From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 936B680AAF for ; Wed, 14 Oct 2026 17:14:12 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCvDT001388; Wed, 14 Oct 2026 20:12:58 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCvDT001388 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="e0muAwnB" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCWGG001332 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:12:32 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCWGG001332 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48b02e93a1eso3573027f8f.1 for ; Wed, 14 Oct 2026 10:12:32 -0700 (PDT) X-Gm-Message-State: AFq9FYKu4Nl8gDlUVnjDLKmvm40Yca+1/IgPWII9y0WQAMpV9QoGjiJN d0ZOQxJ2WQQINgqzPTAZFD9OUzH7RWnl6faZ3GOQIrH4Pni76ra0ZZorqtV+ISpkiAvMfaGT7QR ySVA6h7ahHSTvlDXMq4ttwJjadXM6f9NP9dKiq1irL51g3/CZqYMKXg== X-Gm-Gg: AYBFou39BxAwbQHw0GUu1MMSkj6HD0XSQ0wJPEkelA7d3V3kwB1l9nIutFNFdgwZXTf QiMzaei4AoZeXGAwNImqwCvp/Wr99HlWlfvHqij7srtcOOH5WHUPfmSr/P2sB+90gmBuIsagA9P xwoJboHLC8dfoHPVlg09b8mK4oY4QxmhHkNK5kdTAi5Wxf0dGmR0sEjoNLUPhnj8zRVXE516Kl/ Et1X+hER3zgCFXjtXHmLi6cRYrUq5qfdWcPom0PWjOQ+MgK4IlTuIfFb23i6LvHzq1O30Q8Isw5 iIm3eteC4wzdDjHRG12dw335DDaK2ZLrhL8K+LQmXBkZeeoCfzBAsuhS7IW7+uCjo33l+V4XLNk NtrZ8B8IElNUgOwzw X-Received: by 2002:a5d:588c:0:b0:48b:5083:96ae with SMTP id ffacd0b85a97d-48ddff64e46mr13863372f8f.15.1791997951254; Wed, 14 Oct 2026 10:12:31 -0700 (PDT) X-Received: by 2002:a5d:588c:0:b0:48b:5083:96ae with SMTP id ffacd0b85a97d-48ddff64e46mr13863259f8f.15.1791997950070; Wed, 14 Oct 2026 10:12:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997950; cv=none; d=google.com; s=arc-20260327; b=XrVw7E6gqaA77Kui4dopEvb6Ke/an2FGJHrVd+W9+yqwD2COW4B2+1C1PLMwq1AY1d 0CXMkKEbc6usemoqLyxdWS6vfnEJVCiCWMAF/pWSiDdu/ErXzDEWsOA20bMkxug2cP3w Bm3yCFRbnpV4TlrCu6j7XxvxsZA/G0Xj+NREYBPXOfR937Ex774f38lR8mMBpkyx1nRJ eXInERCiVSKk5Os169VXzbvZ/pDCZx45A7X+LJs3hwhAuvLqw0rqbf1NDZ8yWK75xvZ/ A73KCbjvxR0J5NUpUmf9DzNXvILTw4uXZdsKv/jdYpGEfY/r4Xv7keAZFrIrEjBRuaBU MkVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=46u//gYUBTHDXF1XjVKwKxW03MOaIZfL4NXcpFo//Bg=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=NXbp/itLl2yPTtqPrFlS4PxHR8P8jL3ifhyXGERbPCAO5Cy9R36vIbMbQQ45c/Kyx/ 0JHgf+4Qf/KN4ulsBQiDJOoDOmUUUW4934t9t9ao960qs0ZVdsi33jnOr/zx/Y3HjONp N4PdPsU/p/79zPnjieChevtFXlNW1KZOFMsQhL3hjB1OwDGuCmXpOUa3pt9XMBQA3Zb6 AmS5yrBil5w/k4fHr5KfKvkr6hUdssz0WBLhQ5agCFyzPPSu0zkwRKeCdmtgGnTp2RQa 9AdvI6EkffhJm41W57vXK1XF4wGYbeU98gssMAhOD/vp8QCFvRIBglsiei6LcRHLqbFK K/ZQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=e0muAwnB; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0965ec9si15527850f8f.4.2026.10.14.10.12.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:12:30 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=e0muAwnB; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=46u//gYUBTHDXF1XjVKwKxW03MOaIZfL4NXcpFo//Bg=; b=e0muAwnBjeQIzh1kYgG gQy+TddyXQdSufBM+jPARkX5Q7CX4rOVP+VGcEBfbxktpxJnEY9pb3wUvoKL8AzjYL7zJW5gczVx8 2pMfW4jdZZfyhMX+1Np0Ej45CqfxYgFcc2brXSkD3z5YaE5RakvjXV5Qt8vfYeizGz7WVVUN15lp/ jqHRmhaUL/oJhoG7MMiNV8jwjOMI2UeGY1xmYfzxx1A60W/HQfzeoxhQcwnpOwx0wBnEHY0B5l1qC AXZ7IDG7vnMW5CA5/NQ/UdJd908VXr+TUtjPHTSXR+1GnNGMhdtXUJr6THhaqZMLQvALXebETsU3O 41YZR76QlhErySQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2TI-0082VK-1x; Wed, 14 Oct 2026 19:12:28 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:12:24 +0200 MIME-Version: 1.0 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-5-e34cbe0d1440@virtuozzo.com> References: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> In-Reply-To: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2224; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=L0BpCV+ZK10q0H/h5r96n3Z9DetAwJ8UY6CnrlSPeeI=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7f6j1tNk0dCZg9XxwyPd+AjorsewlvHETzOO Ut2BwZ96uWJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+3+gAKCRBRlgpH+WFc KoAMD/9JaZUXP54o4zXA3rz/S+lVxUEMfZXw/X/UkT25Bo8yNZE7FrSyYQVRuhe9uQscqMeCRpK uuJyiDK4Sb7RIFLKBrFo7UwDqNx4FMMmJ04ip4jUlj5QlnohxUzxoqNejYuR05bMtUyjO+yMrE6 A3nxcDER7oIVV7hPfCLyh0+IuAFQSDDNoXSp7oFM8wrghlIJXM0psgqW4OyILVe6hsGpYmXjyEy o0cImSEEWQjXc9ltY3SyZp8DndNGka+ija8vCa8Iu4dy3RZHpZ7om6CDL8Hg9uden2UetvN3y9t 0s5aJdWcPP3WT1FrqDWovqNJR5f+XsJ0wfPPTIhnbWMvn0VqJGqEJ+6/vw4jTbZ3C+3ZP4tFyz4 Wyc4wYlAPmmLoGa0mF22d3RyXpFtswZWBzY8M638o7C3aLGhAv0wjdOlj7P8C5R7EFNAtUO0OK1 93B2vRcMdqL6GAAVjU5FX/cfcjmtgmk2Q9JlOgKe235QrH47RMdi0OVZOR/HFXG3EVEcZX29Dul Gm0nlFpULZVlRfHnXiu/OmZ6s47GkJIQgphh3vf89HqcwQTVw60ty+v2EPsM6LW455s6ktNw7JV 04djqUCz72Wjww82s3ul/Z6HJwHqP4V1DPd2Y8un935RrgzjzQx4ToQzc2346yPfFSVfrjrt2CY LDBBtwNXdhb6/vQ== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 5/7] exec: refuse to preserve memory across a privilege-changing exec X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org Since commit 9e6d16a6c0a1 ("oracle/mm: introduce VM_EXEC_KEEP") a pinned page in a preserved range is shared with the new image instead of copied, and since commit 37d9f55655ea ("oracle/mm: do not write protect COW mappings when preserving across exec") it is not copied on write either: long-term pins taken before the exec, such as a VFIO DMA mapping or io_uring fixed buffers, keep pointing at it. That is what the feature is for, DMA into the pages has to continue across exec. When the exec is a secure one, for a set-id or file-capability binary or an LSM transition that asks for AT_SECURE, this hands a write path into the privileged image to whoever drives those pins: the user who set them up keeps the device or the io_uring fd in another process and has the device or io_uring write into the memory of the new image. The pins cannot be revoked, and zapping the ranges in the old mm does not touch them. Refuse the exec with EPERM from reserve_preserved_mem() when bprm->secureexec is set. bprm_creds_from_file() has already run at that point and the check is before the point of no return, so the caller gets the error from execve(), can drop MADV_DOEXEC and retry. secureexec is computed before the ptrace downgrade, so a ptraced setuid exec is refused as well. A root task that regains dropped capabilities through exec does not set it and is not refused. Fixes: 9e6d16a6c0a1 ("oracle/mm: introduce VM_EXEC_KEEP") https://virtuozzo.atlassian.net/browse/VSTOR-150232 Feature: oracle/mm: MADV_DOEXEC madvise() flag Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- fs/exec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index 5bf856e829af3..49a0a9693eb8a 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1021,6 +1021,10 @@ static int reserve_preserved_mem(struct linux_binprm *bprm) if (!preserve) return 0; + /* Pins taken under the old credentials outlive the exec. */ + if (bprm->secureexec) + return -EPERM; + /* A clone is either counted here or already visible in the task list. */ spin_lock(&mm->page_table_lock); if (mm->exec_keep_active || mm->exec_keep_clones) -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel