[Devel] [PATCH rh9 v2] cgroup-v1: Allow setting release_agent from root Container user_ns

[Konstantin Khorenko]

ms commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") restricts release_agent configuration to init user_ns
only.

Release agent is virtualialized per-Container, so
allow to configure it from top CT userns as well.

We need both checks here because CRIU during restore stage
configures release agent while being in init_user_ns and
in non-root ve cgroup.

https://jira.sw.ru/browse/PSBM-140174

Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
Feature: cgroup: per-CT cgroup release_agent
---
 kernel/cgroup/cgroup-v1.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index f321e6691c46..0b89018474e2 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -554,10 +554,20 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
 	/*
 	 * Release agent gets called with all capabilities,
 	 * require capabilities to set release agent.
+	 *
+	 * Release agent is virtualialized per-Container, so
+	 * allow to configure it from top CT userns as well.
+	 *
+	 * We need both checks here because CRIU during restore stage
+	 * configures release agent while being in init_user_ns and
+	 * in non-root ve cgroup.
 	 */
-	if ((of->file->f_cred->user_ns != &init_user_ns) ||
-	    !capable(CAP_SYS_ADMIN))
+	if (((of->file->f_cred->user_ns != &init_user_ns) ||
+             !capable(CAP_SYS_ADMIN)) &&
+	    ((of->file->f_cred->user_ns != ve_init_user_ns()) ||
+	     !ve_capable(CAP_SYS_ADMIN))) {
 		return -EPERM;
+	}
 
 	cgrp = cgroup_kn_lock_live(of->kn, false);
 	if (!cgrp)
@@ -1089,7 +1099,10 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
 		 * Release agent gets called with all capabilities,
 		 * require capabilities to set release agent.
 		 */
-		if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))
+		if (((of->file->f_cred->user_ns != &init_user_ns) ||
+		     !capable(CAP_SYS_ADMIN)) &&
+		    ((fc->user_ns != ve_init_user_ns()) ||
+		     !ve_capable(CAP_SYS_ADMIN)))
 			return invalfc(fc, "Setting release_agent not allowed");
 		ctx->release_agent = param->string;
 		param->string = NULL;
-- 
2.31.1