The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent.
Unified · Split
| @@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 548 unmodified lines | ||
| 549 | 549 | |
| 550 | 550 | BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); |
| 551 | 551 | |
| 552 | + /* | |
| 553 | + * Release agent gets called with all capabilities, | |
| 554 | + * require capabilities to set release agent. | |
| 555 | + */ | |
| 556 | + if ((of->file->f_cred->user_ns != &init_user_ns) || | |
| 557 | + !capable(CAP_SYS_ADMIN)) | |
| 558 | + return -EPERM; | |
| 559 | + | |
| 552 | 560 | cgrp = cgroup_kn_lock_live(of->kn, false); |
| 553 | 561 | if (!cgrp) |
| 554 | 562 | return -ENODEV; |
| @@ -954,6 +962,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) · 399 unmodified lines | ||
| 954 | 962 | /* Specifying two release agents is forbidden */ |
| 955 | 963 | if (ctx->release_agent) |
| 956 | 964 | return invalfc(fc, "release_agent respecified"); |
| 965 | + /* | |
| 966 | + * Release agent gets called with all capabilities, | |
| 967 | + * require capabilities to set release agent. | |
| 968 | + */ | |
| 969 | + if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) | |
| 970 | + return invalfc(fc, "Setting release_agent not allowed"); | |
| 957 | 971 | ctx->release_agent = param->string; |
| 958 | 972 | param->string = NULL; |
| 959 | 973 | break; |