lkml.org 
[lkml]   [2013]   [Oct]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: adjust /proc/PID/oom_score_adj with CAP_SYS_RESOURCE
From
On Sun, Oct 20, 2013 at 12:33 AM, Azat Khuzhin <a.khuzhin@semrush.com> wrote:
> Recently I needed in adjusting /proc/PID/oom_score_adj to disable oom killer,
> but I didn't want to add suid/or run from root that binary.
>
> I decided to use CAP_SYS_RESOURCE. However it didn't work.
>
> I gdb/strace/printk a lot, and finally found the reason,
> the process can't open this file for writing because pid_revalidate()
> change i_uid/i_gid for it to GLOBAL_ROOT_UID/GID.

Here is some more information:

For binary with CAP_SYS_RESOURCE we have
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 204
(gdb) p (task->mm->flags & 3)
$86 = 0
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 0
$87 = 0

For binary without:
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 205
(gdb) p (task->mm->flags & 3)
$86 = 1
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 1
$87 = 1

(Where 3 is MMF_DUMPABLE_MASK.)
In pid_revalidate() checks does $87 != 0, if so, set i_{uid,gid} from
cred, otherwise set it to 0.

And that's why process can open "oom_score_adj" without capabilities
(but can't write to it)

> And to bypass this check I must to use CAP_DAC_OVERRIDE, which is not so good,
> because this will allow more capabilities than I need for that binary.
>
> Is this works by design,
> and/or is there another way to do this without suid/root?
>
> Thanks!
>
> --
> Respectfully
> Azat Khuzhin



--
Respectfully
Azat Khuzhin


\
 
 \ /
  Last update: 2013-10-20 12:21    [W:0.036 / U:0.640 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site