From patchwork Sat Dec 17 04:43:46 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 9478859 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7296A60827 for ; Sat, 17 Dec 2016 04:44:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 621EF2863C for ; Sat, 17 Dec 2016 04:44:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 439FD2866D; Sat, 17 Dec 2016 04:44:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 00EDF2863C for ; Sat, 17 Dec 2016 04:44:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755792AbcLQEoC (ORCPT ); Fri, 16 Dec 2016 23:44:02 -0500 Received: from mail-pf0-f178.google.com ([209.85.192.178]:35000 "EHLO mail-pf0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752223AbcLQEoA (ORCPT ); Fri, 16 Dec 2016 23:44:00 -0500 Received: by mail-pf0-f178.google.com with SMTP id i88so16847364pfk.2 for ; Fri, 16 Dec 2016 20:43:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=0hOBGDyJviQMwmaRks0U1W3t661fZc7cCnjwGstr9r0=; b=YwfRpYJxxByCRFLND73S4/v/cwBnJMlqGOZ6abW2h4Ry2t1vPhqpa5/AL1IgPF3vjs eiwiTd9rgsAPSHOMhi9b3+bjxADdLN/Lo+68qmqn8B8OpRIezzG6npEQouW+Tjeq3gzv 4nSFw4SE/ORks1aztzgyr5hPlUtfijMUMGfWM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=0hOBGDyJviQMwmaRks0U1W3t661fZc7cCnjwGstr9r0=; b=RtJkbL5izOtmrf0u0T5Omzx9Y4RCFDcSeXcD949DIJdn/F7cZeEaAtVg5q0i7XO62i CJZsFu5ioFI0rT5C6T875Ky1Aw1sEalLgWv6Aj3B/otp04eBurTv0++I7cZyD3v6w/My 2J728mP2WGal5ujOfmt4xPcu79YNF8jjkSURWAKSSsB/mK26AfUR5x2bUS5SLx0ZYfdZ E5Bxnq6rYYKkXVETg6BEYgZixnJGge+k0ASu5xFSoKRdp4RR0xhswXW4iqdWi/CI8Esw DykkXrnxuM3WVPDWzA4m4WLzpvlF8v/kQLprDPHwsXMVYaioJrclcrkAfyo33ZO//bsb IAjQ== X-Gm-Message-State: AKaTC02xlxZF8nPdMivwQAr6I/Nz0EyvDCCIbjxDMB8LBf5qOCOhZXofynefPRjb7jTbVcs5 X-Received: by 10.99.146.76 with SMTP id s12mr12008386pgn.8.1481949839258; Fri, 16 Dec 2016 20:43:59 -0800 (PST) Received: from localhost.localdomain ([2601:1c2:1002:83f0:4e72:b9ff:fe99:466a]) by smtp.gmail.com with ESMTPSA id t125sm4557452pgb.4.2016.12.16.20.43.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 16 Dec 2016 20:43:57 -0800 (PST) From: John Stultz To: lkml Cc: John Stultz , Tejun Heo , Li Zefan , Jonathan Corbet , cgroups@vger.kernel.org, Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , Andy Lutomirski , linux-api@vger.kernel.org, Paul Moore , Stephen Smalley , Eric Paris , James Morris , Jeff Vander Stoep , linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Subject: [PATCH] cgroup: Add new capability to allow a process to migrate other tasks between cgroups Date: Fri, 16 Dec 2016 20:43:46 -0800 Message-Id: <1481949827-23613-1-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 2.7.4 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patch adds CAP_GROUP and logic to allows a process to migrate other tasks between cgroups. In Android (where this feature originated), the ActivityManager tracks various application states (TOP_APP, FOREGROUND, BACKGROUND, SYSTEM, etc), and then as applications change states, the SchedPolicy logic will migrate the application tasks between different cgroups used to control the different application states (for example, there is a background cpuset cgroup which can limit background tasks to stay on one low-power cpu, and the bg_non_interactive cpuctrl cgroup can then further limit those background tasks to a small percentage of that one cpu's cpu time). However, for security reasons, Android doesn't want to make the system_server (the process that runs the ActivityManager and SchedPolicy logic), run as root. So in the Android common.git kernel, they have some logic to allow cgroups to loosen their permissions so CAP_SYS_NICE tasks can migrate other tasks between cgroups. I feel the approach taken there overloads CAP_SYS_NICE a bit much for non-android environments. Efforts to re-use CAP_SYS_RESOURCE for this purpose (which Android has since adopted) was also stymied by concerns about risks from future cgroups that could be considered "dangerous" by how they might change system semantics. So to avoid overlapping usage, this patch adds a brand new process capability flag (CAP_CGROUP), and uses it when checking if a task can migrate other tasks between cgroups. I've tested this with AOSP master (though its a bit hacked in as I still need to properly get the selinux userspace bits aware of the new capability bit) with selinux set to permissive and it seems to be working well. Thoughts and feedback would be appreciated! (Note, I'm going on holiday break after today, so I may not respond to feedback immediately, but I figured it would be better to give folks the chance to review this rather then sit it for two weeks. I'll resend after the new-year, addressing any feedback I do get.) Cc: Tejun Heo Cc: Li Zefan Cc: Jonathan Corbet Cc: cgroups@vger.kernel.org Cc: Android Kernel Team Cc: Rom Lemarchand Cc: Colin Cross Cc: Dmitry Shmidt Cc: Todd Kjos Cc: Christian Poetzsch Cc: Amit Pundir Cc: Dmitry Torokhov Cc: Kees Cook Cc: Serge E. Hallyn Cc: Andy Lutomirski Cc: linux-api@vger.kernel.org Cc: Paul Moore Cc: Stephen Smalley Cc: Eric Paris Cc: James Morris Cc: Jeff Vander Stoep Cc: linux-security-module@vger.kernel.org Cc: selinux@tycho.nsa.gov Signed-off-by: John Stultz --- v2: Renamed to just CAP_CGROUP_MIGRATE as reccomended by Tejun v3: Switched to just using CAP_SYS_RESOURCE as suggested by Michael v4: Send out properly folded down version of the patch. :P v5: Switch back to CAP_CGROUP_MIGRATE due to concerns from Andy v6: Rename to CAP_CGROUP, as it might be used for other purposes in the future. Also added selinux mappings for the new cap. --- include/uapi/linux/capability.h | 5 ++++- kernel/cgroup.c | 3 ++- security/selinux/include/classmap.h | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h index 49bc062..726f767 100644 --- a/include/uapi/linux/capability.h +++ b/include/uapi/linux/capability.h @@ -349,8 +349,11 @@ struct vfs_cap_data { #define CAP_AUDIT_READ 37 +/* Allow migration of other tasks between cgroups */ -#define CAP_LAST_CAP CAP_AUDIT_READ +#define CAP_CGROUP 38 + +#define CAP_LAST_CAP CAP_CGROUP #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 2ee9ec3..8b42ae3 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2856,7 +2856,8 @@ static int cgroup_procs_write_permission(struct task_struct *task, */ if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && - !uid_eq(cred->euid, tcred->suid)) + !uid_eq(cred->euid, tcred->suid) && + !ns_capable(tcred->user_ns, CAP_CGROUP)) ret = -EACCES; if (!ret && cgroup_on_dfl(dst_cgrp)) { diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index e2d4ad3a..ee8c1ed 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -22,9 +22,9 @@ "audit_control", "setfcap" #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ - "wake_alarm", "block_suspend", "audit_read" + "wake_alarm", "block_suspend", "audit_read", "cgroup" -#if CAP_LAST_CAP > CAP_AUDIT_READ +#if CAP_LAST_CAP > CAP_CGROUP #error New capability defined, please update COMMON_CAP2_PERMS. #endif