Messages in this thread | | | Date | Sun, 20 Oct 2013 14:10:56 +0400 | Subject | Re: adjust /proc/PID/oom_score_adj with CAP_SYS_RESOURCE | From | Azat Khuzhin <> |
| |
On Sun, Oct 20, 2013 at 12:33 AM, Azat Khuzhin <a.khuzhin@semrush.com> wrote: > Recently I needed in adjusting /proc/PID/oom_score_adj to disable oom killer, > but I didn't want to add suid/or run from root that binary. > > I decided to use CAP_SYS_RESOURCE. However it didn't work. > > I gdb/strace/printk a lot, and finally found the reason, > the process can't open this file for writing because pid_revalidate() > change i_uid/i_gid for it to GLOBAL_ROOT_UID/GID.
Here is some more information:
For binary with CAP_SYS_RESOURCE we have Breakpoint 17, pid_revalidate (gdb) p task->mm->flags $85 = 204 (gdb) p (task->mm->flags & 3) $86 = 0 (gdb) p (task->mm->flags & 3) > 1 ? 2 : 0 $87 = 0
For binary without: Breakpoint 17, pid_revalidate (gdb) p task->mm->flags $85 = 205 (gdb) p (task->mm->flags & 3) $86 = 1 (gdb) p (task->mm->flags & 3) > 1 ? 2 : 1 $87 = 1
(Where 3 is MMF_DUMPABLE_MASK.) In pid_revalidate() checks does $87 != 0, if so, set i_{uid,gid} from cred, otherwise set it to 0.
And that's why process can open "oom_score_adj" without capabilities (but can't write to it)
> And to bypass this check I must to use CAP_DAC_OVERRIDE, which is not so good, > because this will allow more capabilities than I need for that binary. > > Is this works by design, > and/or is there another way to do this without suid/root? > > Thanks! > > -- > Respectfully > Azat Khuzhin
-- Respectfully Azat Khuzhin
| |