mir/criu
2
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu synced 2025-08-22 09:58:09 +00:00
Code Issues Releases Wiki Activity

memfd: dump and restore permissions.

Browse Source 
memfd is created by default with +x permissions set. This can be changed
by a process using fchmod() and expected to prevent using this fd for
exec(). Migrate the permissions.

Signed-off-by: Michał Mirosław <emmir@google.com>
This commit is contained in:
Michał Mirosław 2023-07-27 21:21:41 +02:00 committed by Andrei Vagin
parent ac1219f4ee
commit dfa5410951
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
criu/memfd.c
View File

@ -91,6 +91,8 @@ static int dump_memfd_inode(int fd, struct memfd_dump_inode *inode, const char *
mie.has_hugetlb_flag = true; mie.has_hugetlb_flag = true;
mie.hugetlb_flag = flag | MFD_HUGETLB; mie.hugetlb_flag = flag | MFD_HUGETLB;
} }
mie.mode = st->st_mode;
mie.has_mode = true;
mie.seals = fcntl(fd, F_GET_SEALS); mie.seals = fcntl(fd, F_GET_SEALS);
if (mie.seals == -1) { if (mie.seals == -1) {
@ -279,8 +281,13 @@ static int memfd_open_inode_nocache(struct memfd_restore_inode *inode)
if (restore_memfd_shmem_content(fd, mie->shmid, mie->size)) if (restore_memfd_shmem_content(fd, mie->shmid, mie->size))
goto out; goto out;
if (cr_fchown(fd, mie->uid, mie->gid)) { if (mie->has_mode)
pr_perror("Can't change uid %d gid %d of memfd:%s", (int)mie->uid, (int)mie->gid, mie->name); ret = cr_fchperm(fd, mie->uid, mie->gid, mie->mode);
else
ret = cr_fchown(fd, mie->uid, mie->gid);
if (ret) {
pr_perror("Can't set permissions { uid %d gid %d mode %#o } of memfd:%s", (int)mie->uid,
(int)mie->gid, mie->has_mode ? (int)mie->mode : -1, mie->name);
goto out; goto out;
} }

1
images/memfd.proto
View File

@ -22,4 +22,5 @@ message memfd_inode_entry {
required uint32 seals = 6 [(criu).flags = "seals.flags"]; required uint32 seals = 6 [(criu).flags = "seals.flags"];
required uint64 inode_id = 7; required uint64 inode_id = 7;
optional uint32 hugetlb_flag = 8; optional uint32 hugetlb_flag = 8;
optional uint32 mode = 9;
}; };