Re: [Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn

[Konstantin Khorenko <khorenko@virtuozzo.com>]

a kind ping

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 8/19/26 18:25, Konstantin Khorenko wrote:
> ve_check_trusted_exec()/ve_check_trusted_mmap() protect the host, but
> the WARN(1, ...) is too much here:
> 
>  * it taints the kernel while this is not a kernel bug which we beed to
>    debug and fix
>  * the backtrace only shows the exec/mmap path, which is already known
>  * on a host booted with panic_on_warn a denied exec takes the host down
> 
> The SIGSEGV and the core dump of the offending process are enough to
> report and investigate such an attempt. Downgrade the WARN() to
> pr_warn(), keeping the message, the rate limiting and the signal.
> 
> Fixes: fc7157b84c32 ("trusted/ve/mmap: Protect from unsecure library load from CT image")
> Fixes: cc218b70c6b4 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
> Feature: security/fs: tructed exec feature
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
> ---
> v1 -> v2: commit message rewritten
> ---
>  kernel/ve/ve.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 73d1c3b4873e5..0d43dc3253ea3 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -1745,8 +1745,8 @@ bool ve_check_trusted_mmap(struct file *file)
>  	if (file->f_path.dentry)
>  		filename = file->f_path.dentry->d_name.name;
>  
> -	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
> -			current->comm, filename);
> +	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
> +		current->comm, filename);
>  	force_sigsegv(SIGSEGV);
>  	return false;
>  }
> @@ -1765,7 +1765,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
>  	if (!__ratelimit(&sigsegv_rs))
>  		return false;
>  
> -	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
> +	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
>  		current->comm, name->name);
>  	force_sigsegv(SIGSEGV);
>  	return false;

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel