linux-stable.git/Documentation/sysctl/kernel.txt, branch v3.12.64

vsprintf: check real user/group id for %pK

2013-12-04T19:05:12+00:00

commit 312b4e226951f707e120b95b118cbc14f3d162b2 upstream.

Some setuid binaries will allow reading of files which have read
permission by the real user id.  This is problematic with files which
use %pK because the file access permission is checked at open() time,
but the kptr_restrict setting is checked at read() time.  If a setuid
binary opens a %pK file as an unprivileged user, and then elevates
permissions before reading the file, then kernel pointer values may be
leaked.

This happens for example with the setuid pppd application on Ubuntu 12.04:

  $ head -1 /proc/kallsyms
  00000000 T startup_32

  $ pppd file /proc/kallsyms
  pppd: In file /proc/kallsyms: unrecognized option 'c1000000'

This will only leak the pointer value from the first line, but other
setuid binaries may leak more information.

Fix this by adding a check that in addition to the current process having
CAP_SYSLOG, that effective user and group ids are equal to the real ids.
If a setuid binary reads the contents of a file which uses %pK then the
pointer values will be printed as NULL if the real user is unprivileged.

Update the sysctl documentation to reflect the changes, and also correct
the documentation to state the kptr_restrict=0 is the default.

This is a only temporary solution to the issue.  The correct solution is
to do the permission check at open() time on files, and to replace %pK
with a function which checks the open() time permission.  %pK uses in
printk should be removed since no sane permission check can be done, and
instead protected by using dmesg_restrict.

Signed-off-by: Ryan Mallon 
Cc: Kees Cook 
Cc: Alexander Viro 
Cc: Joe Perches 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

coredump: add new %P variable in core_pattern

2013-09-11T22:59:01+00:00

Add a new %P variable to be used in core_pattern.  This variable contains
the global PID (PID in the init namespace) as %p contains the PID in the
current namespace which isn't always what we want.

The main use for this is to make it easier to handle crashes that happened
within a container.  With that new variables it's possible to have the
crashes dumped into the container or forwarded to the host with the right
PID (from the host's point of view).

Signed-off-by: Stéphane Graber 
Reported-by: Hans Feldt 
Cc: Alexander Viro 
Cc: Eric W. Biederman 
Cc: Andy Whitcroft 
Acked-by: Serge E. Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

perf: Drop sample rate when sampling is too slow

2013-06-23T09:52:57+00:00

This patch keeps track of how long perf's NMI handler is taking,
and also calculates how many samples perf can take a second.  If
the sample length times the expected max number of samples
exceeds a configurable threshold, it drops the sample rate.

This way, we don't have a runaway sampling process eating up the
CPU.

This patch can tend to drop the sample rate down to level where
perf doesn't work very well.  *BUT* the alternative is that my
system hangs because it spends all of its time handling NMIs.

I'll take a busted performance tool over an entire system that's
busted and undebuggable any day.

BTW, my suspicion is that there's still an underlying bug here.
Using the HPET instead of the TSC is definitely a contributing
factor, but I suspect there are some other things going on.
But, I can't go dig down on a bug like that with my machine
hanging all the time.

Signed-off-by: Dave Hansen 
Acked-by: Peter Zijlstra 
Cc: paulus@samba.org
Cc: acme@ghostprotocols.net
Cc: Dave Hansen 
[ Prettified it a bit. ]
Signed-off-by: Ingo Molnar

watchdog: Remove softlockup_thresh from Documentation

2013-05-28T09:28:20+00:00

The old softlockup detector has been replaced with new lockup
detector long ago.

Signed-off-by: Li Zefan 
Acked-by: Don Zickus 
Link: http://lkml.kernel.org/r/51959687.9090305@huawei.com
Signed-off-by: Ingo Molnar

watchdog: Document watchdog_thresh sysctl

2013-05-28T09:28:19+00:00

Signed-off-by: Li Zefan 
Acked-by: Don Zickus 
Link: http://lkml.kernel.org/r/51959678.6000802@huawei.com
Signed-off-by: Ingo Molnar

Documentation/sysctl/kernel.txt: document /proc/sys/shmall

2013-01-05T00:11:46+00:00

Signed-off-by: Carlos Alberto Lopez Perez 
Cc: Rob Landley 
Cc: Larry Finger 
Cc: Neil Horman 
Cc: Mitsuo Hayasaka 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc: add sysctl to specify desired next object id

2013-01-05T00:11:45+00:00

Add 3 new variables and sysctls to tune them (by one "next_id" variable
for messages, semaphores and shared memory respectively).  This variable
can be used to set desired id for next allocated IPC object.  By default
it's equal to -1 and old behaviour is preserved.  If this variable is
non-negative, then desired idr will be extracted from it and used as a
start value to search for free IDR slot.

Notes:

1) this patch doesn't guarantee that the new object will have desired
   id.  So it's up to user space how to handle new object with wrong id.

2) After a sucessful id allocation attempt, "next_id" will be set back
   to -1 (if it was non-negative).

[akpm@linux-foundation.org: checkpatch fixes]
Signed-off-by: Stanislav Kinsbursky 
Cc: Serge Hallyn 
Cc: "Eric W. Biederman" 
Cc: Pavel Emelyanov 
Cc: Al Viro 
Cc: KOSAKI Motohiro 
Cc: Michael Kerrisk 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

coredump: add support for %d=__get_dumpable() in core name

2012-10-05T18:05:15+00:00

Some coredump handlers want to create a core file in a way compatible with
standard behavior.  Standard behavior with fs.suid_dumpable = 2 is to
create core file with uid=gid=0.  However, there was no way for coredump
handler to know that the process being dumped was suid'ed.

This patch adds the new %d specifier for format_corename() which simply
reports __get_dumpable(mm->flags), this is compatible with
/proc/sys/fs/suid_dumpable we already have.

Addresses https://bugzilla.redhat.com/show_bug.cgi?id=787135

Developed during a discussion with Denys Vlasenko.

Signed-off-by: Oleg Nesterov 
Cc: Denys Vlasenko 
Cc: Alex Kelly 
Cc: Andi Kleen 
Cc: Cong Wang 
Cc: Jiri Moskovcak 
Acked-by: Neil Horman 
Cc: Alan Cox 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Documentation: add missing tainted bits to Documentation/sysctl/kernel.txt

2012-02-07T00:29:19+00:00

Two of the bits in the tainted flag are not documented.

Signed-off-by: Larry Finger 
Signed-off-by: Randy Dunlap 
Signed-off-by: Linus Torvalds

sysctl: add the kernel.ns_last_pid control

2012-01-13T04:13:11+00:00

The sysctl works on the current task's pid namespace, getting and setting
its last_pid field.

Writing is allowed for CAP_SYS_ADMIN-capable tasks thus making it possible
to create a task with desired pid value.  This ability is required badly
for the checkpoint/restore in userspace.

This approach suits all the parties for now.

Signed-off-by: Pavel Emelyanov 
Acked-by: Tejun Heo 
Cc: Oleg Nesterov 
Cc: Cyrill Gorcunov 
Cc: "Eric W. Biederman" 
Cc: Serge Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds