mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
[ Upstream commit e0f25b8992
]
The capability CAP_CHECKPOINT_RESTORE was introduced to allow non-root
users to checkpoint and restore processes as non-root with CRIU.
This change extends CAP_CHECKPOINT_RESTORE to enable the CRIU option
'--shell-job' as non-root. CRIU's man-page describes the '--shell-job'
option like this:
Allow one to dump shell jobs. This implies the restored task will
inherit session and process group ID from the criu itself. This option
also allows to migrate a single external tty connection, to migrate
applications like top.
TIOCSLCKTRMIOS can only be done if the process has CAP_SYS_ADMIN and
this change extends it to CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE.
With this change it is possible to checkpoint and restore processes
which have a tty connection as non-root if CAP_CHECKPOINT_RESTORE is
set.
Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Adrian Reber <areber@redhat.com>
Acked-by: Andrei Vagin <avagin@gmail.com>
Link: https://lore.kernel.org/r/20231208143656.1019-1-areber@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
d8d7ffefc0
commit
c13bcbdb84
1 changed files with 2 additions and 2 deletions
|
@ -859,7 +859,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
|
||||||
ret = -EFAULT;
|
ret = -EFAULT;
|
||||||
return ret;
|
return ret;
|
||||||
case TIOCSLCKTRMIOS:
|
case TIOCSLCKTRMIOS:
|
||||||
if (!capable(CAP_SYS_ADMIN))
|
if (!checkpoint_restore_ns_capable(&init_user_ns))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
copy_termios_locked(real_tty, &kterm);
|
copy_termios_locked(real_tty, &kterm);
|
||||||
if (user_termios_to_kernel_termios(&kterm,
|
if (user_termios_to_kernel_termios(&kterm,
|
||||||
|
@ -876,7 +876,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
|
||||||
ret = -EFAULT;
|
ret = -EFAULT;
|
||||||
return ret;
|
return ret;
|
||||||
case TIOCSLCKTRMIOS:
|
case TIOCSLCKTRMIOS:
|
||||||
if (!capable(CAP_SYS_ADMIN))
|
if (!checkpoint_restore_ns_capable(&init_user_ns))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
copy_termios_locked(real_tty, &kterm);
|
copy_termios_locked(real_tty, &kterm);
|
||||||
if (user_termios_to_kernel_termios_1(&kterm,
|
if (user_termios_to_kernel_termios_1(&kterm,
|
||||||
|
|
Loading…
Reference in a new issue