tree 7613edd2201a1a1ed3ebe08fb2e5845b8af59f3a
parent 3f140821eb7a3810124d04cf25e0902aaf755ab1
author Eric W. Biederman <ebiederm@xmission.com> 1642698241 -0600
committer Roy Yang <royyang@google.com> 1644267731 +0000

cgroup-v1: Require capabilities to set release_agent

commit 24f6008564183aa120d07c03d9289519c2fe02af upstream.

The cgroup release_agent is called with call_usermodehelper.  The function
call_usermodehelper starts the release_agent with a full set fo capabilities.
Therefore require capabilities when setting the release_agaent.

BUG=b/218320729
TEST=presubmit
RELEASE_NOTE=This resolves CVE-2022-0492

cos-patch: security-moderate
Reported-by: Tabitha Sable <tabitha.c.sable@gmail.com>
Tested-by: Tabitha Sable <tabitha.c.sable@gmail.com>
Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups")
Cc: stable@vger.kernel.org # v2.6.24+
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9bb8dbc0eb53e9ca4cc0f20a934604d14ce29369
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/29042
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Roy Yang <royyang@google.com>