• Filipe Brandenburger's avatar
    restore: preserve dumpable flag when it is set to 2 · f662df45
    Filipe Brandenburger authored
    Commit d5bb7e97 started to preserve the dumpable flag across migration by
    using prctl to get the value on dump and set it back on restore.
    
    On some situations, the dumpable flag can be set to 2.  This happens when it is
    not reset (with prctl) after using setuid() or after using execv() on a binary
    that has executable but not read permissions, when the fs.suid_dumpable sysctl
    is also set to 2.  However, it is not possible to set it to 2 using prctl,
    which would make criu restore fail.
    
    Fix this by checking for the value before passing it to prctl.  In case the
    value of the dumpable flag was 2 at the source, check whether it is already 2
    at the destination, which is likely to happen if the fs.suid_dumpable sysctl is
    also set to 2 where restore is running.  In that case, preserve the value,
    otherwise reset it to 0 which is the most secure fallback.
    
    Fixes: d5bb7e97
    
    Tested:
    - Using dumpable02 zdtm test after setting fs.suid_dumpable to 2.
      # sysctl -w fs.suid_dumpable=2
      # test/zdtm.sh ns/static/dumpable02
      4: DEBUG: before dump: dumpable=2
      4: DEBUG: after restore: dumpable=2
      4: PASS
      Test: zdtm/live/static/dumpable02, Result: PASS
    Signed-off-by: 's avatarFilipe Brandenburger <filbranden@google.com>
    Acked-by: 's avatarAndrew Vagin <avagin@parallels.com>
    Signed-off-by: 's avatarPavel Emelyanov <xemul@parallels.com>
    f662df45
Name
Last commit
Last update
Documentation Loading commit data...
arch Loading commit data...
include Loading commit data...
lib Loading commit data...
pie Loading commit data...
protobuf Loading commit data...
scripts Loading commit data...
test Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Makefile Loading commit data...
Makefile.config Loading commit data...
Makefile.crtools Loading commit data...
Makefile.inc Loading commit data...
README Loading commit data...
cgroup.c Loading commit data...
cr-check.c Loading commit data...
cr-dedup.c Loading commit data...
cr-dump.c Loading commit data...
cr-exec.c Loading commit data...
cr-restore.c Loading commit data...
cr-service.c Loading commit data...
cr-show.c Loading commit data...
crtools Loading commit data...
crtools.c Loading commit data...
eventfd.c Loading commit data...
eventpoll.c Loading commit data...
fifo.c Loading commit data...
file-ids.c Loading commit data...
file-lock.c Loading commit data...
files-ext.c Loading commit data...
files-reg.c Loading commit data...
files.c Loading commit data...
fsnotify.c Loading commit data...
image-desc.c Loading commit data...
image.c Loading commit data...
ipc_ns.c Loading commit data...
irmap.c Loading commit data...
kcmp-ids.c Loading commit data...
kerndat.c Loading commit data...
libnetlink.c Loading commit data...
log.c Loading commit data...
mem.c Loading commit data...
mount.c Loading commit data...
namespaces.c Loading commit data...
net.c Loading commit data...
netfilter.c Loading commit data...
page-pipe.c Loading commit data...
page-read.c Loading commit data...
page-xfer.c Loading commit data...
pagemap-cache.c Loading commit data...
parasite-syscall.c Loading commit data...
pipes.c Loading commit data...
plugin.c Loading commit data...
proc_parse.c Loading commit data...
protobuf-desc.c Loading commit data...
protobuf.c Loading commit data...
pstree.c Loading commit data...
ptrace.c Loading commit data...
rbtree.c Loading commit data...
rst-malloc.c Loading commit data...
sd-daemon.c Loading commit data...
sd-daemon.h Loading commit data...
security.c Loading commit data...
shmem.c Loading commit data...
sigframe.c Loading commit data...
signalfd.c Loading commit data...
sk-inet.c Loading commit data...
sk-netlink.c Loading commit data...
sk-packet.c Loading commit data...
sk-queue.c Loading commit data...
sk-tcp.c Loading commit data...
sk-unix.c Loading commit data...
sockets.c Loading commit data...
stats.c Loading commit data...
string.c Loading commit data...
sysctl.c Loading commit data...
tty.c Loading commit data...
tun.c Loading commit data...
util.c Loading commit data...
uts_ns.c Loading commit data...