cr: support LSM credentials
Subsystems (4)
cover cr: support LSM credentials
Here is my current code for lsm c/r support. I'll be out a good part of next week, but intend to spend the next few weeks doing proper selinux implementation, working on the comments for these earlier patches, and writing some automated tests. These patches seem solid on my setup, and shouldn't hurt anything to have in the tree for testing. I'm punting on the SELinux code this week bc testing it requires a lot more userspace tweaking to properly test. That means that if you have an SELinux-enabled kernel, you will be able to use mktree without -k as usual to get default labeling, but mktree -k < out will return -ENOSYS.
I'm not sending to linux-kernel-module or selinux lists because that will require writing patch intros describing c/r again etc...
-serge
A message that is not in the archive (sent off-list or not yet received): 20090812181237.GA10925-r/[email protected]
PATCH 1/3 cr: checkpoint the active LSM and add RESTART_KEEP_LSM flag
(this is a resend of the patch I sent a few weeks ago, which requires the corresponding mktree patch)
The RESTART_KEEP_LSM flag indicates that the LSM should attempt to reuse checkpointed security labels. It is always invalid when the LSM at restart differs from that at checkpoint. It is currently only usable for capabilities.
(For capabilities, restart without RESTART_KEEP_LSM is technically not implemented. There actually might be a use case for that, but the safety of it is dubious so for now we always re-create checkpointed capability sets whether RESTART_KEEP_LSM is specified or not)
Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
--- Documentation/checkpoint/readme.txt | 25 +++++++++++++++++++++++++ checkpoint/checkpoint.c | 6 ++++++ checkpoint/restart.c | 19 +++++++++++++++++++ include/linux/checkpoint.h | 5 +++-- include/linux/checkpoint_hdr.h | 3 ++- include/linux/checkpoint_types.h | 2 ++ include/linux/security.h | 8 ++++++++ security/security.c | 5 +++++ 8 files changed, 70 insertions(+), 3 deletions(-)
Documentation/checkpoint/readme.txt +25 -0
@@ -328,6 +328,31 @@ So that's why we don't want CAP_SYS_ADMIN required up-front. That way we will be forced to more carefully review each of those features. However, this can be controlled with a sysctl-variable. +LSM +=== + +Security modules use custom labels on subjects and objects to +further mediate access decisions beyond DAC controls. When +checkpoint applications, these labels are [ work in progress ] +checkpointed along with the objects. At restart, the +RESTART_KEEP_LSM flag tells the kernel whether re-created objects +whould keep their checkpointed labels, or get automatically +recalculated labels. Since checkpointed labels will only make +sense to the same LSM which was active at checkpoint time, +sys_restart() with the RESTART_KEEP_LSM flag will fail with +-EINVAL if the LSM active at restart is not the same as that +active at checkpoint. If RESTART_KEEP_LSM is not specified, +then objects will be given whatever default labels the LSM and +their optional policy decide. Of course, when RESTART_KEEP_LSM +is specified, the LSM may choose a different label than the +checkpointed one, or fail the entire restart if the caller +does not have permission to create objects with the checkpointed +label. + +It should always be safe to take a checkpoint of an application +under LSM_1, and restart it without the RESTART_KEEP_LSM flag +under LSM_2. + Kernel interfaces =================
checkpoint/checkpoint.c +6 -0
@@ -248,6 +248,12 @@ static int checkpoint_write_header(struct ckpt_ctx *ctx)if (ret <0 )return ret; +memset (ctx->lsm_name,0 ,SECURITY_NAME_MAX +1 ); +strlcpy (ctx->lsm_name,security_get_lsm_name (),SECURITY_NAME_MAX +1 ); + ret =ckpt_write_buffer (ctx, ctx->lsm_name,SECURITY_NAME_MAX +1 ); +if (ret <0 ) +return ret; +return checkpoint_write_header_arch (ctx); }
checkpoint/restart.c +19 -0
@@ -366,6 +366,25 @@ static int restore_read_header(struct ckpt_ctx *ctx)if (ret <0 ) goto out; + ret =_ckpt_read_buffer (ctx, ctx->lsm_name,SECURITY_NAME_MAX +1 ); +if (ret <0 ) + goto out; +if (ctx->uflags &RESTART_KEEP_LSM ) { +char *cur =security_get_lsm_name (); +if (strncmp (cur, ctx->lsm_name,SECURITY_NAME_MAX +1 ) !=0 ) { +pr_warning ("c/r: checkpointed LSM %s, current is %s.\n" , + ctx->lsm_name, cur); +return -EINVAL ; + } +/* to be implemented later, per-lsm */ +if (strcmp (ctx->lsm_name,"lsm_none" ) !=0 && +strcmp (ctx->lsm_name,"default" ) !=0 ) { +pr_warning ("c/r: RESTART_KEEP_LSM unsupported for %s\n" , + ctx->lsm_name); +return -ENOSYS ; + } + } + ret =restore_read_header_arch (ctx); out:kfree (uts);
include/linux/checkpoint.h +3 -2
@@ -18,6 +18,7 @@/* restart user flags */ #define RESTART_TASKSELF 0x1#define RESTART_FROZEN 0x2 +#define RESTART_KEEP_LSM 0x4#ifdef __KERNEL__#ifdef CONFIG_CHECKPOINT
@@ -29,7 +30,6 @@#include <linux/checkpoint_types.h> #include <linux/checkpoint_hdr.h> -/* ckpt_ctx: kflags */ #define CKPT_CTX_CHECKPOINT_BIT 0#define CKPT_CTX_RESTART_BIT 1
@@ -43,7 +43,8 @@/* ckpt_ctx: uflags */ #define CHECKPOINT_USER_FLAGS CHECKPOINT_SUBTREE -#define RESTART_USER_FLAGS (RESTART_TASKSELF | RESTART_FROZEN) +#define RESTART_USER_FLAGS (RESTART_TASKSELF | RESTART_FROZEN | \ + RESTART_KEEP_LSM)extern void exit_checkpoint (struct task_struct *tsk);
include/linux/checkpoint_hdr.h +2 -1
@@ -160,10 +160,11 @@ struct ckpt_hdr_header {__u64 uflags;/* uflags from checkpoint */ /* -* the header is followed by three strings: +* the header is followed by four strings: * char release[const.uts_release_len]; * char version[const.uts_version_len]; * char machine[const.uts_machine_len]; +* char lsm_name[SECURITY_NAME_MAX + 1] */ } __attribute__((aligned(8)));
include/linux/checkpoint_types.h +2 -0
@@ -19,6 +19,7 @@#include <linux/fs.h> #include <linux/ktime.h> #include <linux/wait.h> +#include <linux/security.h> struct ckpt_stats {int uts_ns;
@@ -36,6 +37,7 @@ struct ckpt_ctx {struct task_struct *root_task;/* [container] root task */ struct nsproxy *root_nsproxy;/* [container] root nsproxy */ struct task_struct *root_freezer;/* [container] root task */ +char lsm_name[SECURITY_NAME_MAX +1 ];/* security module at ckpt */ unsigned long kflags;/* kerenl flags */ unsigned long uflags;/* user flags */
include/linux/security.h +8 -0
@@ -1776,6 +1776,8 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);int security_secctx_to_secid (const char *secdata,u32 seclen,u32 *secid);void security_release_secctx (char *secdata,u32 seclen); +char *security_get_lsm_name (void ); +#else /* CONFIG_SECURITY */ struct security_mnt_opts { };
@@ -1798,6 +1800,12 @@ static inline int security_init(void)return 0 ; } +#define DEFAULT_LSM_NAME "lsm_none" +static inline char *security_get_lsm_name (void ) +{ +return DEFAULT_LSM_NAME ; +} +static inline int security_ptrace_may_access (struct task_struct *child,unsigned int mode) {
security/security.c +5 -0
@@ -122,6 +122,11 @@ int register_security(struct security_operations *ops)return 0 ; } +char *security_get_lsm_name (void ) +{ +return security_ops->name; +} +/* Security operations */ int security_ptrace_may_access (struct task_struct *child,unsigned int mode)
Signature · 1 line
1.6.1
PATCH 2/3 cr: add generic LSM c/r support
In reply to a message not in the archiveThis patch adds generic support for c/r of LSM credentials. Support for Smack and SELinux (and TOMOYO if appropriate) will be added later. Capabilities is already supported through generic creds code.
This patch supports ipc_perm, msg_msg, cred (task) and file ->security fields. Inodes, superblocks, netif, and xfrm currently are restored not through sys_restart() but through container creation, and so the security fields should be done then as well. Network should be added when network c/r is added.
Briefly, all security fields must be exported by the LSM as a simple null-terminated string. They are checkpointed through the security_checkpoint_obj() helper, because we must pass it an extra sectype field. Splitting SECURITY_OBJ_SEC into one type per object type would not work because, in Smack, one void* security is used for all object types. But we must pass the sectype field because in SELinux a different type of structure is stashed in each object type.
Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
--- checkpoint/checkpoint.c | 1 + checkpoint/files.c | 30 +++++++++ checkpoint/objhash.c | 93 +++++++++++++++++++++++++++ include/linux/checkpoint_hdr.h | 20 ++++++ include/linux/checkpoint_types.h | 7 ++ include/linux/security.h | 128 ++++++++++++++++++++++++++++++++++++++ ipc/checkpoint.c | 34 +++++++--- ipc/checkpoint_msg.c | 26 +++++++- ipc/checkpoint_sem.c | 4 +- ipc/checkpoint_shm.c | 4 +- ipc/util.h | 6 +- kernel/cred.c | 20 ++++++- security/capability.c | 48 ++++++++++++++ security/security.c | 105 +++++++++++++++++++++++++++++++ 14 files changed, 506 insertions(+), 20 deletions(-)
checkpoint/checkpoint.c +1 -0
@@ -24,6 +24,7 @@#include <linux/utsname.h> #include <linux/magic.h> #include <linux/hrtimer.h> +#include <linux/security.h> #include <linux/checkpoint.h> #include <linux/checkpoint_hdr.h>
checkpoint/files.c +30 -0
@@ -142,6 +142,19 @@ static int scan_fds(struct files_struct *files, int **fdtable)return n; } +#ifdef CONFIG_SECURITY +int checkpoint_file_security (struct ckpt_ctx *ctx,struct file *file) +{ +return security_checkpoint_obj (ctx, file->f_security, +CKPT_SECURITY_FILE ); +} +#else +int checkpoint_file_security (struct ckpt_ctx *ctx,struct file *file) +{ +return -EOPNOTSUPP ; +} +#endif +int checkpoint_file_common (struct ckpt_ctx *ctx,struct file *file,struct ckpt_hdr_file *h) {
@@ -154,6 +167,12 @@ int checkpoint_file_common(struct ckpt_ctx *ctx, struct file *file,if (h->f_credref <0 )return h->f_credref; + h->f_secref =checkpoint_file_security (ctx, file); +if (h->f_secref == -EOPNOTSUPP ) + h->f_secref =-1 ; +else if (h->f_secref <0 ) +return h->f_secref; +/* FIX: need also file->f_owner, etc */ return 0 ;
@@ -480,6 +499,17 @@ int restore_file_common(struct ckpt_ctx *ctx, struct file *file,put_cred (file->f_cred); file->f_cred =get_cred (cred); +if ((ctx->uflags &RESTART_KEEP_LSM ) && (h->f_secref !=-1 )) { +struct ckpt_stored_lsm *l =ckpt_obj_fetch (ctx, h->f_secref, +CKPT_OBJ_SEC ); +if (IS_ERR (l)) +return PTR_ERR (l); + + ret =security_file_restore (file, l->string); +if (ret) +return ret; + } +/* safe to set 1st arg (fd) to 0, as command is F_SETFL */ ret =vfs_fcntl (0 ,F_SETFL , h->f_flags &CKPT_SETFL_MASK , file);if (ret <0 )
checkpoint/objhash.c +93 -0
111 lines not on this page · raw message
include/linux/checkpoint_hdr.h +20 -0
@@ -49,6 +49,7 @@ enum {CKPT_HDR_BUFFER ,CKPT_HDR_STRING ,CKPT_HDR_OBJREF , +CKPT_HDR_SEC ,CKPT_HDR_TREE =101 , CKPT_HDR_TASK,
@@ -122,6 +123,7 @@ enum obj_type {CKPT_OBJ_CRED ,CKPT_OBJ_USER ,CKPT_OBJ_GROUPINFO , +CKPT_OBJ_SEC , CKPT_OBJ_MAX };
@@ -235,6 +237,8 @@ struct ckpt_hdr_cred {__u32 gid, sgid, egid, fsgid;__s32 user_ref;__s32 groupinfo_ref; +__s32 sec_ref; +__u32 padding;struct ckpt_capabilities cap_s; } __attribute__((aligned(8)));
@@ -247,6 +251,16 @@ struct ckpt_hdr_groupinfo {__u32 groups[0 ]; } __attribute__((aligned(8))); +struct ckpt_hdr_lsm { +struct ckpt_hdr h; +__u8 sectype; +__u16 len; +/* +* This is followed by a string of size len+1, +* null-terminated +*/ +__u8 string[0 ]; +} __attribute__((aligned (8 )));/* * todo - keyrings and LSM * These may be better done with userspace help though
@@ -340,6 +354,8 @@ struct ckpt_hdr_file {__s32 f_credref;__u64 f_pos;__u64 f_version; +__s32 f_secref; +__u32 f_padding; } __attribute__((aligned(8)));struct ckpt_hdr_file_generic {
@@ -462,6 +478,8 @@ struct ckpt_hdr_ipc_perms {__u32 mode;__u32 _padding;__u64 seq; +__s32 sec_ref; +__u32 padding; } __attribute__((aligned(8)));struct ckpt_hdr_ipc_shm {
@@ -495,6 +513,8 @@ struct ckpt_hdr_ipc_msg_msg {struct ckpt_hdr h;__s32 m_type;__u32 m_ts; +__s32 sec_ref; +__u32 padding; } __attribute__((aligned(8)));struct ckpt_hdr_ipc_sem {
include/linux/checkpoint_types.h +7 -0
@@ -73,6 +73,13 @@ struct ckpt_ctx {struct ckpt_stats stats;/* statistics */ }; +/* stored on hashtable */ +struct ckpt_stored_lsm { +struct kref kref; +int sectype; +char *string; +}; +#endif /* __KERNEL__ */ #endif /* _LINUX_CHECKPOINT_TYPES_H_ */
include/linux/security.h +128 -0
219 lines not on this page · raw message
ipc/checkpoint.c +24 -10
@@ -31,7 +31,8 @@ static char *ipc_ind_to_str[] = { "sem", "msg", "shm" };* Checkpoint */ -int checkpoint_fill_ipc_perms (struct ckpt_hdr_ipc_perms *h, +int checkpoint_fill_ipc_perms (struct ckpt_ctx *ctx, +struct ckpt_hdr_ipc_perms *h,struct kern_ipc_perm *perm) {if (ipcperms (perm,S_IROTH ))
@@ -45,6 +46,15 @@ int checkpoint_fill_ipc_perms(struct ckpt_hdr_ipc_perms *h, h->cgid = perm->cgid; h->mode = perm->mode &S_IRWXUGO ; h->seq = perm->seq; +if (perm->security) { + h->sec_ref =security_checkpoint_obj (ctx, perm->security, +CKPT_SECURITY_IPC ); +if (h->sec_ref == -EOPNOTSUPP ) + h->sec_ref =-1 ; +else if (h->sec_ref <0 ) +return h->sec_ref; + }else + h->sec_ref =-1 ;return 0 ; }
@@ -176,7 +186,8 @@ static int validate_created_perms(struct ckpt_hdr_ipc_perms *h)return 1 ; } -int restore_load_ipc_perms (struct ckpt_hdr_ipc_perms *h, +int restore_load_ipc_perms (struct ckpt_ctx *ctx, +struct ckpt_hdr_ipc_perms *h,struct kern_ipc_perm *perm) {if (h->id <0 )
@@ -205,14 +216,17 @@ int restore_load_ipc_perms(struct ckpt_hdr_ipc_perms *h, perm->cgid = h->cgid; perm->mode = h->mode; perm->seq = h->seq; -/* -* Todo: restore perm->security. -* At the moment it gets set by security_x_alloc() called through -* ipcget()->ipcget_public()->ops-.getnew (->nequeue for instance) -* We will want to ask the LSM to consider resetting the -* checkpointed ->security, based on current_security(), -* the checkpointed ->security, and the checkpoint file context. -*/ + +if ((ctx->uflags &RESTART_KEEP_LSM ) && (h->sec_ref !=-1 )) { +int ret; +struct ckpt_stored_lsm *l =ckpt_obj_fetch (ctx, h->sec_ref, +CKPT_OBJ_SEC ); +if (IS_ERR (l)) +return PTR_ERR (l); + ret =security_ipc_restore (perm, l->string); +if (ret) +return ret; + }return 0 ; }
ipc/checkpoint_msg.c +23 -3
@@ -37,7 +37,7 @@ static int fill_ipc_msg_hdr(struct ckpt_ctx *ctx,ipc_lock_by_ptr (&msq->q_perm); - ret =checkpoint_fill_ipc_perms (&h->perms, &msq->q_perm); + ret =checkpoint_fill_ipc_perms (ctx, &h->perms, &msq->q_perm);if (ret <0 ) goto unlock;
@@ -64,13 +64,23 @@ static int checkpoint_msg_contents(struct ckpt_ctx *ctx, struct msg_msg *msg)struct msg_msgseg *seg;int total, len;int ret; - +int sec_ref =-1 ; + +if (msg->security) { + sec_ref =security_checkpoint_obj (ctx, msg->security, +CKPT_SECURITY_MSG_MSG ); +if (sec_ref == -EOPNOTSUPP ) + sec_ref =-1 ; +else if (sec_ref <0 ) +return sec_ref; + } h =ckpt_hdr_get_type (ctx,sizeof (*h),CKPT_HDR_IPC_MSG_MSG );if (!h)return -ENOMEM ; h->m_type = msg->m_type; h->m_ts = msg->m_ts; + h->sec_ref = sec_ref; ret =ckpt_write_obj (ctx, &h->h);ckpt_hdr_put (ctx, h);
@@ -177,7 +187,7 @@ static int load_ipc_msg_hdr(struct ckpt_ctx *ctx, {int ret =0 ; - ret =restore_load_ipc_perms (&h->perms, &msq->q_perm); + ret =restore_load_ipc_perms (ctx, &h->perms, &msq->q_perm);if (ret <0 )return ret;
@@ -224,6 +234,16 @@ static struct msg_msg *restore_msg_contents_one(struct ckpt_ctx *ctx, int *clen) msg->next =NULL ; pseg = &msg->next; +if ((ctx->uflags &RESTART_KEEP_LSM ) && (h->sec_ref !=-1 )) { +struct ckpt_stored_lsm *l =ckpt_obj_fetch (ctx, h->sec_ref, +CKPT_OBJ_SEC ); +if (IS_ERR (l)) +return (struct msg_msg *)l; + ret =security_msg_msg_restore (msg, l->string); +if (ret) +return ERR_PTR (ret); + } + ret =_ckpt_read_buffer (ctx, (msg +1 ), len);if (ret <0 ) goto out;
ipc/checkpoint_sem.c +2 -2
@@ -37,7 +37,7 @@ static int fill_ipc_sem_hdr(struct ckpt_ctx *ctx,ipc_lock_by_ptr (&sem->sem_perm); - ret =checkpoint_fill_ipc_perms (&h->perms, &sem->sem_perm); + ret =checkpoint_fill_ipc_perms (ctx, &h->perms, &sem->sem_perm);if (ret <0 ) goto unlock;
@@ -113,7 +113,7 @@ static int load_ipc_sem_hdr(struct ckpt_ctx *ctx, {int ret =0 ; - ret =restore_load_ipc_perms (&h->perms, &sem->sem_perm); + ret =restore_load_ipc_perms (ctx, &h->perms, &sem->sem_perm);if (ret <0 )return ret;
ipc/checkpoint_shm.c +2 -2
@@ -41,7 +41,7 @@ static int fill_ipc_shm_hdr(struct ckpt_ctx *ctx,ipc_lock_by_ptr (&shp->shm_perm); - ret =checkpoint_fill_ipc_perms (&h->perms, &shp->shm_perm); + ret =checkpoint_fill_ipc_perms (ctx, &h->perms, &shp->shm_perm);if (ret <0 ) goto unlock;
@@ -166,7 +166,7 @@ static int load_ipc_shm_hdr(struct ckpt_ctx *ctx, {int ret; - ret =restore_load_ipc_perms (&h->perms, &shp->shm_perm); + ret =restore_load_ipc_perms (ctx, &h->perms, &shp->shm_perm);if (ret <0 )return ret;
ipc/util.h +4 -2
@@ -199,9 +199,11 @@ void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp);#ifdef CONFIG_CHECKPOINT -extern int checkpoint_fill_ipc_perms (struct ckpt_hdr_ipc_perms *h, +extern int checkpoint_fill_ipc_perms (struct ckpt_ctx *ctx, +struct ckpt_hdr_ipc_perms *h,struct kern_ipc_perm *perm); -extern int restore_load_ipc_perms (struct ckpt_hdr_ipc_perms *h, +extern int restore_load_ipc_perms (struct ckpt_ctx *ctx, +struct ckpt_hdr_ipc_perms *h,struct kern_ipc_perm *perm);extern int checkpoint_ipc_shm (int id,void *p,void *data);
kernel/cred.c +19 -1
@@ -709,7 +709,7 @@ int cred_setfsgid(struct cred *new, gid_t gid, gid_t *old_fsgid)static int do_checkpoint_cred (struct ckpt_ctx *ctx,const struct cred *cred) {int ret; -int groupinfo_ref, user_ref; +int groupinfo_ref, user_ref, sec_ref =-1 ;struct ckpt_hdr_cred *h; groupinfo_ref = checkpoint_obj(ctx, cred->group_info,
@@ -719,6 +719,14 @@ static int do_checkpoint_cred(struct ckpt_ctx *ctx, const struct cred *cred) user_ref =checkpoint_obj (ctx, cred->user,CKPT_OBJ_USER );if (user_ref <0 )return user_ref; +#ifdef CONFIG_SECURITY + sec_ref =security_checkpoint_obj (ctx, cred->security, +CKPT_SECURITY_CRED ); +if (sec_ref == -EOPNOTSUPP ) + sec_ref =-1 ; +else if (sec_ref <0 ) +return sec_ref; +#endif /* else cred->security doesn't exist and sec_ref = -1 */ h =ckpt_hdr_get_type (ctx,sizeof (*h),CKPT_HDR_CRED );if (!h)
@@ -733,6 +741,7 @@ static int do_checkpoint_cred(struct ckpt_ctx *ctx, const struct cred *cred) h->sgid = cred->sgid; h->egid = cred->egid; h->fsgid = cred->fsgid; + h->sec_ref = sec_ref;checkpoint_capabilities (&h->cap_s, cred);
@@ -806,6 +815,15 @@ static struct cred *do_restore_cred(struct ckpt_ctx *ctx) ret =cred_setfsgid (cred, h->fsgid, &oldgid);if (oldgid != h->fsgid && ret <0 ) goto err_putcred; +if ((ctx->uflags &RESTART_KEEP_LSM ) && (h->sec_ref !=-1 )) { +struct ckpt_stored_lsm *l =ckpt_obj_fetch (ctx, h->sec_ref, +CKPT_OBJ_SEC ); +if (IS_ERR (l)) +return (struct cred *)l; + ret =security_cred_restore (cred, l->string); +if (ret) + goto err_putcred; + } ret =restore_capabilities (&h->cap_s, cred);if (ret) goto err_putcred;
security/capability.c +48 -0
90 lines not on this page · raw message
security/security.c +105 -0
131 lines not on this page · raw message
Signature · 1 line
1.6.1
PATCH 3/3 cr: add smack support to lsm c/r
In reply to a message not in the archiveThe policy is the same as in previous versions:
1. when objects are created during restore() they are automatically labeled with current_security().
2. if there was a label checkpointed with the object, and that label != current_security() (which is the same as obj->security), then the object is relabeled if the sys_restart() caller has CAP_MAC_ADMIN. Otherwise we return -EPERM.
This has been tested by checkpointing tasks under labels _, vs1, and vs2, and restarting from tasks under _, vs1, and vs2, with and without CAP_MAC_ADMIN in the bounding set, and with and without the '-k' (keep_lsm) flag to mktree. Expected results:
#shell 1:
echo vs1 > /proc/self/attr/current
ckpt > out
echo vs2 > /proc/self/attr/current
mktree -F /cgroup/2 < out
(frozen)
# shell 2:
cat /proc/pidof ckpt/attr/current
vs2
echo THAWED > /cgroup/2/freezer.state
# shell 1:
mktree -k -F /cgroup/2 < out
(frozen)
# shell 2:
cat /proc/pidof ckpt/attr/current
vs1
echo THAWED > /cgroup/2/freezer.state
# shell 1:
capsh --drop=cap_mac_admin --
mktree -k -F /cgroup/2 < out
(permission denied)
Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
--- checkpoint/restart.c | 1 + security/security.c | 8 ++++ security/smack/smack_lsm.c | 90 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 0 deletions(-)
checkpoint/restart.c +1 -0
@@ -378,6 +378,7 @@ static int restore_read_header(struct ckpt_ctx *ctx) }/* to be implemented later, per-lsm */ if (strcmp (ctx->lsm_name,"lsm_none" ) !=0 && +strcmp (ctx->lsm_name,"smack" ) !=0 &&strcmp (ctx->lsm_name,"default" ) !=0 ) {pr_warning ("c/r: RESTART_KEEP_LSM unsupported for %s\n" , ctx->lsm_name);
security/security.c +8 -0
@@ -1316,6 +1316,14 @@ int security_checkpoint_obj(struct ckpt_ctx *ctx, void *security,char *str;int len; +/* +* to simplify the LSM code, short-cut a null security +* here - hopefully not actually needed; test without +* this one day. +*/ +if (!security) +return -EOPNOTSUPP ; +switch (sectype) {case CKPT_SECURITY_MSG_MSG : str =security_msg_msg_get_ctx (security);
security/smack/smack_lsm.c +90 -0
134 lines not on this page · raw message
Signature · 1 line
1.6.1