Adrian Reber
ef8a66d0ee
UPSTREAM: capabilities: Introduce CAP_CHECKPOINT_RESTORE ...
This patch introduces CAP_CHECKPOINT_RESTORE, a new capability facilitating
checkpoint/restore for non-root users.
Over the last years, The CRIU (Checkpoint/Restore In Userspace) team has
been asked numerous times if it is possible to checkpoint/restore a
process as non-root. The answer usually was: 'almost'.
The main blocker to restore a process as non-root was to control the PID
of the restored process. This feature available via the clone3 system
call, or via /proc/sys/kernel/ns_last_pid is unfortunately guarded by
CAP_SYS_ADMIN.
In the past two years, requests for non-root checkpoint/restore have
increased due to the following use cases:
* Checkpoint/Restore in an HPC environment in combination with a
resource manager distributing jobs where users are always running as
non-root. There is a desire to provide a way to checkpoint and
restore long running jobs.
* Container migration as non-root
* We have been in contact with JVM developers who are integrating
CRIU into a Java VM to decrease the startup time. These
checkpoint/restore applications are not meant to be running with
CAP_SYS_ADMIN.
We have seen the following workarounds:
* Use a setuid wrapper around CRIU:
See https://github.com/FredHutch/slurm-examples/blob/master/checkpointer/lib/checkpointer/checkpointer-suid.c
* Use a setuid helper that writes to ns_last_pid.
Unfortunately, this helper delegation technique is impossible to use
with clone3, and is thus prone to races.
See https://github.com/twosigma/set_ns_last_pid
* Cycle through PIDs with fork() until the desired PID is reached:
This has been demonstrated to work with cycling rates of 100,000 PIDs/s
See https://github.com/twosigma/set_ns_last_pid
* Patch out the CAP_SYS_ADMIN check from the kernel
* Run the desired application in a new user and PID namespace to provide
a local CAP_SYS_ADMIN for controlling PIDs. This technique has limited
use in typical container environments (e.g., Kubernetes) as /proc is
typically protected with read-only layers (e.g., /proc/sys) for
hardening purposes. Read-only layers prevent additional /proc mounts
(due to proc's SB_I_USERNS_VISIBLE property), making the use of new
PID namespaces limited as certain applications need access to /proc
matching their PID namespace.
The introduced capability allows to:
* Control PIDs when the current user is CAP_CHECKPOINT_RESTORE capable
for the corresponding PID namespace via ns_last_pid/clone3.
* Open files in /proc/pid/map_files when the current user is
CAP_CHECKPOINT_RESTORE capable in the root namespace, useful for
recovering files that are unreachable via the file system such as
deleted files, or memfd files.
See corresponding selftest for an example with clone3().
Change-Id: Ia9ae3fc9a698e37774be945bac5a7d2a0d640cbc
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20200719100418.2112740-2-areber@redhat.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: ralph950412 <ralph950412@gmail.com>
2026-07-09 09:06:38 -04:00
firmware: meson_sm: Rework driver as a proper platform driver
2024-04-13 12:51:26 +02:00
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
2025-10-29 13:59:50 +01:00
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-06-04 14:32:33 +02:00
RDMA/mlx5: Enforce same type port association for multiport RoCE
2025-01-09 13:23:34 +01:00
mmc: sdhci-msm: Disable partial_init and clk-scaling to avoid RED error
2024-04-18 10:46:06 +05:30
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
qed: Improve the stack space of filter_config()
2024-08-19 05:33:30 +02:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
UPSTREAM: fork: extend clone3() to support setting a PID
2026-07-09 09:06:38 -04:00
soc: qcom: mdt_loader: Read hash from firmware blob
2024-08-08 16:32:23 -05:00
Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
2024-11-21 22:00:36 +00:00
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
2024-12-14 19:44:42 +01:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
UPSTREAM: fs: add LSM-supporting anon-inode interface
2025-02-20 04:17:45 +02:00
ata: libata-scsi: Fix system suspend for a security locked drive
2025-12-03 12:45:21 +01:00
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
2025-09-04 14:05:54 +02:00
writeback: fix false warning in inode_to_wb()
2025-05-02 07:39:19 +02:00
Revert "coredump: hand a pidfd to the usermode coredump helper"
2025-06-05 07:57:32 +00:00
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
2024-09-04 13:14:50 +02:00
Merge 5.4.287 into android11-5.4-lts
2024-12-16 10:50:16 +00:00
UPSTREAM: bpf: Fix potentially incorrect results with bpf_get_local_storage()
2026-01-14 18:12:57 -08:00
UPSTREAM: bpf: Introduce SK_LOOKUP program type with a dedicated attach point
2026-01-14 18:12:05 -08:00
ANDROID: add kabi padding for bpf structures
2026-02-01 20:44:47 -08:00
UPSTREAM: bpf: Split bpf_local_storage to bpf_sk_storage
2026-01-14 18:12:20 -08:00
UPSTREAM: bpf: Implement bpf_local_storage for inodes
2026-01-14 18:12:21 -08:00
BACKPORT: ANDROID: fuse-bpf: Use fuse_bpf_args in uapi
2026-05-08 21:46:17 +02:00
ANDROID: add kabi padding for bpf_verifier structure
2026-02-01 20:44:56 -08:00
UPSTREAM: bpfilter: switch bpfilter_ip_set_sockopt to sockptr_t
2026-02-01 20:44:55 -08:00
UPSTREAM: bpf: Introduce bpf_per_cpu_ptr()
2026-01-14 18:12:39 -08:00
BACKPORT: btf: Add BTF_ID_LIST_SINGLE macro
2026-01-14 18:12:31 -08:00
UPSTREAM: capabilities: Introduce CAP_CHECKPOINT_RESTORE
2026-07-09 09:06:38 -04:00
UPSTREAM: mm: memcontrol: recursive memory.low protection
2026-01-14 18:13:12 -08:00
UPSTREAM: cgroup: use cgrp->kn->id as the cgroup ID
2025-12-23 13:36:09 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: epoll: wire up syscall epoll_pwait2
2025-12-22 07:42:50 +02:00
Fix gcc 4.9 build issue in 5.4.y
2024-08-19 05:33:53 +02:00
This is the 5.4.302 stable release
2025-12-11 09:41:30 +00:00
UPSTREAM: bpf, net: Rework cookie generator as per-cpu one
2026-01-14 18:12:39 -08:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
BACKPORT: crypto: lib/sha1 - rename "sha" to "sha1"
2025-12-23 13:36:17 -08:00
UPSTREAM: dax, pmem: Add a dax operation zero_page_range
2026-05-08 21:46:12 +02:00
This is the 5.4.283 stable release
2024-09-06 11:18:13 +00:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
Merge android11-5.4.295(387dbb9) into msm-5.4
2025-09-29 05:22:53 -07:00
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
2024-02-23 08:25:06 +01:00
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
2024-12-14 19:44:55 +01:00
ethernet: Add helper for assigning packet type when dest address does not match device address
2024-05-02 16:18:36 +02:00
BACKPORT: bpf: Add support for BTF pointers to x86 JIT
2025-12-23 13:35:36 -08:00
UPSTREAM: close_range(): fix the logics in descriptor table trimming
2025-12-22 04:28:18 +02:00
UPSTREAM: inet6: Run SK_LOOKUP BPF program on socket lookup
2026-01-14 18:13:17 -08:00
objtool: Add support for intra-function calls
2024-04-13 12:51:29 +02:00
BACKPORT: vfs: add vfs_iocb_iter_[read|write] helper functions
2026-05-08 21:46:16 +02:00
UPSTREAM: fuse: reject options on reconfigure via fsconfig(2)
2026-05-08 21:46:11 +02:00
This is the 5.4.280 stable release
2024-07-19 13:19:29 +00:00
ftrace: Let ftrace_enable_sysctl take a kernel pointer buffer
2026-02-01 20:38:01 -08:00
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
gpu: host1x: mipi: Update tegra_mipi_request() to be node based
2024-03-26 18:22:18 -04:00
reverting enum-conversion, Handle CPU state and all USB patches
2025-09-29 11:14:00 +05:30
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
Revert "mm: provide speculative fault infrastructure"
2025-05-24 05:44:05 +00:00
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
2025-01-09 13:23:33 +01:00
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
2024-09-12 11:03:50 +02:00
clockevents/drivers/i8253: Fix stop sequence for timer 0
2025-04-10 14:29:34 +02:00
net: bridge: Fix for co-located mode
2025-12-01 04:15:06 -08:00
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
2025-08-28 16:21:27 +02:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
iommu: Fix invalid access in av8l_fast_unmap_public
2025-04-17 19:01:13 +05:30
Merge android11-5.4.281 ( d62984a) into msm-5.4
2024-10-29 01:43:17 -07:00
msm: ipa3: change variable name for indication of
2024-03-13 08:33:14 -07:00
BACKPORT: net: change accept_ra_min_rtr_lft to affect all RA lifetimes
2026-05-07 10:16:30 -04:00
Revert "genirq: Allow irq_chip registration functions to take a const irq_chip"
2024-08-30 10:05:12 +00:00
UPSTREAM: irq_work: Convert flags to atomic_t
2025-12-23 13:35:39 -08:00
Revert "genirq: Allow the PM device to originate from irq domain"
2024-08-30 10:05:12 +00:00
jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
2024-11-08 16:20:30 +01:00
Merge 5.4.287 into android11-5.4-lts
2024-12-16 10:50:16 +00:00
This is the 5.4.291 stable release
2025-03-13 14:53:52 +00:00
UPSTREAM: kernfs: Add option to enable user xattrs
2026-01-14 18:13:12 -08:00
UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
2026-05-07 17:24:09 +03:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
2025-03-13 12:43:07 +01:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
leds: class: Protect brightness_show() with led_cdev->led_access mutex
2024-12-14 19:44:53 +01:00
BACKPORT: bpf: Verifier, do explicit ALU32 bounds tracking
2025-12-23 13:36:11 -08:00
UPSTREAM: list: Add hlist_unhashed_lockless()
2026-01-14 18:13:06 -08:00
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
2024-03-01 13:13:38 +01:00
BACKPORT: security: Refactor declaration of LSM hooks
2025-12-23 13:36:10 -08:00
BACKPORT: security: Refactor declaration of LSM hooks
2025-12-23 13:36:10 -08:00
net: phy: mchp: Add support for LAN8814 QUAD PHY
2024-07-05 09:08:27 +02:00
Revert "mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()"
2025-05-24 05:44:07 +00:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
Revert "mm: make pte_unmap_same compatible with SPF"
2025-05-24 05:44:30 +00:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
module: Restore the moduleparam prefix length check
2025-08-28 16:21:21 +02:00
msm: ep_pcie: Disable hot reset and ignore linkdown
2024-09-13 17:38:37 +05:30
Merge tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina
2026-04-30 20:46:30 +03:00
netpoll: netpoll_send_skb() returns transmit status
2025-04-10 14:29:35 +02:00
nfs: add missing selections of CONFIG_CRC32
2025-05-02 07:39:20 +02:00
nfs: fix UAF in direct writes
2025-08-28 16:21:37 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
nvme: fixup comment for nvme RDMA Provider Type
2024-07-05 09:08:28 +02:00
mlxsw: spectrum_acl_erp: Fix object nesting warning
2024-08-19 05:33:28 +02:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
overflow: Allow mixed type arguments
2025-03-13 12:42:52 +01:00
Revert "mm: provide speculative fault infrastructure"
2025-05-24 05:44:05 +00:00
Merge android11-5.4.295(387dbb9) into msm-5.4
2025-09-29 05:22:53 -07:00
This is the 5.4.291 stable release
2025-03-13 14:53:52 +00:00
UPSTREAM: perf: Expose get/put_callchain_entry()
2026-01-14 18:12:01 -08:00
ANDROID: 16K: Don't copy data vma for maps/smaps output
2025-08-22 07:06:50 -07:00
ANDROID: 16K: Introduce pgsize_migration_inline.h
2024-10-10 16:13:30 -07:00
UPSTREAM: fork: extend clone3() to support setting a PID
2026-07-09 09:06:38 -04:00
UPSTREAM: fork: extend clone3() to support setting a PID
2026-07-09 09:06:38 -04:00
This is the 5.4.269 stable release
2024-02-24 15:47:08 +00:00
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
2025-02-01 18:18:51 +01:00
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
2025-05-25 16:53:58 +00:00
pps: fix poll support
2025-08-28 16:21:18 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t
2026-01-14 18:12:07 -08:00
UPSTREAM: fs/nsfs.c: Added ns_match
2025-12-23 13:36:04 -08:00
firmware: qcom_scm: Add a call for getting dload mode
2024-06-21 10:36:14 +05:30
UPSTREAM: random: split initialization into early step and later step
2026-05-07 17:24:10 +03:00
UPSTREAM: list: Add hlist_unhashed_lockless()
2026-01-14 18:13:06 -08:00
UPSTREAM: rcu-tasks: Add an RCU-tasks rude variant
2026-01-14 18:12:25 -08:00
UPSTREAM: rcu-tasks: Add an RCU Tasks Trace to simplify protection of tracing hooks
2026-01-14 18:12:26 -08:00
rcu: fix header guard for rcu_all_qs()
2025-06-04 14:32:34 +02:00
Revert "regmap: allow to define reg_update_bits for no bus configuration"
2024-04-16 10:04:00 +00:00
This is the 5.4.284 stable release
2024-09-12 10:37:37 +00:00
Revert "mm: introduce __page_add_new_anon_rmap()"
2025-05-24 05:44:06 +00:00
UPSTREAM: rcu-tasks: Add an RCU Tasks Trace to simplify protection of tracing hooks
2026-01-14 18:12:26 -08:00
BACKPORT: seccomp: release filter after task is fully dead
2026-05-07 10:17:17 -04:00
BACKPORT: bpf: Add lockdown check for probe_write_user helper
2026-02-01 20:44:42 -08:00
Revert "Revert "Revert "8250: add support for ASIX devices with a FIFO bug"""
2025-05-18 11:04:18 +03:00
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
2024-05-02 16:18:37 +02:00
dmaengine: sh: setup_xref error handling
2025-12-03 12:45:11 +01:00
BACKPORT: FROMGIT: userfaultfd/shmem: combine shmem_{mcopy_atomic,mfill_zeropage}_pte
2025-05-18 08:08:42 +00:00
UPSTREAM: net: add and use skb_unclone_keeptruesize() helper
2026-05-07 17:24:10 +03:00
BACKPORT: net: sk_msg: Simplify sk_psock initialization
2026-02-01 20:44:39 -08:00
UPSTREAM: bpf, net: Rework cookie generator as per-cpu one
2026-01-14 18:12:39 -08:00
UPSTREAM: bpf: net: Change sk_getsockopt() to take the sockptr_t argument
2026-01-14 18:13:09 -08:00
stackleak: let stack_erasing_sysctl take a kernel pointer buffer
2026-02-01 20:38:37 -08:00
Revert "mm: introduce __lru_cache_add_active_or_unevictable"
2025-05-24 05:44:06 +00:00
BACKPORT: epoll: wire up syscall epoll_pwait2
2025-12-22 07:42:50 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: tcp: bpf: Optionally store mac header in TCP_SAVE_SYN
2026-01-14 18:12:18 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: bpf: Verifier, do explicit ALU32 bounds tracking
2025-12-23 13:36:11 -08:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
types: Complement the aligned types with signed 64-bit one
2025-06-04 14:32:27 +02:00
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
2024-05-02 16:18:28 +02:00
BACKPORT: maccess: rename probe_user_{read,write} to copy_{from,to}_user_nofault
2026-01-14 18:13:22 -08:00
UPSTREAM: udp: do not accept non-tunnel GSO skbs landing in a tunnel
2025-03-10 16:19:50 +00:00
BACKPORT: umh: Separate the user mode driver and the user mode helper support
2026-01-14 18:12:14 -08:00
units: add the HZ macros
2024-02-23 08:24:47 +01:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
BACKPORT: FROMGIT: userfaultfd/shmem: modify shmem_mfill_atomic_pte to use install_pte()
2025-05-18 08:08:42 +00:00
UPSTREAM: bpf: Fix umd memory leak in copy_process()
2026-01-14 18:12:50 -08:00
util_macros.h: fix/rework find_closest() macros
2024-12-14 19:44:43 +01:00
vfio: Introduce interface to flush virqfd inject workqueue
2024-04-13 12:51:34 +02:00
UPSTREAM: virtio: Add get_shm_region method
2026-05-08 21:46:12 +02:00
Revert "mm: add speculative page fault vmstats"
2025-05-24 05:44:04 +00:00
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: sched/core: Add function to sample state of locked-down task
2026-01-14 18:13:18 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: kernfs: Add removed_size out param for simple_xattr_set
2026-01-14 18:13:12 -08:00
