Commit 12886f8a authored Jul 19, 2020 by Adrian Reber Committed by Christian Brauner Jul 19, 2020

proc: allow access in init userns for map_files with CAP_CHECKPOINT_RESTORE



Opening files in /proc/pid/map_files when the current user is
CAP_CHECKPOINT_RESTORE capable in the root namespace is useful for
checkpointing and restoring to recover files that are unreachable via
the file system such as deleted files, or memfd files.

Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Link: https://lore.kernel.org/r/20200719100418.2112740-5-areber@redhat.com


Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

parent b9a3db92

fs/proc/base.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -2189,16 +2189,16 @@ struct map_files_info {
		};

		/*
		* Only allow CAP_SYS_ADMIN to follow the links, due to concerns about how the
		* symlinks may be used to bypass permissions on ancestor directories in the
		* path to the file in question.
		* Only allow CAP_SYS_ADMIN and CAP_CHECKPOINT_RESTORE to follow the links, due
		* to concerns about how the symlinks may be used to bypass permissions on
		* ancestor directories in the path to the file in question.
		*/
		static const char *
		proc_map_files_get_link(struct dentry *dentry,
		struct inode *inode,
		struct delayed_call *done)
		{
		if (!capable(CAP_SYS_ADMIN))
		if (!checkpoint_restore_ns_capable(&init_user_ns))
		return ERR_PTR(-EPERM);

		return proc_pid_get_link(dentry, inode, done);

Admin message