• Cyrill Gorcunov's avatar
    c/r: prctl: add PR_SET_MM codes to set up mm_struct entries · 028ee4be
    Cyrill Gorcunov authored
    When we restore a task we need to set up text, data and data heap sizes
    from userspace to the values a task had at checkpoint time.  This patch
    adds auxilary prctl codes for that.
    
    While most of them have a statistical nature (their values are involved
    into calculation of /proc/<pid>/statm output) the start_brk and brk values
    are used to compute an allowed size of program data segment expansion.
    Which means an arbitrary changes of this values might be dangerous
    operation.  So to restrict access the following requirements applied to
    prctl calls:
    
     - The process has to have CAP_SYS_ADMIN capability granted.
     - For all opcodes except start_brk/brk members an appropriate
       VMA area must exist and should fit certain VMA flags,
       such as:
       - code segment must be executable but not writable;
       - data segment must not be executable.
    
    start_brk/brk values must not intersect with data segment and must not
    exceed RLIMIT_DATA resource limit.
    
    Still the main guard is CAP_SYS_ADMIN capability check.
    
    Note the kernel should be compiled with CONFIG_CHECKPOINT_RESTORE support
    otherwise these prctl calls will return -EINVAL.
    
    [akpm@linux-foundation.org: cache current->mm in a local, saving 200 bytes text]
    Signed-off-by: default avatarCyrill Gorcunov <gorcunov@openvz.org>
    Reviewed-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Andrew Vagin <avagin@openvz.org>
    Cc: Serge Hallyn <serge.hallyn@canonical.com>
    Cc: Pavel Emelyanov <xemul@parallels.com>
    Cc: Vasiliy Kulikov <segoon@openwall.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    028ee4be
sys.c 46.6 KB