Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-08-02 14:52:19 +00:00
Code Issues Projects Releases Wiki Activity

security: Also save gid of user requesting for C/R

Browse source 
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Pavel Emelyanov 2013-09-28 15:51:09 +04:00
parent 6bf63b3f01
commit b4c8c5ae32
4 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
cr-service.c
View file

@ -87,7 +87,7 @@ static int setup_dump_from_req(int sk, CriuOpts *req)
return -1;
}
restrict_uid(ids.uid);
restrict_uid(ids.uid, ids.gid);
if (fstat(sk, &st)) {
pr_perror("Can't get socket stat");

2
crtools.c
View file

@ -72,7 +72,7 @@ int main(int argc, char *argv[])
BUILD_BUG_ON(PAGE_SIZE != PAGE_IMAGE_SIZE);
cr_pb_init();
restrict_uid(getuid());
restrict_uid(getuid(), getgid());
if (argc < 2)
goto usage;

2
include/crtools.h
View file

@ -208,7 +208,7 @@ static inline bool pid_rst_prio(unsigned pid_a, unsigned pid_b)
return pid_a < pid_b;
}
void restrict_uid(unsigned int uid);
void restrict_uid(unsigned int uid, unsigned int gid);
struct proc_status_creds;
bool may_dump(struct proc_status_creds *);
struct _CredsEntry;

10
security.c
View file

@ -3,7 +3,10 @@
#include "proc_parse.h"
#include "log.h"
static unsigned int cr_uid; /* UID which user can C/R */
/*
* UID and GID of user requesting for C/R
*/
static unsigned int cr_uid, cr_gid;
/*
* Setup what user is requesting for dump (via rpc or using
@ -12,10 +15,11 @@ static unsigned int cr_uid; /* UID which user can C/R */
* access to. (Or implement some trickier security policy).
*/
void restrict_uid(unsigned int uid)
void restrict_uid(unsigned int uid, unsigned int gid)
{
pr_info("Restrict C/R with %u uid\n", uid);
pr_info("Restrict C/R with %u:%u uid\n", uid, gid);
cr_uid = uid;
cr_gid = gid;
}
static bool check_uid(unsigned int uid)