Currently this operation requires the global CAP_SYS_RESOURCE. It's required, because a task can exceed limits (RLIMIT_DATA, RLIMIT_STACK).
So let's allow task to change these parameters if a proper limit is unlimited. When we restore a task we need to set up text, data and data heap sizes from userspace to the values a task had at checkpoint time. Currently we can not restore these parameters, if a task lives in a non-root user name space, because it has no capabilities in the parent namespace. Cc: Andrew Morton <[email protected]> Cc: Oleg Nesterov <[email protected]> Cc: Al Viro <[email protected]> Cc: Kees Cook <[email protected]> Cc: "Eric W. Biederman" <[email protected]> Cc: Stephen Rothwell <[email protected]> Cc: Pavel Emelyanov <[email protected]> Cc: Aditya Kali <[email protected]> Signed-off-by: Andrey Vagin <[email protected]> --- kernel/sys.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/kernel/sys.c b/kernel/sys.c index c0a58be..939370c 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1701,8 +1701,23 @@ static int prctl_set_mm(int opt, unsigned long addr, if (arg5 || (arg4 && opt != PR_SET_MM_AUXV)) return -EINVAL; - if (!capable(CAP_SYS_RESOURCE)) - return -EPERM; + if (!capable(CAP_SYS_RESOURCE)) { + switch (opt) { + case PR_SET_MM_START_DATA: + case PR_SET_MM_END_DATA: + case PR_SET_MM_START_BRK: + case PR_SET_MM_BRK: + if (rlim < RLIM_INFINITY) + return -EPERM; + break; + case PR_SET_MM_START_STACK: + if (rlimit(RLIMIT_STACK) < RLIM_INFINITY) + return -EPERM; + break; + default: + return -EPERM; + } + } if (opt == PR_SET_MM_EXE_FILE) return prctl_set_mm_exe_file(mm, (unsigned int)addr); -- 1.8.5.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
