No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tejun Heo 691a0fd625 cgroup: Use open-time credentials for process migraton perm checks
commit 1756d7994ad85c2479af6ae5a9750b92324685af upstream.

cgroup process migration permission checks are performed at write time as
whether a given operation is allowed or not is dependent on the content of
the write - the PID. This currently uses current's credentials which is a
potential security weakness as it may allow scenarios where a less
privileged process tricks a more privileged one into writing into a fd that
it created.

This patch makes both cgroup2 and cgroup1 process migration interfaces to
use the credentials saved at the time of open (file->f_cred) instead of
current's.

Reported-by: "Eric W. Biederman" <ebiederm@xmission.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Fixes: 187fe84067 ("cgroup: require write perm on common ancestor when moving processes on the default hierarchy")
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[OP: backport to 5.4: apply original __cgroup_procs_write() changes to
cgroup_threads_write() and cgroup_procs_write()]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-15 14:18:41 +02:00
arch arm64: module: remove (NOLOAD) from linker script 2022-04-15 14:18:40 +02:00
block Revert "Revert "block, bfq: honor already-setup queue merges"" 2022-04-15 14:18:23 +02:00
certs
crypto
Documentation dt-bindings: spi: mxic: The interrupt property is not mandatory 2022-04-15 14:18:30 +02:00
drivers drm/amdkfd: Fix -Wstrict-prototypes from amdgpu_amdkfd_gfx_10_0_get_functions() 2022-04-15 14:18:41 +02:00
fs io_uring: fix fs->users overflow 2022-04-15 14:18:41 +02:00
include mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning 2022-04-15 14:18:40 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc
kernel cgroup: Use open-time credentials for process migraton perm checks 2022-04-15 14:18:41 +02:00
lib lz4: fix LZ4_decompress_safe_partial read out of bound 2022-04-15 14:18:39 +02:00
LICENSES
mm mm: don't skip swap entry even if zap_details specified 2022-04-15 14:18:40 +02:00
net SUNRPC: Handle low memory situations in call_status() 2022-04-15 14:18:38 +02:00
samples
scripts
security Fix incorrect type in assignment of ipv6 port for audit 2022-04-15 14:18:22 +02:00
sound ASoC: topology: Allow TLV control to be either read or write 2022-04-15 14:18:30 +02:00
tools tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts 2022-04-15 14:18:40 +02:00
usr
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.