Tejun Heo 187fe84067 cgroup: require write perm on common ancestor when moving processes on the default hierarchy ... On traditional hierarchies, if a task has write access to "tasks" or "cgroup.procs" file of a cgroup and its euid agrees with the target, it can move the target to the cgroup; however, consider the following scenario. The owner of each cgroup is in the parentheses. R (root) - 0 (root) - 00 (user1) - 000 (user1) | \ 001 (user1) \ 1 (root) - 10 (user1) The subtrees of 00 and 10 are delegated to user1; however, while both subtrees may belong to the same user, it is clear that the two subtrees are to be isolated - they're under completely separate resource limits imposed by 0 and 1, respectively. Note that 0 and 1 aren't strictly necessary but added to ease illustrating the issue. If user1 is allowed to move processes between the two subtrees, the intention of the hierarchy - keeping a given group of processes under a subtree with certain resource restrictions while delegating management of the subtree - can be circumvented by user1. This happens because migration permission check doesn't consider the hierarchical nature of cgroups. To fix the issue, this patch adds an extra permission requirement when userland tries to migrate a process in the default hierarchy - the issuing task must have write access to the common ancestor of "cgroup.procs" file of the ancestor in addition to the destination's. Conceptually, the issuer must be able to move the target process from the source cgroup to the common ancestor of source and destination cgroups and then to the destination. As long as delegation is done in a proper top-down way, this guarantees that a delegatee can't smuggle processes across disjoint delegation domains. The next patch will add documentation on the delegation model on the default hierarchy. v2: Fixed missing !ret test. Spotted by Li Zefan. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Li Zefan <lizefan@huawei.com>		2015-06-18 16:54:28 -04:00
..
bpf	bpf: fix two bugs in verification logic when accessing 'ctx' pointer	2015-04-16 14:08:49 -04:00
configs
debug	debug: prevent entering debug mode on panic/exception.	2015-02-19 12:39:03 -06:00
events	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-15 09:00:47 -07:00
gcov	gcov: fix softlockups	2015-04-17 09:04:08 -04:00
irq	irqchip core change for v4.1 (round 3)	2015-04-11 11:17:28 +02:00
livepatch	Merge branch 'for-4.1/core-noarch' into for-linus	2015-04-13 23:57:20 +02:00
locking	lockdep: Make print_lock() robust against concurrent release	2015-04-17 09:42:14 +02:00
power	Merge back earlier suspend/hibernate material for v4.1.	2015-04-10 12:01:59 +02:00
printk	TTY/Serial patches for 4.1-rc1	2015-04-21 09:33:10 -07:00
rcu	Merge branches 'doc.2015.02.26a', 'earlycb.2015.03.03a', 'fixes.2015.03.03a', 'gpexp.2015.02.26a', 'hotplug.2015.03.20a', 'sysidle.2015.02.26b' and 'tiny.2015.02.26a' into HEAD	2015-03-20 08:31:01 -07:00
sched	Merge branch 'timers-nohz-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-04-14 13:58:48 -07:00
time	Char/Misc driver patches for 4.1-rc1	2015-04-21 09:42:58 -07:00
trace	This adds three fixes for the tracing code.	2015-04-22 11:27:36 -07:00
.gitignore
acct.c	acct: check FMODE_CAN_WRITE	2015-04-11 22:27:55 -04:00
async.c	kernel/async.c: switch to pr_foo()	2014-10-09 22:26:04 -04:00
audit_tree.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
audit_watch.c	audit: invalid op= values for rules	2014-09-23 16:37:53 -04:00
audit.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
audit.h	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
auditfilter.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-02-11 20:07:47 -08:00
auditsc.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
backtracetest.c
bounds.c
capability.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
cgroup_freezer.c
cgroup.c	cgroup: require write perm on common ancestor when moving processes on the default hierarchy	2015-06-18 16:54:28 -04:00
compat.c	all arches, signal: move restart_block to struct task_struct	2015-02-12 18:54:12 -08:00
configs.c
context_tracking.c	context_tracking: Export context_tracking_user_enter/exit	2015-03-09 15:43:00 +01:00
cpu_pm.c
cpu.c	Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-04-14 13:36:04 -07:00
cpuset.c	kernel, cpuset: remove exception for __GFP_THISNODE	2015-04-14 16:49:03 -07:00
crash_dump.c	crash_dump: Make is_kdump_kernel() accessible from modules	2014-08-25 15:42:19 -07:00
cred.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
delayacct.c
dma.c
elfcore.c
exec_domain.c	Remove rest of exec domains.	2015-04-12 21:03:31 +02:00
exit.c	Remove execution domain support	2015-04-12 20:58:24 +02:00
extable.c	ftrace/x86/extable: Add is_ftrace_trampoline() function	2014-11-19 15:25:26 -05:00
fork.c	sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem	2015-05-26 20:35:00 -04:00
freezer.c	freezer: remove obsolete comments in __thaw_task()	2014-10-21 23:44:20 +02:00
futex_compat.c
futex.c	Linux 34.0-rc1	2015-02-24 08:41:07 +01:00
groups.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
hung_task.c	kernel/hung_task.c: change hung_task.c to use for_each_process_thread()	2015-04-15 16:35:22 -07:00
irq_work.c	percpu: Convert remaining __get_cpu_var uses in 3.18-rcX	2014-10-29 11:18:18 -04:00
jump_label.c
kallsyms.c	kernel/kallsyms.c: use __seq_open_private()	2014-10-14 02:18:16 +02:00
kcmp.c	kcmp: fix standard comparison bug	2014-09-10 15:42:12 -07:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/mcs: Better differentiate between MCS variants	2015-01-14 15:07:32 +01:00
Kconfig.preempt
kexec.c	kexec: simplify conditional	2015-02-17 14:34:51 -08:00
kmod.c	usermodehelper: kill the kmod_thread_locker logic	2014-12-10 17:41:17 -08:00
kprobes.c	kprobes: makes kprobes/enabled works correctly for optimized kprobes.	2015-02-13 21:21:42 -08:00
ksysfs.c
kthread.c	kernel/kthread.c: partial revert of 81c98869fa ("kthread: ensure locality of task_struct allocations")	2014-10-09 22:25:51 -04:00
latencytop.c
Makefile	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
module_signing.c
module-internal.h
module.c	Quentin opened a can of worms by adding extable entry checking to modpost,	2015-04-22 09:49:24 -07:00
notifier.c	rcu: Make SRCU optional by using CONFIG_SRCU	2015-01-06 11:04:29 -08:00
nsproxy.c	bury struct proc_ns in fs/proc	2014-12-04 14:34:54 -05:00
padata.c	padata: use %*pb[l] to print bitmaps including cpumasks and nodemasks	2015-02-13 21:21:38 -08:00
panic.c	livepatch: kernel: add TAINT_LIVEPATCH	2014-12-22 15:40:48 +01:00
params.c	params: handle quotes properly for values not of form foo="bar".	2015-04-15 13:31:23 +09:30
pid_namespace.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-12-16 15:53:03 -08:00
pid.c	fork: report pid reservation failure properly	2015-04-17 09:04:06 -04:00
profile.c	profile: use %*pb[l] to print bitmaps including cpumasks and nodemasks	2015-02-13 21:21:38 -08:00
ptrace.c	ptrace: ptrace_detach() can no longer race with SIGKILL	2015-04-17 09:04:06 -04:00
range.c	kernel: avoid overflow in cmp_range	2015-01-17 10:02:23 +13:00
reboot.c	kernel/reboot.c: add orderly_reboot for graceful reboot	2015-04-15 16:35:23 -07:00
relay.c
resource.c	kernel/resource.c: remove deprecated __check_region() and friends	2015-04-15 16:35:22 -07:00
seccomp.c	seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO	2015-02-17 14:34:55 -08:00
signal.c	signal: remove warning about using SI_TKILL in rt_[tg]sigqueueinfo	2015-04-17 09:04:06 -04:00
smp.c	smp: Fix error case handling in smp_call_function_*()	2015-04-19 13:19:23 -07:00
smpboot.c	smpboot: Add common code for notification from dying CPU	2015-03-11 13:20:25 -07:00
smpboot.h
softirq.c	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-02-09 15:24:03 -08:00
stacktrace.c	stacktrace: introduce snprint_stack_trace for buffer output	2014-12-13 12:42:48 -08:00
stop_machine.c
sys_ni.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
sys.c	prctl: avoid using mmap_sem for exe_file serialization	2015-04-17 09:04:07 -04:00
sysctl_binary.c	kernel: add panic_on_warn	2014-12-10 17:41:10 -08:00
sysctl.c	kernel/sysctl.c: detect overflows when converting to int	2015-04-17 09:04:08 -04:00
system_certificates.S
system_keyring.c
task_work.c
taskstats.c	netlink: make nlmsg_end() and genlmsg_end() void	2015-01-18 01:03:45 -05:00
test_kprobes.c
torture.c	torture: Address race in module cleanup	2014-09-16 13:41:06 -07:00
tracepoint.c
tsacct.c
uid16.c	groups: Consolidate the setgroups permission checks	2014-12-05 17:19:27 -06:00
up.c
user_namespace.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2014-12-17 12:31:40 -08:00
user-return-notifier.c	scheduler: Replace __get_cpu_var with this_cpu_ptr	2014-08-26 13:45:45 -04:00
user.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2014-12-17 12:31:40 -08:00
utsname_sysctl.c
utsname.c	copy address of proc_ns_ops into ns_common	2014-12-04 14:34:47 -05:00
watchdog.c	Merge branch 'akpm' (patches from Andrew)	2015-04-14 16:49:17 -07:00
workqueue_internal.h
workqueue.c	workqueue: Reorder sysfs code	2015-04-06 11:16:04 -04:00