Commits · 35636a7e048f98c395f52848d3cd52b17c92f3bf · zhul / criu

24 Dec, 2015 26 commits

parasite: Load code blobs via memfd · 35636a7e

Cyrill Gorcunov authored Dec 15, 2015

Currently parasite is loaded using the map_files dir,
which is guarged with CAP_SYS_ADMIN by default (which
is dropped in 4.2 series). So lets do a deal -- try
to use memfd interface first (which has been introduced
in 4.0 kernel series) and if we fail then switch to old
map_files interface.

With time all users are switched to new kernels so
memfd gonna be primary interface.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

35636a7e

proc: Use smaps path for file · 2dcccc61

Pavel Emelyanov authored Dec 15, 2015

Kernel doesn't allow to mess with map_files dir in proc. So,
when doing dump from user process, we should try to get
file path using path from smaps file. To be 100% sure the
path is correct we also get device and ino numbers and
check them agains the stat()-ed path ones.

With this scheme we miss

- mapped packet sockets, but users don't use them
- AIOs, but this can be detected via device, inode and name
- several nested mntns's, but users don't use them
- mapped and unlinked files, but this can be fixed by
  reading file via task's memory (slow, but still)

gorcunov@:

 - For special mappings such as heap, vsyscall, vdso and such
   the kernel provides names rounded by brackets so exit
   from vma_get_mapfile if we meet one and allow the caller
   to handle it.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

2dcccc61

pagemap-cache: Use greedy mode if pagemap inaccessible · a4edef8e

Cyrill Gorcunov authored Dec 15, 2015

If criu is running in unprivileged mode and we can't
access dumpee's pagemap file -- simply switch to
greedy mode where all pages are gonna be dumped
regardless of their presence in memory.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

a4edef8e

vdso: Don't fail if pagemap is not accessbile · d1db4faf

Cyrill Gorcunov authored Dec 15, 2015

We use page frame number to detect vDSO which has been remapped
in-place from runtime vDSO during restore. In such case if the
kernel is younger than 3.16 the "[vdso]" mark won't be reported
in procfs output.

Still to address recently reported CVEs and be able to run CRIU
in unprivileged mode we need to handle vDSO without pagemap access
and here is the deal -- when we find VMA which "looks like" vDSO
we try to scan it for vDSO symbols and if it matches we restore
its status without PFN access.

Here is some details on @pagemap access in-kernel history:

 - @pagemap introduced in commit 85863e475e59 where anyone
   which can attach to a task via ptrace is allowed to read
   data from @pagemap (Feb 4 2008, v2.6.25-rc1)

 - in commit 006ebb40d3d65 ptrace attach rule has been changed
   into ptrace read permission (May 19 2008, v2.6.27-rc1)

 - in commit ab676b7d6fbf4 opening of @pagemap become guarded
   with CAP_SYS_ADMIN because of leak of physical addresses
   into userspace (Mar 9 2015, v4.0-rc5)

 - in commit 1c90308e7a77a opening of @pagemap become available
   for regular users again (with ptrace read permission) but
   physical addresses of pages are hidden from non-privileged
   userd (Sep 8 2015, v4.3-rc1)
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

d1db4faf

dump: Dont read prohibited kernel files · d10835c4

Pavel Emelyanov authored Dec 15, 2015

In particular, we won't be able to do memory tracking and
zero page detection.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>

d10835c4

kerndat: Read anon shmem dev via maps · 2e2e1c13

Pavel Emelyanov authored Dec 15, 2015

Kernel doesn't allow to read /proc/pid/map_files. This file
is used to get pseudo device for anon shmem mappings, but
this info can be get by scanning /proc/self/maps file.

This works slower, but still.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>

2e2e1c13

util: Ability to ignore errno when opening proc · df1729e3

Pavel Emelyanov authored Dec 15, 2015

When run from regular user criu will get EACCES/EPERM from
opening proc, but in some situations criu will now how to
deal with it. So this patch makes it possible not to print
error message in logs for such cases.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>

df1729e3

parasite: Add @pad argument for syscall run · 70681dd8

Cyrill Gorcunov authored Dec 15, 2015

We will need an extra space for memfd based
syscall (without poking the stack since it's
not that safe without additional tests).

So add @pad argument which will be used
to find proper memory for seized syscall
execution.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

70681dd8

proc: Get full file path into handle_vma · 5bfb579e

Pavel Emelyanov authored Dec 15, 2015

Right now we only get first 31 symbols of it, but in the
next patches full path would be required.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>

5bfb579e

criu: Remove security · 6c22bfe2

Pavel Emelyanov authored Dec 15, 2015

We no longer support root-mode service and suid binaries, so
any artificial restrictions no longer make sense.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Looks-good-to-me: Andrew Vagin <avagin@virtuozzo.com>

6c22bfe2

test: different_creds -- Enhance the testing · 35cb5996

Cyrill Gorcunov authored Dec 23, 2015

To test c/r of creds we need more precise way,
so lets add a few additional creds to test.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

35cb5996

zdtm: Add ARRAY_SIZE into the header · e8dd8c63

Cyrill Gorcunov authored Dec 23, 2015

Suitable macro.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

e8dd8c63

zdtm: set the dumpable flag after setuid (v2) · e09f7ea0

Andrew Vagin authored Dec 23, 2015

Otherwise we will not able to access /proc/pid/* for the process.

v2: s/__NR_WAIT4/__NR_setresuid

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

e09f7ea0

zdtm.py: don't worry if a test class doesn't have ns() and static() · 7c11b0b9
Andrew Vagin authored Dec 23, 2015
```
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
```
7c11b0b9

test/inhfd: use os.fdopen instead of a home-made class · 57d73475

Andrew Vagin authored Dec 23, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

57d73475

cpt/rst: access and modification time of ghost files · 6aaa1a2e

Pavel Tikhomirov authored Dec 22, 2015

Modification time changes after cpt/rst file_attr test in VZ7CT:
CT-102 criu# cat test/zdtm/live/static/file_attr.out
15:05:05.315:   146: FAIL: file_attr.c:101: modification time has
changed (errno = 11 (Resource temporarily unavailable))

https://jira.sw.ru/browse/PSBM-41401

v2: add timeval message, test seem to pass now - remove noauto
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

6aaa1a2e

creds: dump -- Implement per-thread dump of credentials · e9fc593c

Cyrill Gorcunov authored Dec 21, 2015

This as well as restore requires several steps to reach per-thread
support during dump stage

 - @creds area to be fetched from the parasite is embedded into
   parasite_dump_structure

 - when test for task to be dumpable we no longer compare caps
   because we now allow them to be different (and I renamed
   proc_status_creds_eq to proc_status_creds_dumpable for this
   sake)

 - have to extend dump_thread_common to support dumping of
   creds (we call for dump_thread_common in several places,
   in particular when we need to fetch misc params we don't
   need creds, here @creds option comes into the play)

 - after this patch no creds-X.img file be generated anymore,
   I guess we might drop it off with time from descriptors

https://jira.sw.ru/browse/PSBM-41416

v2:
 - In dump_task_creds() don't mangle the call for parasite_dump_creds
   and collect_lsm_profile
 - PARASITE_MAX_GROUPS takes parasite_dump_thread into account because
   dump_thread_common now serves two cases: for plain misc parameters
   fetching and for creds as well (depending on the context)
 - when test for dumpable we still require the seccomp filters
   to match, they can be different and we need to support such
   configuration too but not in this series

v3:
 - Rip off dump_task_creds completely, together with PARASITE_CMD_DUMP_CREDS,
   we dump creds unconditionally in dump_thread_common
 - the group leader thread data is fetched via new
   parasite_dump_thread_leader_seized helper
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

e9fc593c

creds: restore -- Implement per-thread restore of credentials · eb5d8442

Cyrill Gorcunov authored Dec 21, 2015

Because the creds parameters are to be passed inside pie/restorer
code but read before thread_restore_args and task_restore_args
structures are allocated we need a small trick and prepare
creds int several stages

 - collect all creds data into separate private memory blobs
 - once all memory needed for restorer is allocated we relocate
   pointers in this blocks and setup
   thread_restore_args::thread_creds_args to appropriate
   address
 - restorer works as usual and setup creds parameters as before

v2:
 - fix addressing in positioning of rst_ memory (I've occasionally
   zap pointers and when been sending patches forgot to merge changes
   back, so while I've the series successfully restoring containers
   with different creds, if been merged the series won't work. So
   all changes are merged as appropriate)

 - drop module's global @cap_last_cap from pie/restorer.c
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

eb5d8442

creds: Move proc_status_creds::cap_X at the end of structure · 212e2105

Cyrill Gorcunov authored Dec 17, 2015

For easier comparision which gonna be addressed in next patch.

https://jira.sw.ru/PSBM-41416Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

212e2105

creds: Allocate CredsEntry for every thread in core_entry_alloc · 85ea6877

Cyrill Gorcunov authored Dec 17, 2015

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

85ea6877

creds: protobuf -- Move @creds_entry into @thread_core_entry · dde0df46

Cyrill Gorcunov authored Dec 17, 2015

Creds are per-thread data, declare them appropriately.
We will need this data to restore threads with different
credentials.

(In a scope of https://jira.sw.ru/browse/PSBM-41416)
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

dde0df46

xmalloc: Add xmemdup helper · 767e3e99

Cyrill Gorcunov authored Dec 17, 2015

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

767e3e99

arm: syscalls -- Wire in sys_setgroups · 9fa11f3a

Cyrill Gorcunov authored Dec 17, 2015

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

9fa11f3a

ppc64: syscalls -- Wire in sys_setgroups · c89ba9a4

Cyrill Gorcunov authored Dec 17, 2015

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

c89ba9a4

x86: syscalls -- Wire in sys_setgroups · 592f45b1

Cyrill Gorcunov authored Dec 17, 2015

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

592f45b1

Fix 'mnt_path' may be used uninitialized in this function · b64159ac
MATSUMOTO, Ryosuke authored Dec 24, 2015
```
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
```
b64159ac

23 Dec, 2015 8 commits

zdtm_ct: Mount binfmt misc in ct creation · 7f75e74a

Pavel Emelyanov authored Dec 23, 2015

The mountpoints.c test creates such mount and criu will try to
kerndat-check one, so this fs should be on "host".
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

7f75e74a

jenkins: Mount binfmt misc in run_ct · a5c2e8cd

Pavel Emelyanov authored Dec 23, 2015

The mountpoints.c test creates such mount and criu will try to
kerndat-check one, so this fs should be on "host".
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

a5c2e8cd

jenkins: build criu with debuginfo · c3e91403

Andrew Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

c3e91403

zdtm/file_locks04: use test_waitsig() to synchronize child and parent · a21ea70d
Andrew Vagin authored Dec 23, 2015
```
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
```
a21ea70d

zdtm/fifo_wronly: wait when a child opens a file descriptor · bd806a78

Andrew Vagin authored Dec 23, 2015

A static test should not change its state during C/R
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

bd806a78

zdtm.sh: remove warnings about existent directories · 64744030

Andrew Vagin authored Dec 22, 2015

and call mknod with correct argumetns
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

64744030

binfmt_misc: Skip dumping if it's not virtual · 36c4cba9

Kirill Tkhai authored Dec 21, 2015

Similar to devtmpfs and devpts, skip binfmt_misc
mount if it's not virtual.
Signed-off-by: Kirill Tkhai <ktkhai@odin.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

36c4cba9

zdtm.py: Test how freeze cgroup works (v2) · 505896e6

Pavel Emelyanov authored Dec 21, 2015

V2: Fix the test/Makefile
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Andrew Vagin <avagin@virtuozzo.com>

505896e6

22 Dec, 2015 6 commits

zdtm/pstree: check return codes · 4d90c130

Andrei Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

4d90c130

zdtm/pstree: read from a correct file descriptor · bd649ceb

Andrei Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

bd649ceb

test: wait when a prepartion stage will be completed · 09d00c41

Andrei Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

09d00c41

pipe00: when while a child is preparing file descriptors · f8550e45

Andrew Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

f8550e45

zdtm/socket_close_data01: wait a child before c/r · d35efb4a

Andrew Vagin authored Dec 22, 2015

A static test should not change its state during C/R.
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

d35efb4a

zdtm/sigpending: wait a child before C/R · 2784095a

Andrew Vagin authored Dec 22, 2015

Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

2784095a