From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Wed, 19 Aug 2026 18:25:13 +0200 Subject: [Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn In-Reply-To: <20260706110002.1024515-9-khorenko@virtuozzo.com> References: <20260706110002.1024515-9-khorenko@virtuozzo.com> Message-ID: <20260819162513.493543-1-khorenko@virtuozzo.com> List-Id: ve_check_trusted_exec()/ve_check_trusted_mmap() protect the host, but the WARN(1, ...) is too much here: * it taints the kernel while this is not a kernel bug which we beed to debug and fix * the backtrace only shows the exec/mmap path, which is already known * on a host booted with panic_on_warn a denied exec takes the host down The SIGSEGV and the core dump of the offending process are enough to report and investigate such an attempt. Downgrade the WARN() to pr_warn(), keeping the message, the rate limiting and the signal. Fixes: fc7157b84c32 ("trusted/ve/mmap: Protect from unsecure library load from CT image") Fixes: cc218b70c6b4 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files") Feature: security/fs: tructed exec feature https://virtuozzo.atlassian.net/browse/VSTOR-137234 Signed-off-by: Konstantin Khorenko --- v1 -> v2: commit message rewritten --- kernel/ve/ve.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index 73d1c3b4873e5..0d43dc3253ea3 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -1745,8 +1745,8 @@ bool ve_check_trusted_mmap(struct file *file) if (file->f_path.dentry) filename = file->f_path.dentry->d_name.name; - WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n", - current->comm, filename); + pr_warn("VE0 %s tried to map code from file '%s' from VEX\n", + current->comm, filename); force_sigsegv(SIGSEGV); return false; } @@ -1765,7 +1765,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name) if (!__ratelimit(&sigsegv_rs)) return false; - WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n", + pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n", current->comm, name->name); force_sigsegv(SIGSEGV); return false; -- 2.43.0