From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BBDF3F4DC8 for ; Mon, 20 Jul 2026 11:13:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784546037; cv=none; b=qK4WtgcF1I8GUWYHqU5GVRcT5i58c0WGiO/KLJ+AXllTJ0hdoan1FJ/RGUHQU9gg8wm8K9C0WwPnMS4kbICVAsQkqWM9mj1VvzTUGl3fp28Z8Aa0QArMFCtWJ8KqqpejyXwcEw63Elb0+DMyPw0DLvgVMYtkkqDamDdb5sxFC8U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784546037; c=relaxed/simple; bh=4UBgZY+08D2ljEl07t+9pTPpj5PNMwhnVcZJrQRbXbw=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=urvl7Rfs8bUK38WtqpuxJe67cTLby2NAWl+/TLQm+433UCZc4MDLdYL4VV/VZYYAjX5dbaIKEELKaeouJDYFhWdOd8pMoJy5NR/CBbUJl8KxeKT6xQvba6Wm71F9icjh6qAtv+Xiv/vOmxdwkc9AgKgTg09bgQsYm1J0wal9+dA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SouVzYBl; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SouVzYBl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784546034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=Qb8MeErvJUsSgQ7xFCsgxC/svqA+MHubpGmBm6qukfA=; b=SouVzYBlr7SW+UlaIUpfZzEdstHzBwxTl0Mj7MWlI/06QC3Mv+ToqG9yFMA7NncSIS6b3c XEbKT5Z5E56DT6oAACzhEHm+o0v3YnWQ22+r/ejbvSeDP4qHWotKiGQuBrdSMVF7OJUIu+ 7yhOz/0K83QWlyuwIUcdpW8cwP6mRO4= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-277-2DGFMhcOOUWfb86Lnb6aMA-1; Mon, 20 Jul 2026 07:13:50 -0400 X-MC-Unique: 2DGFMhcOOUWfb86Lnb6aMA-1 X-Mimecast-MFC-AGG-ID: 2DGFMhcOOUWfb86Lnb6aMA_1784546029 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BD54C1944AAC; Mon, 20 Jul 2026 11:13:48 +0000 (UTC) Received: from fedora (unknown [10.44.49.164]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with SMTP id 2639730001BE; Mon, 20 Jul 2026 11:13:44 +0000 (UTC) Received: by fedora (nbSMTP-1.00) for uid 1000 oleg@redhat.com; Mon, 20 Jul 2026 13:13:48 +0200 (CEST) Date: Mon, 20 Jul 2026 13:13:43 +0200 From: Oleg Nesterov To: Andrew Morton Cc: Alexey Gladkov , Bradley Morgan , "Cen Zhang (Microsoft)" , Christian Brauner , "Eric W. Biederman" , Mateusz Guzik , Pavel Tikhomirov , linux-kernel@vger.kernel.org Subject: [PATCH v2] sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled. Cc: stable@vger.kernel.org Fixes: e054bcbe7e7a ("sysctl: move cad_pid into kernel/pid.c") Signed-off-by: Oleg Nesterov Acked-by: Alexey Gladkov Reviewed-by: Bradley Morgan Reviewed-by: Pavel Tikhomirov --- kernel/pid.c | 31 ------------------------------- kernel/reboot.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 31 deletions(-) diff --git a/kernel/pid.c b/kernel/pid.c index f55189a3d07d..1c27e63fa0ad 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -764,29 +764,6 @@ static struct ctl_table_root pid_table_root = { .set_ownership = pid_table_root_set_ownership, }; -static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer, - size_t *lenp, loff_t *ppos) -{ - struct pid *new_pid; - pid_t tmp_pid; - int r; - struct ctl_table tmp_table = *table; - - tmp_pid = pid_vnr(cad_pid); - tmp_table.data = &tmp_pid; - - r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); - if (r || !write) - return r; - - new_pid = find_get_pid(tmp_pid); - if (!new_pid) - return -ESRCH; - - put_pid(xchg(&cad_pid, new_pid)); - return 0; -} - static const struct ctl_table pid_table[] = { { .procname = "pid_max", @@ -797,14 +774,6 @@ static const struct ctl_table pid_table[] = { .extra1 = &pid_max_min, .extra2 = &pid_max_max, }, -#ifdef CONFIG_PROC_SYSCTL - { - .procname = "cad_pid", - .maxlen = sizeof(int), - .mode = 0600, - .proc_handler = proc_do_cad_pid, - }, -#endif }; #endif diff --git a/kernel/reboot.c b/kernel/reboot.c index 695c33e75efd..f070c5c1103a 100644 --- a/kernel/reboot.c +++ b/kernel/reboot.c @@ -1366,6 +1366,29 @@ static struct attribute *reboot_attrs[] = { }; #ifdef CONFIG_SYSCTL +static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer, + size_t *lenp, loff_t *ppos) +{ + struct ctl_table tmp_table = *table; + struct pid *new_pid; + pid_t tmp_pid; + int r; + + tmp_pid = pid_vnr(cad_pid); + tmp_table.data = &tmp_pid; + + r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); + if (r || !write) + return r; + + new_pid = find_get_pid(tmp_pid); + if (!new_pid) + return -ESRCH; + + put_pid(xchg(&cad_pid, new_pid)); + return 0; +} + static const struct ctl_table kern_reboot_table[] = { { .procname = "poweroff_cmd", @@ -1381,6 +1404,12 @@ static const struct ctl_table kern_reboot_table[] = { .mode = 0644, .proc_handler = proc_dointvec, }, + { + .procname = "cad_pid", + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_do_cad_pid, + }, }; static void __init kernel_reboot_sysctls_init(void) -- 2.52.0