<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Re: [Devel] [PATCH] pidns: Limit kill -1 and cap_set_all</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Eric, this problem is a known one. Currently Pavel and Sukadev are working on a appropriate signal management for namespaces.<BR>
<BR>
If you'd first sent this patch for discussion/review to containers@, you'd know that the patch is very incomplete.<BR>
<BR>
Rgrds,<BR>
Kir.<BR>
Sent from my BlackBerry; please reply to kir@openvz.org<BR>
<BR>
-----Original Message-----<BR>
From: devel-bounces@openvz.org <devel-bounces@openvz.org><BR>
To: Linus Torvalds <torvalds@linux-foundation.org><BR>
CC: Linux Containers <containers@lists.osdl.org>; Andrew Morton <akpm@linux-foundation.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>; Oleg Nesterov <oleg@tv-sign.ru><BR>
Sent: Fri Oct 26 16:37:48 2007<BR>
Subject: [Devel] [PATCH] pidns: Limit kill -1 and cap_set_all<BR>
<BR>
<BR>
This patch implements task_in_pid_ns and uses it to limit cap_set_all<BR>
and sys_kill(-1,) to only those tasks in the current pid namespace.<BR>
<BR>
Without this we have a setup for a very nasty surprise.<BR>
<BR>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com><BR>
---<BR>
include/linux/pid_namespace.h | 2 ++<BR>
kernel/capability.c | 3 +++<BR>
kernel/pid.c | 11 +++++++++++<BR>
kernel/signal.c | 5 ++++-<BR>
4 files changed, 20 insertions(+), 1 deletions(-)<BR>
<BR>
diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h<BR>
index 0227e68..b454678 100644<BR>
--- a/include/linux/pid_namespace.h<BR>
+++ b/include/linux/pid_namespace.h<BR>
@@ -78,4 +78,6 @@ static inline struct task_struct *task_child_reaper(struct task_struct *tsk)<BR>
return tsk->nsproxy->pid_ns->child_reaper;<BR>
}<BR>
<BR>
+extern int task_in_pid_ns(struct task_struct *tsk, struct pid_namespace *ns);<BR>
+<BR>
#endif /* _LINUX_PID_NS_H */<BR>
diff --git a/kernel/capability.c b/kernel/capability.c<BR>
index efbd9cd..a801016 100644<BR>
--- a/kernel/capability.c<BR>
+++ b/kernel/capability.c<BR>
@@ -125,6 +125,7 @@ static inline int cap_set_all(kernel_cap_t *effective,<BR>
kernel_cap_t *inheritable,<BR>
kernel_cap_t *permitted)<BR>
{<BR>
+ struct pid_namespace *pid_ns = current->nsproxy->pid_ns;<BR>
struct task_struct *g, *target;<BR>
int ret = -EPERM;<BR>
int found = 0;<BR>
@@ -132,6 +133,8 @@ static inline int cap_set_all(kernel_cap_t *effective,<BR>
do_each_thread(g, target) {<BR>
if (target == current || is_container_init(target->group_leader))<BR>
continue;<BR>
+ if (!task_in_pid_ns(target, pid_ns))<BR>
+ continue;<BR>
found = 1;<BR>
if (security_capset_check(target, effective, inheritable,<BR>
permitted))<BR>
diff --git a/kernel/pid.c b/kernel/pid.c<BR>
index f815455..1c332ca 100644<BR>
--- a/kernel/pid.c<BR>
+++ b/kernel/pid.c<BR>
@@ -430,6 +430,17 @@ struct pid *find_get_pid(pid_t nr)<BR>
return pid;<BR>
}<BR>
<BR>
+static int pid_in_pid_ns(struct pid *pid, struct pid_namespace *ns)<BR>
+{<BR>
+ return pid && (ns->level <= pid->level) &&<BR>
+ pid->numbers[ns->level].ns == ns;<BR>
+}<BR>
+<BR>
+int task_in_pid_ns(struct task_struct *task, struct pid_namespace *ns)<BR>
+{<BR>
+ return pid_in_pid_ns(task_pid(task), ns);<BR>
+}<BR>
+<BR>
pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)<BR>
{<BR>
struct upid *upid;<BR>
diff --git a/kernel/signal.c b/kernel/signal.c<BR>
index 1200630..8f5a31f 100644<BR>
--- a/kernel/signal.c<BR>
+++ b/kernel/signal.c<BR>
@@ -1147,10 +1147,13 @@ static int kill_something_info(int sig, struct siginfo *info, int pid)<BR>
} else if (pid == -1) {<BR>
int retval = 0, count = 0;<BR>
struct task_struct * p;<BR>
+ struct pid_namespace *ns = current->nsproxy->pid_ns;<BR>
<BR>
read_lock(&tasklist_lock);<BR>
for_each_process(p) {<BR>
- if (p->pid > 1 && !same_thread_group(p, current)) {<BR>
+ if (!is_container_init(p) &&<BR>
+ !same_thread_group(p, current) &&<BR>
+ task_in_pid_ns(p, ns)) {<BR>
int err = group_send_sig_info(sig, info, p);<BR>
++count;<BR>
if (err != -EPERM)<BR>
--<BR>
1.5.3.rc6.17.g1911<BR>
<BR>
_______________________________________________<BR>
Containers mailing list<BR>
Containers@lists.linux-foundation.org<BR>
<A HREF="https://lists.linux-foundation.org/mailman/listinfo/containers">https://lists.linux-foundation.org/mailman/listinfo/containers</A><BR>
<BR>
_______________________________________________<BR>
Devel mailing list<BR>
Devel@openvz.org<BR>
<A HREF="https://openvz.org/mailman/listinfo/devel">https://openvz.org/mailman/listinfo/devel</A><BR>
</FONT>
</P>
</BODY>
</HTML>