Re: [RFC PATCH] security: Allow dropping bounding set process-wide

[Jinjie Ruan <ruanjinjie@huawei.com>]

在 2026/9/23 10:10, Andrew G. Morgan 写道:
> The https://pkg.go.dev/kernel.org/pub/linux/libs/security/libcap/cap#IAB.SetProc
> already handles this for the whole process. It can be run from main()

I think libcap argues *for* a kernel primitive here.

Its docs say whole-process (POSIX) semantics are implemented via
`libcap/psx`, which uses `syscall.AllThreadsSyscall()` when available,
and it exports `Prctlw` ("executes on all the threads of the process").
So `IAB.SetProc` does the same per-thread prctl dance as gvisor do
below— it doesn't avoid the cost.

112 // Apply applies `r` to every thread of the current process.
113 // May be run without procfs available.
114 // Fails with `ENOTSUP` in cgo builds.
115 func (r *ResolvedThreadCaps) Apply(timer *timing.Timer) error {
116 >-------// 1. Trim the bounding set on every thread. This must
happen before
117 >-------// capset drops CAP_SETPCAP from the effective set
(PR_CAPBSET_DROP
118 >-------// requires it).
119 >-------if r.haveSetPCap {
120 >------->-------for c := capability.Cap(0); c <= r.lastCap; c++ {
121 >------->------->-------if r.bounding&(uint64(1)<<uint(c)) != 0 {
122 >------->------->------->-------continue
123 >------->------->-------}
124 >------->------->-------if err :=
allThreadsPrctl(unix.PR_CAPBSET_DROP, uintptr(c), 0); err != nil {
125 >------->------->------->-------return fmt.Errorf("dropping bounding
capability %v on all threads: %w", c, err)
126 >------->------->-------}
127 >------->-------}
128 >-------}

58 // allThreadsPrctl issues `prctl(option, arg2, arg3)` on every OS
thread of the
 59 // process via `syscall.AllThreadsSyscall6`.
 60 func allThreadsPrctl(option, arg2, arg3 uintptr) error {
 61 >-------// EINVAL is ignored to mirror `capability.Apply`'s handling
of unsupported caps.
 62 >-------if _, _, errno := syscall.AllThreadsSyscall6(unix.SYS_PRCTL,
option, arg2, arg3, 0, 0, 0); errno != 0 && err    no != unix.EINVAL {
 63 >------->-------return errno
 64 >-------}
 65 >-------return nil
 66 }


> if you need it to happen early, and it will track down all of the
> threads in the runtime.
> 
> To Serge's point, I am also curious what benefit there is from doing
> it more quickly. After all, this is pretty much a one-time function
> request for any executable.

Every cap drop across all threads requires pausing each thread to
deliver a signal and resume it — effectively stop-the-world signal
delivery per thread, which serializes the operation and can't be
parallelized across cores.

The bounding-set trim is the worst case. As the code shows,
PR_CAPBSET_DROP must run per-thread for each capability bit.

So it's N threads × M capability bits stop-and-resume operations, all
serialized.

The benefit of doing this faster isn't about a one-time cost — gVisor
starts a sandbox per container and an agent starts a fresh sandbox per
task, so this runs on every sandbox start. And the local test shows that
warm end-to-end startup is ~160 ms (sentry boot ~70 ms), and the ~10 ms
trim on a high-core host is ~6% of end-to-end and ~14% of the sentry
boot — the largest single syscall phase in early boot. That's the hot
path, which is why making it faster matters.

> 
> FYI The "sendmail capabilities bug" reference is written up here:
> https://sites.google.com/site/fullycapable/thesendmailcapabilitiesissue
> 
> Cheers
> 
> Andrew
> 
> On Tue, Sep 22, 2026 at 10:01 AM Serge E. Hallyn <serge@hallyn.com> wrote:
>>
>> On Tue, Sep 22, 2026 at 05:58:16PM +0800, Jinjie Ruan wrote:
>>> The capability bounding set is per-thread: PR_CAPBSET_DROP only affects
>>> the calling thread, since its bounding set lives in the per-task struct
>>> cred.  User space that wants to drop capabilities for a whole process
>>> must therefore invoke PR_CAPBSET_DROP once per capability per thread,
>>> which on a many-threaded process is expensive, and from a Go runtime
>>> requires stopping the world and signalling every thread.
>>>
>>> Add PR_CAPBSET_DROP_MASK, an opt-in prctl that removes a set of
>>> capabilities, given as a 64-bit mask in arg2 (low 32 bits) and arg3
>>> (high 32 bits), from the bounding set of every thread of the calling
>>> thread group in a single call.
>>>
>>> The calling thread drops the capabilities synchronously, last; every
>>> sibling that still holds any of them is asked to drop them through a
>>> task_work item, so that it applies the drop in its own context.  This
>>> avoids racing with a sibling's concurrent credential updates such as
>>> setuid() or capset().  The call does not wait for the siblings: a
>>> sibling may be parked in a wait that is not woken by TIF_NOTIFY_SIGNAL
>>> (e.g. futex), so waiting could block for an unbounded time.  This is
>>> still safe, because TIF_NOTIFY_SIGNAL is handled on the way out to user
>>> mode, so a sibling applies the drop before executing any further
>>> userspace code.  It does not synchronize against a sibling that is
>>> concurrently creating threads, so callers must keep the thread group
>>> quiescent while dropping.
>>>
>>> Measured with gVisor's "bounding set trimmed" boot phase on an arm64 KVM
>>> guest (medians over repeated boots):
>>>   - 8 vCPUs:  ~1.6ms  -> ~0.10ms
>>>   - 32 vCPUs: ~3.5ms  -> ~0.11ms
>>>   - 64 vCPUs: ~10.1ms -> ~0.1-0.6ms
>>>   - cost goes from O(capabilities * threads) stop-the-world prctls to a
>>>     single thread-group walk.
>>
>> That is impressive, but please do detail the specific use case where
>> you need to drop from the bounding set after the go scheduler has started.
>> I can imagine some cases where you need to do some early setup and then
>> want to drop privileges, but you could also do that by re-exec'ing, so
>> I'd like to hear specifics.
>>
>> This makes me nervous, reminding me of the 'sendmail capabilities bug'.
>> If some program specifically locks down one thread, I could imagine the
>> locked down thread forcing wrong behavior from the privileged threads
>> by calling this.
>>
>>>
>>> Cc: Serge Hallyn <serge@hallyn.com>
>>> Cc: Paul Moore <paul@paul-moore.com>
>>> Cc: James Morris <jmorris@namei.org>
>>> Cc: Paul Walmsley <pjw@kernel.org>
>>> Cc: Thomas Gleixner <tglx@kernel.org>
>>> Cc: Zong Li <zong.li@sifive.com>
>>> Cc: Deepak Gupta <debug@rivosinc.com>
>>> Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
>>> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
>>> ---
>>>  include/uapi/linux/prctl.h |   1 +
>>>  security/commoncap.c       | 129 +++++++++++++++++++++++++++++++++++++
>>>  2 files changed, 130 insertions(+)
>>>
>>> diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
>>> index b6ec6f693719..750a7824d3bc 100644
>>> --- a/include/uapi/linux/prctl.h
>>> +++ b/include/uapi/linux/prctl.h
>>> @@ -70,6 +70,7 @@
>>>  /* Get/set the capability bounding set (as per security/commoncap.c) */
>>>  #define PR_CAPBSET_READ 23
>>>  #define PR_CAPBSET_DROP 24
>>> +#define PR_CAPBSET_DROP_MASK 83
>>>
>>>  /* Get/set the process' ability to use the timestamp counter instruction */
>>>  #define PR_GET_TSC 25
>>> diff --git a/security/commoncap.c b/security/commoncap.c
>>> index 3399535808fe..ae7ce50a8151 100644
>>> --- a/security/commoncap.c
>>> +++ b/security/commoncap.c
>>> @@ -19,7 +19,14 @@
>>>  #include <linux/hugetlb.h>
>>>  #include <linux/mount.h>
>>>  #include <linux/sched.h>
>>> +#include <linux/cred.h>
>>> +#include <linux/rcupdate.h>
>>> +#include <linux/sched/signal.h>
>>> +#include <linux/sched/task.h>
>>> +#include <linux/slab.h>
>>> +#include <linux/task_work.h>
>>>  #include <linux/prctl.h>
>>> +#include <linux/printk.h>
>>>  #include <linux/securebits.h>
>>>  #include <linux/user_namespace.h>
>>>  #include <linux/binfmts.h>
>>> @@ -1283,6 +1290,123 @@ static int cap_prctl_drop(unsigned long cap)
>>>       return commit_creds(new);
>>>  }
>>>
>>> +/*
>>> + * Structure used to queue process-wide bounding set drops via task_work.
>>> + */
>>> +struct cap_bset_drop_work {
>>> +     struct callback_head work;
>>> +     struct task_struct *task;
>>> +     kernel_cap_t mask;
>>> +     struct cap_bset_drop_work *next;
>>> +};
>>> +
>>> +static void cap_bset_drop_work_fn(struct callback_head *work)
>>> +{
>>> +     struct cap_bset_drop_work *w = container_of(work, struct cap_bset_drop_work, work);
>>> +     struct cred *new = prepare_creds();
>>> +
>>> +     if (!new) {
>>> +             /* Out of memory: bounding set drop failed silently for this thread. */
>>> +             pr_warn_ratelimited("capability bounding set drop failed for pid %d (%s)\n",
>>> +                                 task_pid_nr(current), current->comm);
>>> +             goto out;
>>> +     }
>>> +
>>> +     new->cap_bset = cap_drop(new->cap_bset, w->mask);
>>> +     commit_creds(new);
>>> +
>>> +out:
>>> +     put_task_struct(w->task);
>>> +     kfree(w);
>>> +}
>>> +
>>> +/*
>>> + * cap_bset_drop_process - Drop capabilities from all threads in the group.
>>> + * @mask: Mask of capabilities to drop from the bounding set.
>>> + *
>>> + * Drops @mask from the calling thread synchronously, and queues a task_work
>>> + * item for each sibling thread to safely apply the drop in its own context.
>>> + *
>>> + * The caller must hold CAP_SETPCAP. Thread group must be quiescent to avoid
>>> + * racing with concurrent thread creation.
>>> + *
>>> + * Returns 0 on success, or -ENOMEM if allocations fail (all-or-nothing).
>>> + */
>>> +static int cap_bset_drop_process(kernel_cap_t mask)
>>> +{
>>> +     struct cap_bset_drop_work *list = NULL, *w, *next;
>>> +     struct task_struct *thread;
>>> +     struct cred *new = NULL;
>>> +     int ret = 0;
>>> +
>>> +     rcu_read_lock();
>>> +     for_each_thread(current, thread) {
>>> +             const struct cred *cred;
>>> +
>>> +             if (thread == current || (thread->flags & PF_EXITING))
>>> +                     continue;
>>> +
>>> +             cred = __task_cred(thread);
>>> +             if (cap_isclear(cap_intersect(cred->cap_bset, mask)))
>>> +                     continue;
>>> +
>>> +             w = kmalloc_obj(*w, GFP_ATOMIC);
>>> +             if (!w) {
>>> +                     ret = -ENOMEM;
>>> +                     break;
>>> +             }
>>> +
>>> +             w->task = get_task_struct(thread);
>>> +             w->mask = mask;
>>> +             w->next = list;
>>> +             list = w;
>>> +     }
>>> +     rcu_read_unlock();
>>> +
>>> +     if (!ret) {
>>> +             new = prepare_creds();
>>> +             if (!new)
>>> +                     ret = -ENOMEM;
>>> +     }
>>> +
>>> +     if (ret) {
>>> +             while (list) {
>>> +                     next = list->next;
>>> +                     put_task_struct(list->task);
>>> +                     kfree(list);
>>> +                     list = next;
>>> +             }
>>> +             return ret;
>>> +     }
>>> +
>>> +     for (w = list; w; w = next) {
>>> +             next = w->next;
>>> +             init_task_work(&w->work, cap_bset_drop_work_fn);
>>> +             if (task_work_add(w->task, &w->work, TWA_SIGNAL)) {
>>> +                     put_task_struct(w->task);
>>> +                     kfree(w);
>>> +             }
>>> +     }
>>> +
>>> +     new->cap_bset = cap_drop(new->cap_bset, mask);
>>> +     commit_creds(new);
>>> +
>>> +     return 0;
>>> +}
>>> +
>>> +static int cap_prctl_drop_mask(unsigned long low, unsigned long high)
>>> +{
>>> +     kernel_cap_t mask = mk_kernel_cap((u32)low, (u32)high);
>>> +
>>> +     if (cap_isclear(mask))
>>> +             return 0;
>>> +
>>> +     if (!ns_capable(current_user_ns(), CAP_SETPCAP))
>>> +             return -EPERM;
>>> +
>>> +     return cap_bset_drop_process(mask);
>>> +}
>>> +
>>>  /**
>>>   * cap_task_prctl - Implement process control functions for this security module
>>>   * @option: The process control function requested
>>> @@ -1313,6 +1437,11 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
>>>       case PR_CAPBSET_DROP:
>>>               return cap_prctl_drop(arg2);
>>>
>>> +     case PR_CAPBSET_DROP_MASK:
>>> +             if (arg4 || arg5)
>>> +                     return -EINVAL;
>>> +             return cap_prctl_drop_mask(arg2, arg3);
>>> +
>>>       /*
>>>        * The next four prctl's remain to assist with transitioning a
>>>        * system from legacy UID=0 based privilege (when filesystem
>>> --
>>> 2.34.1

-- 
Best regards,
Jinjie