The commit is pushed to "branch-rh9-5.14.vz9.1.x-ovz" and will appear at
https://src.openvz.org/scm/ovz/vzkernel.git
after ark-5.14
------>
commit 7db0de7e3053b272295867ddc848c6073ccde783
Author: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Date: Mon Oct 4 21:41:01 2021 +0300
trusted/ve/exec: Allow trusted exec change both on boot and on running
system
By default the protection from "untrusted" binaries execution by VE0
processes is enabled.
The protection can be disabled via
* setting "trusted_exec" kernel boot option
* setting "fs.trusted_exec" sysctl to "1"
If the protection is disabled, "vz_trusted_exec" disk device attribute
value is ignored, the execution is allowed.
https://jira.sw.ru/browse/PSBM-98702
Signed-off-by: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Acked-by: Konstantin Khorenko <khore...@virtuozzo.com>
https://jira.sw.ru/browse/PSBM-129741
Cherry-picked from vz7 commit dccfe19f93c4 ("ve/exec: allow trusted exec
change both on boot and on running system")
Signed-off-by: Valeriy Vdovin <valeriy.vdo...@virtuozzo.com>
Reviewed-by: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khore...@virtuozzo.com>
(cherry picked from vz8 commit 4d7f46beaf9265a0bb1ed57d7e387d838adcd9f8)
Signed-off-by: Andrey Zhadchenko <andrey.zhadche...@virtuozzo.com>
---
fs/exec.c | 1 +
include/linux/sysctl.h | 2 ++
kernel/sysctl.c | 17 +++++++++++++++++
kernel/ve/ve.c | 4 ++++
4 files changed, 24 insertions(+)
diff --git a/fs/exec.c b/fs/exec.c
index 15c3c62cbe23..79a3e0fff4d9 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -65,6 +65,7 @@
#include <linux/vmalloc.h>
#include <linux/io_uring.h>
#include <linux/syscall_user_dispatch.h>
+#include <linux/sysctl.h>
#include <linux/ve.h>
#include <linux/uaccess.h>
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 4c9efe69e435..3c59f962f3f6 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -185,6 +185,8 @@ struct ctl_path {
const char *procname;
};
+extern int trusted_exec;
+
#ifdef CONFIG_SYSCTL
void proc_sys_poll_notify(struct ctl_table_poll *poll);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 55054f136f68..e50829903763 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -109,6 +109,14 @@
#if defined(CONFIG_SYSCTL)
+int trusted_exec;
+static int __init set_trusted_exec(char *str)
+{
+ trusted_exec = 1;
+ return 1;
+}
+__setup("trusted_exec", set_trusted_exec);
+
/* Constants used for minimum and maximum */
#ifdef CONFIG_LOCKUP_DETECTOR
static int sixty = 60;
@@ -3479,6 +3487,15 @@ static struct ctl_table fs_table[] = {
.proc_handler = proc_dointvec_minmax,
.extra1 = SYSCTL_ONE,
},
+ {
+ .procname = "trusted_exec",
+ .data = &trusted_exec,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = &proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
+ },
{ }
};
diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 4123a1bb2136..4d6366925396 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -1273,6 +1273,10 @@ static bool ve_check_trusted_file(struct file *file)
bool exec_from_ct;
bool file_on_host_mount;
+ /* The trusted exec defense is globally off. */
+ if (trusted_exec)
+ return true;
+
/* The current process does not belong to ve0. */
exec_from_ct = !ve_is_super(get_exec_env());
if (exec_from_ct)
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
