[Devel] [PATCH vz10 08/24] ve: don't WARN on untrusted exec/mmap attempts from a container

[Pavel Tikhomirov]

On 7/6/26 12:59, Konstantin Khorenko wrote:
> ve_check_trusted_exec()/ve_check_trusted_mmap() fire WARN(1, ...) when a
> process tries to exec/mmap a container (VEX) file it is not allowed to.
> That path is triggerable by unprivileged container activity, so it taints
> the kernel, emits a full backtrace and, under panic_on_warn, lets a
> container DoS the host. The condition is an expected, handled policy
> denial (the caller is SIGSEGV'd and false returned), not a kernel bug.
> 
> The block is already rate-limited via sigsegv_rs; keep the diagnostic and
> the SIGSEGV but downgrade WARN() to pr_warn() so it no longer taints or
> backtraces.

Change is sound, but the commit message is off.

Note that the patched prints explicitly say "VE0", which means host.
Container can't trigger it, this mechanism is to protect host from accidentally
executing something prepared by container for us to run (e.g. exploit).

We don't need explicit WARN panic here, the caller will be killed by SIGSEGV
and collect core, that should be enough to report this problem. So I agree
that we can downgrade to pr_warn.

Please rewrite the comment.

> 
> Fixes: aa60c6194cfd ("trusted/ve/mmap: Protect from unsecure library load from CT image")
> Fixes: 2ae1bae0bd95 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
> Feature: security/fs: tructed exec feature
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
> ---
>  kernel/ve/ve.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index e58ffb22da87..550fac57436b 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -1739,8 +1739,8 @@ bool ve_check_trusted_mmap(struct file *file)
>  	if (file->f_path.dentry)
>  		filename = file->f_path.dentry->d_name.name;
>  
> -	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
> -			current->comm, filename);
> +	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
> +		current->comm, filename);
>  	force_sigsegv(SIGSEGV);
>  	return false;
>  }
> @@ -1759,7 +1759,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
>  	if (!__ratelimit(&sigsegv_rs))
>  		return false;
>  
> -	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
> +	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
>  		current->comm, name->name);
>  	force_sigsegv(SIGSEGV);
>  	return false;

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.