[CRIU] [PATCH] security: check_ids - return true if [se]?[ug]id is the same as task id

[Ruslan Kuprieiev]

On 17.06.2014 17:05, Andrew Vagin wrote:
> On Tue, Jun 17, 2014 at 05:35:50PM +0400, Pavel Emelyanov wrote:
>> On 06/17/2014 05:30 PM, Andrew Vagin wrote:
>>> On Tue, Jun 17, 2014 at 04:15:31PM +0400, Pavel Emelyanov wrote:
>>>> On 06/17/2014 01:40 PM, Andrew Vagin wrote:
>>>>
>>>>> We was talking with you about the third one. Images are created from a
>>>>> suid user. On restore criu checks that images are belonged to this user.
>>>>>
>>>>> Only root can change file owners, so it looks secure.
>>>> Well, yes. I've already expressed this idea in another sub-thread.
>>>> Files belonging to root and having no write perms for anyone else
>>>> are safe to be used as restore images regardless of contents.
>>> It is not the same. Why they should belong to root?
>> To whom? To some other user? This is also insecure.
>>
>>> Or may be root a code name for suid (Saved User ID)?
>> What?
> I had a personal discussion with Pavel. He explained me why it's
> insecure. Sorry for the noise.

Don't want to bother you, but I'm still curious=).
Could you tell here too?

>
>> Thanks,
>> Pavel