v2: Renamed to just CAP_CGROUP_MIGRATE as reccomended by Tejun v3: Switched to just using CAP_SYS_RESOURCE as suggested by Michael v4: Send out properly folded down version of the patch. :P v5: Switch back to CAP_CGROUP_MIGRATE due to concerns from Andy --- include/uapi/linux/capability.h | 5 ++++- kernel/cgroup.c | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) -- 2.7.4 diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h index 49bc062..32d3829 100644 --- a/include/uapi/linux/capability.h +++ b/include/uapi/linux/capability.h @@ -349,8 +349,11 @@ struct vfs_cap_data { #define CAP_AUDIT_READ 37 +/* Allow migration of other tasks between cgroups */ -#define CAP_LAST_CAP CAP_AUDIT_READ +#define CAP_CGROUP_MIGRATE 38 + +#define CAP_LAST_CAP CAP_CGROUP_MIGRATE #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 2ee9ec3..784f115 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2856,7 +2856,8 @@ static int cgroup_procs_write_permission(struct task_struct *task, */ if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && - !uid_eq(cred->euid, tcred->suid)) + !uid_eq(cred->euid, tcred->suid) && + !ns_capable(tcred->user_ns, CAP_CGROUP_MIGRATE)) ret = -EACCES; if (!ret && cgroup_on_dfl(dst_cgrp)) {