Commit 0469a46a authored by Kirill Tkhai's avatar Kirill Tkhai Committed by Andrei Vagin

seize: Fix size error in creds_dumpable()

The goal of this function is to compare everything except caps,
but caps size is took to compare. It's wrong, there must be
used offsetof(struct proc_status_creds, cap_inh) instead.

Also, sigpnd may be different too.

v3: Move excluding sigpnd from comparation in this patch (was in another patch).
    Reorder fields in seize_task_status().
Signed-off-by: 's avatarKirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: 's avatarAndrei Vagin <avagin@virtuozzo.com>
parent 6329e660
...@@ -16,10 +16,10 @@ ...@@ -16,10 +16,10 @@
extern int compel_interrupt_task(int pid); extern int compel_interrupt_task(int pid);
struct seize_task_status { struct seize_task_status {
char state;
int ppid;
unsigned long long sigpnd; unsigned long long sigpnd;
unsigned long long shdpnd; unsigned long long shdpnd;
char state;
int ppid;
int seccomp_mode; int seccomp_mode;
}; };
......
...@@ -629,9 +629,7 @@ static inline bool thread_collected(struct pstree_item *i, pid_t tid) ...@@ -629,9 +629,7 @@ static inline bool thread_collected(struct pstree_item *i, pid_t tid)
static bool creds_dumpable(struct proc_status_creds *parent, static bool creds_dumpable(struct proc_status_creds *parent,
struct proc_status_creds *child) struct proc_status_creds *child)
{ {
const size_t size = sizeof(struct proc_status_creds) - size_t size;
offsetof(struct proc_status_creds, cap_inh);
/* /*
* The comparison rules are the following * The comparison rules are the following
* *
...@@ -640,17 +638,20 @@ static bool creds_dumpable(struct proc_status_creds *parent, ...@@ -640,17 +638,20 @@ static bool creds_dumpable(struct proc_status_creds *parent,
* semantic comparison (FIXME) but for * semantic comparison (FIXME) but for
* now we require them to be exactly * now we require them to be exactly
* identical * identical
* - sigpnd may be different
* - the rest of members must match * - the rest of members must match
*/ */
if (memcmp(parent, child, size)) { size = offsetof(struct proc_status_creds, cap_inh) -
sizeof(parent->s.sigpnd);
if (memcmp(&parent->s.sigpnd, &child->s.sigpnd, size)) {
if (!pr_quelled(LOG_DEBUG)) { if (!pr_quelled(LOG_DEBUG)) {
pr_debug("Creds undumpable (parent:child)\n" pr_debug("Creds undumpable (parent:child)\n"
" uids: %d:%d %d:%d %d:%d %d:%d\n" " uids: %d:%d %d:%d %d:%d %d:%d\n"
" gids: %d:%d %d:%d %d:%d %d:%d\n" " gids: %d:%d %d:%d %d:%d %d:%d\n"
" state: %d:%d" " state: %d:%d"
" ppid: %d:%d\n" " ppid: %d:%d\n"
" sigpnd: %llu:%llu\n"
" shdpnd: %llu:%llu\n" " shdpnd: %llu:%llu\n"
" seccomp_mode: %d:%d\n" " seccomp_mode: %d:%d\n"
" last_filter: %u:%u\n", " last_filter: %u:%u\n",
...@@ -664,7 +665,6 @@ static bool creds_dumpable(struct proc_status_creds *parent, ...@@ -664,7 +665,6 @@ static bool creds_dumpable(struct proc_status_creds *parent,
parent->gids[3], child->gids[3], parent->gids[3], child->gids[3],
parent->s.state, child->s.state, parent->s.state, child->s.state,
parent->s.ppid, child->s.ppid, parent->s.ppid, child->s.ppid,
parent->s.sigpnd, child->s.sigpnd,
parent->s.shdpnd, child->s.shdpnd, parent->s.shdpnd, child->s.shdpnd,
parent->s.seccomp_mode, child->s.seccomp_mode, parent->s.seccomp_mode, child->s.seccomp_mode,
parent->last_filter, child->last_filter); parent->last_filter, child->last_filter);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment