Re: [PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

Re: [PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[Mickaël Salaün]

On Fri, Nov 06, 2026 at 12:00:04PM +0000, Hungyu Lin wrote:
> Commit d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s
> period") moved the CAP_SYS_RESOURCE check for psi triggers from the
> open() of the /proc/pressure files to psi_trigger_create(), so that the
> credentials of the opener decide whether a trigger is privileged. In
> doing so it replaced capable(CAP_SYS_RESOURCE) with a direct test of the
> opener's effective capability set:
> 
> 	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
> 
> Unlike capable(), cap_raised() does not check against the initial user
> namespace and does not go through the LSM capable hook. A task that
> creates a user namespace has a full effective set inside it, so an
> unprivileged user gets privileged triggers on /proc/pressure/* and on
> delegated cgroup pressure files: windows that are not a multiple of 2s,
> served by the SCHED_FIFO psimon kthread, which the N*2s rule was meant
> to keep from unprivileged users. LSM policies that deny CAP_SYS_RESOURCE
> are not consulted either.
> 
> Use file_ns_capable(), which checks the opener's credentials against the
> given user namespace through security_capable(). This brings back the
> user namespace and LSM checks of the capable() call it replaced.
> 
> Fixes: d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s period")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

This is directly visible with the new Landlock control of capabilities.

Reviewed-by: Mickaël Salaün <mic@digikod.net>
Tested-by: Mickaël Salaün <mic@digikod.net>

> ---
>  kernel/sched/psi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
> index 7c5381423334..cf2593183b25 100644
> --- a/kernel/sched/psi.c
> +++ b/kernel/sched/psi.c
> @@ -1347,7 +1347,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf,
>  	 * Checking the privilege here on file->f_cred implies that a privileged user
>  	 * could open the file and delegate the write to an unprivileged one.
>  	 */
> -	privileged = cap_raised(file->f_cred->cap_effective, CAP_SYS_RESOURCE);
> +	privileged = file_ns_capable(file, &init_user_ns, CAP_SYS_RESOURCE);
> 
>  	if (sscanf(buf, "some %u %u", &threshold_us, &window_us) == 2)
>  		state = PSI_IO_SOME + res * 2;
> --
> 2.43.0

Re: [PATCH] sched/psi: Check CAP_SYS_RESOURCE in the initial user namespace

[양시은]

On Mon, Nov 9, 2026 at 18:50:52 +0100, Mickaël Salaün wrote:
> This is directly visible with the new Landlock control of capabilities.


I reported the PSI/Landlock CAP_SYS_RESOURCE mismatch privately to
the maintainers on November 4, 2026, along with reproduction results.

I tested Hungyu's patch on Linux v7.4-rc1 with Landlock ABI 12 and
confirmed that privileged PSI trigger creation is rejected after
Landlock restricts CAP_SYS_RESOURCE.

Nice catch on the user-namespace issue as well. Using
file_ns_capable() with &init_user_ns restores both the initial user
namespace check and LSM mediation.

Reported-by: Sieun Yang <didtldms2525@jnu.ac.kr>
Tested-by: Sieun Yang <didtldms2525@jnu.ac.kr>

Thanks,
Sieun Yang