tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE

The capability CAP_CHECKPOINT_RESTORE was introduced to allow non-root
users to checkpoint and restore processes as non-root with CRIU.

This change extends CAP_CHECKPOINT_RESTORE to enable the CRIU option
'--shell-job' as non-root. CRIU's man-page describes the '--shell-job'
option like this:

Allow one to dump shell jobs. This implies the restored task will
inherit session and process group ID from the criu itself. This option
also allows to migrate a single external tty connection, to migrate
applications like top.

TIOCSLCKTRMIOS can only be done if the process has CAP_SYS_ADMIN and
this change extends it to CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE.

With this change it is possible to checkpoint and restore processes
which have a tty connection as non-root if CAP_CHECKPOINT_RESTORE is
set.

Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Adrian Reber <areber@redhat.com>
Acked-by: Andrei Vagin <avagin@gmail.com>
Link: https://lore.kernel.org/r/20231208143656.1019-1-areber@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Adrian Reber and committed by
Greg Kroah-Hartman e0f25b89 3d19ff56

+2 -2
+2 -2
drivers/tty/tty_ioctl.c
··· 844 844 ret = -EFAULT; 845 845 return ret; 846 846 case TIOCSLCKTRMIOS: 847 - if (!capable(CAP_SYS_ADMIN)) 847 + if (!checkpoint_restore_ns_capable(&init_user_ns)) 848 848 return -EPERM; 849 849 copy_termios_locked(real_tty, &kterm); 850 850 if (user_termios_to_kernel_termios(&kterm, ··· 861 861 ret = -EFAULT; 862 862 return ret; 863 863 case TIOCSLCKTRMIOS: 864 - if (!capable(CAP_SYS_ADMIN)) 864 + if (!checkpoint_restore_ns_capable(&init_user_ns)) 865 865 return -EPERM; 866 866 copy_termios_locked(real_tty, &kterm); 867 867 if (user_termios_to_kernel_termios_1(&kterm,