Wed, 13 Nov 2013 11:52:37 -0600
On Tue, 5 Nov 2013 07:35:37 -0600
Corey Wright <undefined@pobox.com> wrote:
> patch-3.10.17-vs2.3.6.6.diff appears to apply to linux-3.10.18, but patch
> (using version 2.6.1) fuzzes incorrectly with net/core/sock.c (ie "Hunk #6
> succeeded at 2495 with fuzz 2 (offset 205 lines)") due to the following
> change in 3.10.18:
>
> * http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/net/core/sock.c?h=linux-3.10.y&id=5e25ba5003ee5de0ba2be56bfd54d16d4b1b028d
>
> the attached patch fixes that bad fuzz and the Makefile reject (ie
> "EXTRAVERSION = -vs2.3.6.6"). apply the patch after applying
> patch-3.10.17-vs2.3.6.6.diff to linux-3.10.18.
>
> there's the slightest chance that my placement of hunk #6 should have come
> before the newly introduced "sk->sk_pacing_rate = ~0U;", but my brief
> analysis of hunk #6 says it doesn't concern itself with sk->sk_pacing_rate
> (only sk->sk_vx_info, sk->sk_xid, sk->sk_nx_info, & sk->sk_nid) so it doesn't
> matter, but i could be wrong.
>
> attached is also a patch to include the deltas (fixes and features) found
> since patch-3.10.17-vs2.3.6.6.diff was released (which i either personally
> tested or have included in a linux-3.10.17-vs2.3.6.6.3 kernel which i've been
> running "in production" for at least 48 hours).
>
> and finally i've included a patch to allow for vserver experimental features
> as CONFIG_EXPERIMENTAL has been removed from 3.10 (starting with 3.9?) so it
> is currently impossible to enable them (without the attached patch). the
> experimental features are defaulted to "n", though VSERVER_AUTO_SINGLE use to
> default to "y", but only when CONFIG_EXPERIMENTAL was enabled (so the true,
> overall "default" was implicitly "n").
>
> the resulting linux-3.10.18-vs2.3.6.6 (with all three attached patches
> applied) boots in virtualbox and passes testme.sh and testfs.sh.
3.10.19 appears to deviate little, if at all, from 3.10.18 in regard to
patching with patch-3.10.17-vs2.3.6.6.diff.
so either follow the previous/above instructions for 3.10.18, but using them
for 3.10.19 (and manually setting EXTRAVERSION in Makefile) or apply the
attached set of patches (after applying patch-3.10.17-vs2.3.6.6.diff to
linux-3.10.19).
* patch-3.10.17-19-vs2.3.6.6.diff
* merging of previous fixups & deltas patches
* includes fixes, features, and repairing a bad fuzz
* patch-3.10.19-vs2.3.6.6-remove_depends_on_EXPERIMENTAL.patch
* allows enabling linux-vserver features marked experimental
the resulting kernel has been successfully built for x86-64 and tested
against testme.sh and testfs.sh in virtualbox.
corey
--
undefined@pobox.com
> corey
> --
> undefined@pobox.com
diff -urNpd a/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c b/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c
--- a/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c 2013-11-13 08:54:37.000000000 -0600
@@ -1641,7 +1641,7 @@ static int tun_set_iff(struct net *net,
int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
MAX_TAP_QUEUES : 1;
- if (!vx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
+ if (!nx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
return -EPERM;
err = security_tun_dev_create();
if (err < 0)
diff -urNpd a/linux-3.10.19-vs2.3.6.6/fs/namespace.c b/linux-3.10.19-vs2.3.6.6/fs/namespace.c
--- a/linux-3.10.19-vs2.3.6.6/fs/namespace.c 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/fs/namespace.c 2013-11-13 08:54:37.000000000 -0600
@@ -1301,7 +1301,8 @@ static int do_umount(struct mount *mnt,
*/
static inline bool may_mount(void)
{
- return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
+ return vx_ns_capable(current->nsproxy->mnt_ns->user_ns,
+ CAP_SYS_ADMIN, VXC_SECURE_MOUNT);
}
/*
diff -urNpd a/linux-3.10.19-vs2.3.6.6/fs/proc/root.c b/linux-3.10.19-vs2.3.6.6/fs/proc/root.c
--- a/linux-3.10.19-vs2.3.6.6/fs/proc/root.c 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/fs/proc/root.c 2013-11-13 08:54:37.000000000 -0600
@@ -116,7 +116,8 @@ static struct dentry *proc_mount(struct
options = data;
if (!current_user_ns()->may_mount_proc ||
- !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ !vx_ns_capable(ns->user_ns,
+ CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
return ERR_PTR(-EPERM);
}
diff -urNpd a/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h b/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h
--- a/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h 2013-11-13 08:49:36.000000000
-0600
+++ b/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h 2013-11-13 08:54:37.000000000
-0600
@@ -143,6 +143,9 @@ enum {
#define nx_capable(b, c) (capable(b) || \
(cap_raised(current_cap(), b) && nx_ncaps(c)))
+#define nx_ns_capable(n, b, c) (ns_capable(n, b) || \
+ (cap_raised(current_cap(), b) && nx_ncaps(c)))
+
#define vx_task_initpid(t, n) \
((t)->vx_info && \
((t)->vx_info->vx_initpid == (n)))
diff -urNpd a/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h b/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h
--- a/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h 2013-11-13 08:49:36.000000000
-0600
+++ b/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h 2013-11-13 08:54:37.000000000
-0600
@@ -66,8 +66,8 @@
#define VXC_OOM_ADJUST 0x00002000
#define VXC_AUDIT_CONTROL 0x00004000
-/* #define VXC_SECURE_MOUNT 0x00010000
-#define VXC_SECURE_REMOUNT 0x00020000 */
+#define VXC_SECURE_MOUNT 0x00010000
+/* #define VXC_SECURE_REMOUNT 0x00020000 */
#define VXC_BINARY_MOUNT 0x00040000
#define VXC_DEV_MOUNT 0x00080000
diff -urNpd a/linux-3.10.19-vs2.3.6.6/ipc/shm.c b/linux-3.10.19-vs2.3.6.6/ipc/shm.c
--- a/linux-3.10.19-vs2.3.6.6/ipc/shm.c 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/ipc/shm.c 2013-11-13 08:54:37.000000000 -0600
@@ -576,7 +576,7 @@ static int newseg(struct ipc_namespace *
ns->shm_tot += numpages;
error = shp->shm_perm.id;
- shm_unlock(shp);
+
ipc_unlock_object(&shp->shm_perm);
rcu_read_unlock();
vx_ipcshm_add(current_vx_info(), key, numpages);
diff -urNpd a/linux-3.10.19-vs2.3.6.6/Makefile b/linux-3.10.19-vs2.3.6.6/Makefile
--- a/linux-3.10.19-vs2.3.6.6/Makefile 2013-11-13 08:42:27.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/Makefile 2013-11-13 08:54:57.000000000 -0600
@@ -1,7 +1,7 @@
VERSION = 3
PATCHLEVEL = 10
SUBLEVEL = 19
-EXTRAVERSION =
+EXTRAVERSION = -vs2.3.6.6
NAME = TOSSUG Baby Fish
# *DOCUMENTATION*
diff -urNpd a/linux-3.10.19-vs2.3.6.6/net/core/sock.c b/linux-3.10.19-vs2.3.6.6/net/core/sock.c
--- a/linux-3.10.19-vs2.3.6.6/net/core/sock.c 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/net/core/sock.c 2013-11-13 08:54:37.000000000 -0600
@@ -2291,6 +2291,13 @@ void sock_init_data(struct socket *sock,
sk->sk_stamp = ktime_set(-1L, 0);
sk->sk_pacing_rate = ~0U;
+
+ set_vx_info(&sk->sk_vx_info, current_vx_info());
+ sk->sk_xid = vx_current_xid();
+ vx_sock_inc(sk);
+ set_nx_info(&sk->sk_nx_info, current_nx_info());
+ sk->sk_nid = nx_current_nid();
+
/*
* Before updating sk_refcnt, we must commit prior changes to memory
* (Documentation/RCU/rculist_nulls.txt for details)
@@ -2495,12 +2502,6 @@ void sk_common_release(struct sock *sk)
if (sk->sk_prot->destroy)
sk->sk_prot->destroy(sk);
- set_vx_info(&sk->sk_vx_info, current_vx_info());
- sk->sk_xid = vx_current_xid();
- vx_sock_inc(sk);
- set_nx_info(&sk->sk_nx_info, current_nx_info());
- sk->sk_nid = nx_current_nid();
-
/*
* Observation: when sock_common_release is called, processes have
* no access to socket. But net still has.
diff -urNpd a/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig b/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig
--- a/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig 2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig 2013-11-13 09:12:11.000000000 -0600
@@ -13,9 +13,8 @@ config VSERVER_AUTO_LBACK
startup.
config VSERVER_AUTO_SINGLE
- bool "Automatic Single IP Special Casing"
- depends on EXPERIMENTAL
- default y
+ bool "Automatic Single IP Special Casing (EXPERIMENTAL)"
+ default n
help
This allows network contexts with a single IP to
automatically remap 0.0.0.0 bindings to that IP,
@@ -35,8 +34,7 @@ config VSERVER_COWBL
link and create a copy of the unified file)
config VSERVER_VTIME
- bool "Enable Virtualized Guest Time"
- depends on EXPERIMENTAL
+ bool "Enable Virtualized Guest Time (EXPERIMENTAL)"
default n
help
This enables per guest time offsets to allow for
@@ -45,8 +43,7 @@ config VSERVER_VTIME
therefore should not be enabled without good reason.
config VSERVER_DEVICE
- bool "Enable Guest Device Mapping"
- depends on EXPERIMENTAL
+ bool "Enable Guest Device Mapping (EXPERIMENTAL)"
default n
help
This enables generic device remapping.