[Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn

[Konstantin Khorenko]

ve_check_trusted_exec()/ve_check_trusted_mmap() protect the host, but
the WARN(1, ...) is too much here:

 * it taints the kernel while this is not a kernel bug which we beed to
   debug and fix
 * the backtrace only shows the exec/mmap path, which is already known
 * on a host booted with panic_on_warn a denied exec takes the host down

The SIGSEGV and the core dump of the offending process are enough to
report and investigate such an attempt. Downgrade the WARN() to
pr_warn(), keeping the message, the rate limiting and the signal.

Fixes: fc7157b84c32 ("trusted/ve/mmap: Protect from unsecure library load from CT image")
Fixes: cc218b70c6b4 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
Feature: security/fs: tructed exec feature
https://virtuozzo.atlassian.net/browse/VSTOR-137234
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
v1 -> v2: commit message rewritten
---
 kernel/ve/ve.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 73d1c3b4873e5..0d43dc3253ea3 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -1745,8 +1745,8 @@ bool ve_check_trusted_mmap(struct file *file)
 	if (file->f_path.dentry)
 		filename = file->f_path.dentry->d_name.name;
 
-	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
-			current->comm, filename);
+	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
+		current->comm, filename);
 	force_sigsegv(SIGSEGV);
 	return false;
 }
@@ -1765,7 +1765,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
 	if (!__ratelimit(&sigsegv_rs))
 		return false;
 
-	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
+	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
 		current->comm, name->name);
 	force_sigsegv(SIGSEGV);
 	return false;
-- 
2.43.0