Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-08-01 22:33:30 +00:00
Code Issues Projects Releases Wiki Activity

security: Push full creds info into may_xxx checks

Browse source 
It's not enough to check only uids on dump and restore -- we need to
check e-ids and s-ids now (and caps in the future).

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Pavel Emelyanov 2013-09-28 15:48:44 +04:00
parent 547d9bf959
commit 6bf63b3f01
4 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
cr-dump.c
View file

@ -1388,7 +1388,7 @@ static int dump_one_task(struct pstree_item *item)
if (ret)
goto err;
if (!may_dump_uid(cr.uids[0])) {
if (!may_dump(&cr)) {
ret = -1;
pr_err("Check uid (pid: %d) failed\n", pid);
goto err;

2
cr-restore.c
View file

@ -1957,7 +1957,7 @@ static int prepare_creds(int pid, struct task_restore_core_args *args)
return -1;
}
if (!may_restore_uid(ce->uid))
if (!may_restore(ce))
return -1;
args->creds = *ce;

6
include/crtools.h
View file

@ -209,7 +209,9 @@ static inline bool pid_rst_prio(unsigned pid_a, unsigned pid_b)
}
void restrict_uid(unsigned int uid);
bool may_dump_uid(unsigned int uid);
bool may_restore_uid(unsigned int uid);
struct proc_status_creds;
bool may_dump(struct proc_status_creds *);
struct _CredsEntry;
bool may_restore(struct _CredsEntry *);
#endif /* __CR_CRTOOLS_H__ */

9
security.c
View file

@ -1,5 +1,6 @@
#include <unistd.h>
#include "crtools.h"
#include "proc_parse.h"
#include "log.h"
static unsigned int cr_uid; /* UID which user can C/R */
@ -27,8 +28,10 @@ static bool check_uid(unsigned int uid)
return false;
}
bool may_dump_uid(unsigned int uid)
bool may_dump(struct proc_status_creds *creds)
{
unsigned int uid = creds->uids[0];
if (check_uid(uid))
return true;
@ -36,8 +39,10 @@ bool may_dump_uid(unsigned int uid)
return false;
}
bool may_restore_uid(unsigned int uid)
bool may_restore(CredsEntry *creds)
{
unsigned int uid = creds->uid;
if (check_uid(uid))
return true;