[Devel] [PATCH vz10 08/24] ve: don't WARN on untrusted exec/mmap attempts from a container

[Konstantin Khorenko]

ve_check_trusted_exec()/ve_check_trusted_mmap() fire WARN(1, ...) when a
process tries to exec/mmap a container (VEX) file it is not allowed to.
That path is triggerable by unprivileged container activity, so it taints
the kernel, emits a full backtrace and, under panic_on_warn, lets a
container DoS the host. The condition is an expected, handled policy
denial (the caller is SIGSEGV'd and false returned), not a kernel bug.

The block is already rate-limited via sigsegv_rs; keep the diagnostic and
the SIGSEGV but downgrade WARN() to pr_warn() so it no longer taints or
backtraces.

Fixes: aa60c6194cfd ("trusted/ve/mmap: Protect from unsecure library load from CT image")
Fixes: 2ae1bae0bd95 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
Feature: security/fs: tructed exec feature
https://virtuozzo.atlassian.net/browse/VSTOR-137234
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 kernel/ve/ve.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index e58ffb22da87..550fac57436b 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -1739,8 +1739,8 @@ bool ve_check_trusted_mmap(struct file *file)
 	if (file->f_path.dentry)
 		filename = file->f_path.dentry->d_name.name;
 
-	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
-			current->comm, filename);
+	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
+		current->comm, filename);
 	force_sigsegv(SIGSEGV);
 	return false;
 }
@@ -1759,7 +1759,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
 	if (!__ratelimit(&sigsegv_rs))
 		return false;
 
-	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
+	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
 		current->comm, name->name);
 	force_sigsegv(SIGSEGV);
 	return false;
-- 
2.47.1