Re: adjust /proc/PID/oom_score_adj with CAP_SYS_RESOURCE

[Azat Khuzhin]

On Sun, Oct 20, 2013 at 12:33 AM, Azat Khuzhin <a.khuzhin@xxxxxxxxxxx> wrote:
> Recently I needed in adjusting /proc/PID/oom_score_adj to disable oom killer,
> but I didn't want to add suid/or run from root that binary.
>
> I decided to use CAP_SYS_RESOURCE. However it didn't work.
>
> I gdb/strace/printk a lot, and finally found the reason,
> the process can't open this file for writing because pid_revalidate()
> change i_uid/i_gid for it to GLOBAL_ROOT_UID/GID.

Here is some more information:

For binary with CAP_SYS_RESOURCE we have
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 204
(gdb) p (task->mm->flags & 3)
$86 = 0
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 0
$87 = 0

For binary without:
Breakpoint 17, pid_revalidate
(gdb) p task->mm->flags
$85 = 205
(gdb) p (task->mm->flags & 3)
$86 = 1
(gdb) p (task->mm->flags & 3) > 1 ? 2 : 1
$87 = 1

(Where 3 is MMF_DUMPABLE_MASK.)
In pid_revalidate() checks does $87 != 0, if so, set i_{uid,gid} from
cred, otherwise set it to 0.

And that's why process can open "oom_score_adj" without capabilities
(but can't write to it)

> And to bypass this check I must to use CAP_DAC_OVERRIDE, which is not so good,
> because this will allow more capabilities than I need for that binary.
>
> Is this works by design,
> and/or is there another way to do this without suid/root?
>
> Thanks!
>
> --
> Respectfully
> Azat Khuzhin



-- 
Respectfully
Azat Khuzhin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/