https://bugzilla.novell.com/show_bug.cgi?id=394548 User jdluhos@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=394548#c1 --- Comment #1 from Jiri Dluhos 2008-05-26 11:15:06 MDT --- Created an attachment (id=218177) --> (https://bugzilla.novell.com/attachment.cgi?id=218177) A small test case. The test case contains two programs: test_child, which attempts to give itself the SCHED_FIFO scheduling mode and then exits, and test_parent that calls the child with execve(). To reproduce the bug, give test_child a setuid flag, and execute test_parent as a non-root user. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=394548 User lmb@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=394548#c2 Lars Marowsky-Bree changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|kernel-maintainers@forge.provo.novell.com |tonyj@novell.com --- Comment #2 from Lars Marowsky-Bree 2008-05-28 03:57:59 MDT --- Looking at sched.c, that seems to imply that setuid() does not convey CAP_SYS_NICE; in that case, this behaviour is expected, or at least matches the comments: /* * Like positive nice levels, dont allow tasks to * move out of SCHED_IDLE either: */ if (p->policy == SCHED_IDLE && policy != SCHED_IDLE) return -EPERM; /* can't change other user's priorities */ if ((current->euid != p->euid) && (current->euid != p->uid)) return -EPERM; But setuid() probably should allow that ... There's also a remote chance that this is caused by security_task_setscheduler(). Tony, please, can you analyse this further? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=394548 Tony Jones changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=394548 User tonyj@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=394548#c5 --- Comment #5 from Tony Jones 2008-07-15 15:42:52 MDT --- This bug has been in NEEDINFO for a while. This isn't very good!!!! Comment "When a process runs with EUID == 0 and UID != 0, and attempts to sets its scheduling mode to SCHED_FIFO, the sched_setscheduler() call fails with errno set to EPERM" does not reproduce for me, see below. I'm going to close this unless I hear otherwise. $ ls -l test_child test_parent -rwsr-sr-x 1 root users 11521 2008-07-15 14:45 test_child -rwxr-xr-x 1 tonyj users 11487 2008-07-15 14:45 test_parent $ id uid=1000(tonyj) gid=100(users) groups=16(dialout),33(video),100(users) tonyj@linux-h94x:~/foo> ./test_parent [3397] test running with uid=1000, euid=0 [1] success $ ls -l test_child test_parent -rwxr-xr-x 1 root users 11521 2008-07-15 14:45 test_child -rwxr-xr-x 1 tonyj users 11487 2008-07-15 14:45 test_parent $ id uid=1000(tonyj) gid=100(users) groups=16(dialout),33(video),100(users) $ ./test_parent [3414] test running with uid=1000, euid=1000 sched_setscheduler(): Operation not permitted $ su Password: # id uid=0(root) gid=0(root) groups=0(root) # ./test_parent [3429] test running with uid=0, euid=0 [1] success -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=394548 User jdluhos@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=394548#c8 --- Comment #8 from Jiri Dluhos 2008-07-16 03:53:12 MDT --- The test passed smoothly on an up-to-date OS11.0 x86-64, so probably it was fixed in one of kernel updates. I will re-test it with a fresh OS11 x86-64 install to be sure. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.