The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 548 unmodified lines | |||
| 549 | 549 | ||
| 550 | BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); | 550 | BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); |
| 551 | 551 | ||
| 552 | /* | ||
| 553 | * Release agent gets called with all capabilities, | ||
| 554 | * require capabilities to set release agent. | ||
| 555 | */ | ||
| 556 | if ((of->file->f_cred->user_ns != &init_user_ns) || | ||
| 557 | !capable(CAP_SYS_ADMIN)) | ||
| 558 | return -EPERM; | ||
| 559 | |||
| 552 | cgrp = cgroup_kn_lock_live(of->kn, false); | 560 | cgrp = cgroup_kn_lock_live(of->kn, false); |
| 553 | if (!cgrp) | 561 | if (!cgrp) |
| 554 | return -ENODEV; | 562 | return -ENODEV; |
| @@ -954,6 +962,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) · 399 unmodified lines | |||
| 954 | /* Specifying two release agents is forbidden */ | 962 | /* Specifying two release agents is forbidden */ |
| 955 | if (ctx->release_agent) | 963 | if (ctx->release_agent) |
| 956 | return invalfc(fc, "release_agent respecified"); | 964 | return invalfc(fc, "release_agent respecified"); |
| 965 | /* | ||
| 966 | * Release agent gets called with all capabilities, | ||
| 967 | * require capabilities to set release agent. | ||
| 968 | */ | ||
| 969 | if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) | ||
| 970 | return invalfc(fc, "Setting release_agent not allowed"); | ||
| 957 | ctx->release_agent = param->string; | 971 | ctx->release_agent = param->string; |
| 958 | param->string = NULL; | 972 | param->string = NULL; |
| 959 | break; | 973 | break; |