433
edits
Changes
Jump to navigation
Jump to search
Line 15:
Line 15: + + + + + + + +
Some datails about global CAPs we need in criu
CRIU has security issues when working with [[Userns|user namespaces]] and [[selinux]]
CRIU has security issues when working with [[Userns|user namespaces]] and [[selinux]]
== Kernel restrictions ==
Currently there are a few places in the kernel which test for action preformed being allowed for capable users only:
* Reading of <code>/proc/$pid/map_files</code> entries is guarded by <code>CAP_SYS_ADMIN</code>. This data is intensively used by CRIU on the dump.
* Restoring memory maps with <code>prctl</code> may require <code>CAP_SYS_RESOURCE</code> on old CRIU versions which don't use <code>PR_SET_MM_MAP</code> interface.
* Upon CRIU start it might try to load net-diag modules which require <code>CAP_SYS_MODULE</code>.
== Code example ==
== Code example ==