From patchwork Tue Nov 8 23:28:47 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 81416 Delivered-To: patches@linaro.org Received: by 10.140.97.165 with SMTP id m34csp1809872qge; Tue, 8 Nov 2016 15:28:53 -0800 (PST) X-Received: by 10.99.140.77 with SMTP id q13mr11493924pgn.109.1478647733854; Tue, 08 Nov 2016 15:28:53 -0800 (PST) Return-Path: Received: from mail-pf0-x22a.google.com (mail-pf0-x22a.google.com. [2607:f8b0:400e:c00::22a]) by mx.google.com with ESMTPS id i75si2980163pfj.285.2016.11.08.15.28.53 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 08 Nov 2016 15:28:53 -0800 (PST) Received-SPF: pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c00::22a as permitted sender) client-ip=2607:f8b0:400e:c00::22a; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: domain of john.stultz@linaro.org designates 2607:f8b0:400e:c00::22a as permitted sender) smtp.mailfrom=john.stultz@linaro.org; dmarc=pass (p=NONE dis=NONE) header.from=linaro.org Received: by mail-pf0-x22a.google.com with SMTP id d2so115556164pfd.0 for ; Tue, 08 Nov 2016 15:28:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=93/VtCR+Hrwbucl/l7IyT4qZpi+1ue2QtASyZ/RRSqo=; b=ao1AP1jvCCXHBF/a2m+gRYoHlf1ZeA1zWrwnv6q/D5LVXCw5Aelar8Q9BFblPHEXRw y4YSb0UCbvjNsdilPVnh0cQ/YtRPnsCL+JxP5sQFdAVTNbsQ7X419PbydwvFxqyVbK9t Q/dQRHbwpTX/h9quGOs51IMShumu8zhaTMwUQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=93/VtCR+Hrwbucl/l7IyT4qZpi+1ue2QtASyZ/RRSqo=; b=O/SwBy6IZJOovvJkhsP6op8/VQeVuiOv54oB5uPLzTzb4SRTWfchyDaWNz5rMsG2k2 ljnkIa6PlRnnCL0Juv+0HyiXDhqO9LoeG8BBZcmow/KsT6PQvrsuKkDtZLO1TodLKqx0 S+Rl1N4quYP3F4FCWASDVKsR/7O6lo+Z0YdNGxbupfC8h8wIAjd+gL5IjcVv4cW1ZRvR m48h7iUrxt0vmc1Ui9RK34gTHYJoK5SwibHA98snvjTFKNgKoFN5kzkGr43FHolI819l lJOmEeJThUCXBJX9bUNFAsogbEaSDfYv0eRduE4uhCI084dWv8vym47xEJZPf4p1ml5Q Kuxg== X-Gm-Message-State: ABUngvfYRYR76g6MKLvunGsu3dIfhpYN1Cf+D8UtTwTQg5nohrbpMSMtQycS1Fc2exz9y/rO+FI= X-Received: by 10.98.52.194 with SMTP id b185mr27336627pfa.41.1478647733394; Tue, 08 Nov 2016 15:28:53 -0800 (PST) Return-Path: Received: from localhost.localdomain ([2601:1c2:1002:83f0:4e72:b9ff:fe99:466a]) by smtp.gmail.com with ESMTPSA id 70sm50454196pfc.50.2016.11.08.15.28.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 08 Nov 2016 15:28:52 -0800 (PST) From: John Stultz To: lkml Cc: John Stultz , Tejun Heo , Li Zefan , Jonathan Corbet , cgroups@vger.kernel.org, Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , linux-api@vger.kernel.org Subject: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a process to migrate other tasks between cgroups Date: Tue, 8 Nov 2016 15:28:47 -0800 Message-Id: <1478647728-30357-1-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 2.7.4 This patch adds logic to allows a process to migrate other tasks between cgroups if they have CAP_SYS_RESOURCE. In Android (where this feature originated), the ActivityManager tracks various application states (TOP_APP, FOREGROUND, BACKGROUND, SYSTEM, etc), and then as applications change states, the SchedPolicy logic will migrate the application tasks between different cgroups used to control the different application states (for example, there is a background cpuset cgroup which can limit background tasks to stay on one low-power cpu, and the bg_non_interactive cpuctrl cgroup can then further limit those background tasks to a small percentage of that one cpu's cpu time). However, for security reasons, Android doesn't want to make the system_server (the process that runs the ActivityManager and SchedPolicy logic), run as root. So in the Android common.git kernel, they have some logic to allow cgroups to loosen their permissions so CAP_SYS_NICE tasks can migrate other tasks between cgroups. I feel the approach taken there overloads CAP_SYS_NICE a bit much for non-android environments. So this patch, as suggested by Michael Kerrisk, simply adds a check for CAP_SYS_RESOURCE. I've tested this with AOSP master, and this seems to work well as Zygote and system_server already use CAP_SYS_RESOURCE. I've also submitted patches against the android-4.4 kernel to change it to use CAP_SYS_RESOURCE, and the Android developers just merged it. Cc: Tejun Heo Cc: Li Zefan Cc: Jonathan Corbet Cc: cgroups@vger.kernel.org Cc: Android Kernel Team Cc: Rom Lemarchand Cc: Colin Cross Cc: Dmitry Shmidt Cc: Todd Kjos Cc: Christian Poetzsch Cc: Amit Pundir Cc: Dmitry Torokhov Cc: Kees Cook Cc: Serge E. Hallyn Cc: linux-api@vger.kernel.org Acked-by: Serge Hallyn Signed-off-by: John Stultz --- v2: Renamed to just CAP_CGROUP_MIGRATE as recommended by Tejun v3: Switched to just using CAP_SYS_RESOURCE as suggested by Michael v4: Send out properly folded down version of the patch. :P --- kernel/cgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.7.4 Reviewed-by: Kees Cook diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 85bc9be..866059a 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2856,7 +2856,8 @@ static int cgroup_procs_write_permission(struct task_struct *task, */ if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && - !uid_eq(cred->euid, tcred->suid)) + !uid_eq(cred->euid, tcred->suid) && + !ns_capable(tcred->user_ns, CAP_SYS_RESOURCE)) ret = -EACCES; if (!ret && cgroup_on_dfl(dst_cgrp)) {