v2 security: set suid flag on crtools and check real uid on dump/restore

v2: remove redundant functions and variables.
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

cr-restore.c

@@ -1957,6 +1957,9 @@ static int prepare_creds(int pid, struct task_restore_core_args *args)
 		return -1;
 	}
 
+	if (!may_restore_uid(ce->uid))
+		return -1;
+
 	args->creds = *ce;
 	args->creds.cap_inh = args->cap_inh;
 	memcpy(args->cap_inh, ce->cap_inh, sizeof(args->cap_inh));

crtools.c

@@ -72,6 +72,7 @@ int main(int argc, char *argv[])
 	BUILD_BUG_ON(PAGE_SIZE != PAGE_IMAGE_SIZE);
 
 	cr_pb_init();
+	restrict_uid(getuid());
 
 	if (argc < 2)
 		goto usage;

include/crtools.h

@@ -210,5 +210,6 @@ static inline bool pid_rst_prio(unsigned pid_a, unsigned pid_b)
 
 void restrict_uid(unsigned int uid);
 bool may_dump_uid(unsigned int uid);
+bool may_restore_uid(unsigned int uid);
 
 #endif /* __CR_CRTOOLS_H__ */

security.c

@@ -2,7 +2,7 @@
 #include "crtools.h"
 #include "log.h"
 
-static unsigned int dumper_uid = 0;
+static unsigned int cr_uid; /* UID which user can C/R */
 
 /*
  * Setup what user is requesting for dump (via rpc or using 
@@ -14,16 +14,33 @@ static unsigned int dumper_uid = 0;
 void restrict_uid(unsigned int uid)
 {
 	pr_info("Restrict C/R with %u uid\n", uid);
-	dumper_uid = uid;
+	cr_uid = uid;
+}
+
+static bool check_uid(unsigned int uid)
+{
+	if (cr_uid == 0)
+		return true;
+	if (cr_uid == uid)
+		return true;
+
+	return false;
 }
 
 bool may_dump_uid(unsigned int uid)
 {
-	if (dumper_uid == 0)
+	if (check_uid(uid))
 		return true;
-	if (dumper_uid == uid)
+
+	pr_err("UID (%u) != dumper's UID(%u)\n", uid, cr_uid);
+	return false;
+}
+
+bool may_restore_uid(unsigned int uid)
+{
+	if (check_uid(uid))
 		return true;
 
-	pr_err("UID (%u) != dumper's UID(%u)\n", uid, dumper_uid);
+	pr_err("UID (%u) != restorer's UID(%u)\n", uid, cr_uid);
 	return false;
 }