[Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn

[Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn

[Konstantin Khorenko]

ve_check_trusted_exec()/ve_check_trusted_mmap() protect the host, but
the WARN(1, ...) is too much here:

 * it taints the kernel while this is not a kernel bug which we beed to
   debug and fix
 * the backtrace only shows the exec/mmap path, which is already known
 * on a host booted with panic_on_warn a denied exec takes the host down

The SIGSEGV and the core dump of the offending process are enough to
report and investigate such an attempt. Downgrade the WARN() to
pr_warn(), keeping the message, the rate limiting and the signal.

Fixes: fc7157b84c32 ("trusted/ve/mmap: Protect from unsecure library load from CT image")
Fixes: cc218b70c6b4 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
Feature: security/fs: tructed exec feature
https://virtuozzo.atlassian.net/browse/VSTOR-137234
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
v1 -> v2: commit message rewritten
---
 kernel/ve/ve.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 73d1c3b4873e5..0d43dc3253ea3 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -1745,8 +1745,8 @@ bool ve_check_trusted_mmap(struct file *file)
 	if (file->f_path.dentry)
 		filename = file->f_path.dentry->d_name.name;
 
-	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
-			current->comm, filename);
+	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
+		current->comm, filename);
 	force_sigsegv(SIGSEGV);
 	return false;
 }
@@ -1765,7 +1765,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
 	if (!__ratelimit(&sigsegv_rs))
 		return false;
 
-	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
+	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
 		current->comm, name->name);
 	force_sigsegv(SIGSEGV);
 	return false;
-- 
2.43.0

Re: [Devel] [PATCH vz10 v2] ve: downgrade the trusted exec/mmap denial from WARN to pr_warn

[Konstantin Khorenko]

a kind ping

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 8/19/26 18:25, Konstantin Khorenko wrote:
> ve_check_trusted_exec()/ve_check_trusted_mmap() protect the host, but
> the WARN(1, ...) is too much here:
> 
>  * it taints the kernel while this is not a kernel bug which we beed to
>    debug and fix
>  * the backtrace only shows the exec/mmap path, which is already known
>  * on a host booted with panic_on_warn a denied exec takes the host down
> 
> The SIGSEGV and the core dump of the offending process are enough to
> report and investigate such an attempt. Downgrade the WARN() to
> pr_warn(), keeping the message, the rate limiting and the signal.
> 
> Fixes: fc7157b84c32 ("trusted/ve/mmap: Protect from unsecure library load from CT image")
> Fixes: cc218b70c6b4 ("trusted/ve/fs/exec: Send SIGSEGV to a process trying to execute untrusted files")
> Feature: security/fs: tructed exec feature
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
> ---
> v1 -> v2: commit message rewritten
> ---
>  kernel/ve/ve.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 73d1c3b4873e5..0d43dc3253ea3 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -1745,8 +1745,8 @@ bool ve_check_trusted_mmap(struct file *file)
>  	if (file->f_path.dentry)
>  		filename = file->f_path.dentry->d_name.name;
>  
> -	WARN(1, "VE0 %s tried to map code from file '%s' from VEX\n",
> -			current->comm, filename);
> +	pr_warn("VE0 %s tried to map code from file '%s' from VEX\n",
> +		current->comm, filename);
>  	force_sigsegv(SIGSEGV);
>  	return false;
>  }
> @@ -1765,7 +1765,7 @@ bool ve_check_trusted_exec(struct file *file, struct filename *name)
>  	if (!__ratelimit(&sigsegv_rs))
>  		return false;
>  
> -	WARN(1, "VE0's %s tried to execute untrusted file %s from VEX\n",
> +	pr_warn("VE0's %s tried to execute untrusted file %s from VEX\n",
>  		current->comm, name->name);
>  	force_sigsegv(SIGSEGV);
>  	return false;

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel