Re: [PATCH] prctl: require checkpoint_restore_ns_capable for PR_SET_MM_MAP

[Lorenzo Stoakes (Oracle)]

On Thu, Apr 02, 2026 at 02:57:51PM +0200, Oleg Nesterov wrote:
> On 04/02, Qi Tang wrote:
> >
> > The original commit f606b77f1a9e ("prctl: PR_SET_MM -- introduce
> > PR_SET_MM_MAP operation") states "we require the caller to be at least
> > user-namespace root user", but this was never enforced in the code.
> >
> > Add a checkpoint_restore_ns_capable() check at the top of
> > prctl_set_mm_map(), after the PR_SET_MM_MAP_SIZE early return.  This
> > requires CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN in the caller's
> > user namespace, matching the stated design intent and the existing
> > check for exe_fd changes.
>
> Can't really comment... but if you add this check at the start, then you
> should also remove the same checkpoint_restore_ns_capable() check below?
> In the "if (prctl_map.exe_fd != (u32)-1)" block.

Ah yeah we noticed the same thing :)

But also as per sub-thread, I question this patch in general... :)

>
> Oleg.
>
>
> > Fixes: f606b77f1a9e ("prctl: PR_SET_MM -- introduce PR_SET_MM_MAP operation")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Cc: Cyrill Gorcunov <gorcunov@xxxxxxxxxx>
> > Signed-off-by: Qi Tang <tpluszz77@xxxxxxxxx>
> > ---
> >  kernel/sys.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/kernel/sys.c b/kernel/sys.c
> > index c86eba9aa7e9..2b8c57f23a35 100644
> > --- a/kernel/sys.c
> > +++ b/kernel/sys.c
> > @@ -2071,6 +2071,9 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
> >  		return put_user((unsigned int)sizeof(prctl_map),
> >  				(unsigned int __user *)addr);
> >
> > +	if (!checkpoint_restore_ns_capable(current_user_ns()))
> > +		return -EPERM;
> > +
> >  	if (data_size != sizeof(prctl_map))
> >  		return -EINVAL;
> >
> > --
> > 2.43.0
> >
>

Cheers, Lorenzo