[RFC] Introduce CAP_CHECKPOINT capability and filter map_files/access

[Cyrill Gorcunov]

The goal idea of checkpoint/restore is to provide this feature not
for admins only but regular users as well. Still some operations
are privileged -- such as accessing /proc/$pid/map_files.

So instead of requiring anyone who has a will to checkpoint/restore
processes CAP_SYS_ADMIN privileges, it might (?) be worth to bring a way
less powerful CAP_CHECKPOINT capability.

The following permissions for CAP_CHECKPOINT should be granted
 - read/write /proc/$pid/map_files/
 - (not yet merged) clone-with-specified-pid, might be changed to last_pid+clone setup
 - (not yet published/stabilized) prctls calls to tune up vDSO and elements
   of mm_struct such as mm->start_code, mm->end_code, mm->start_data and etc

I would like to gather people opinions on such approach as a general.
_ANY_ comments are highly appreciated. Would it worth it or not (since
CAPs space is pretty limited one).

(the patch is on top of -mm)

*NOT-FOR-INCLUSION*
---
 fs/proc/base.c             |    6 ++++--
 include/linux/capability.h |    7 ++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

Index: linux-2.6.git/fs/proc/base.c
===================================================================
--- linux-2.6.git.orig/fs/proc/base.c
+++ linux-2.6.git/fs/proc/base.c
@@ -2386,7 +2386,8 @@ static struct dentry *proc_map_files_loo
 	struct mm_struct *mm;
 
 	result = ERR_PTR(-EACCES);
-	if (!capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN) &&
+	    !capable(CAP_CHECKPOINT))
 		goto out;
 
 	result = ERR_PTR(-ENOENT);
@@ -2442,7 +2443,8 @@ proc_map_files_readdir(struct file *filp
 	int ret;
 
 	ret = -EACCES;
-	if (!capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN) &&
+	    !capable(CAP_CHECKPOINT))
 		goto out;
 
 	ret = -ENOENT;
Index: linux-2.6.git/include/linux/capability.h
===================================================================
--- linux-2.6.git.orig/include/linux/capability.h
+++ linux-2.6.git/include/linux/capability.h
@@ -360,8 +360,13 @@ struct cpu_vfs_cap_data {
 
 #define CAP_WAKE_ALARM            35
 
+/*
+ * Allow to use privilege operations needed for
+ * checkpoint/restore procedure.
+ */
+#define CAP_CHECKPOINT             36
 
-#define CAP_LAST_CAP         CAP_WAKE_ALARM
+#define CAP_LAST_CAP         CAP_CHECKPOINT
 
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/