rpms/criu
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add riscv64 to ExclusiveArch

Browse Source
This commit is contained in:
Andrew Lukoshko 2026-07-03 01:19:25 +00:00 committed by root
commit 6482b6e726
3 changed files with 290 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
3025.patch Normal file
View File

@ -0,0 +1,78 @@
From 7b5b7ed2715e367d50fff2e23b4d6172cc7e506b Mon Sep 17 00:00:00 2001
From: Adrian Reber <areber@redhat.com>
Date: Thu, 21 May 2026 12:35:13 +0000
Subject: [PATCH 1/2] service: restrict socket permissions to 0600
Change the service socket permissions from 0666 (world-accessible)
to 0600 (owner-only) to prevent unauthorized local users from
connecting to the CRIU service socket.
Print a message informing the administrator that the socket is
restricted and that chmod should be used to widen access if needed.
Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
Generated with Claude Code (https://claude.ai/code)
Signed-off-by: Adrian Reber <areber@redhat.com>
---
criu/cr-service.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/criu/cr-service.c b/criu/cr-service.c
index b3ba7f03f0..d4c206d569 100644
--- a/criu/cr-service.c
+++ b/criu/cr-service.c
@@ -1534,12 +1534,16 @@ int cr_service(bool daemon_mode)
pr_info("The service socket is bound to %s\n", server_addr.sun_path);
- /* change service socket permissions, so anyone can connect to it */
- if (chmod(server_addr.sun_path, 0666)) {
+ /* restrict service socket permissions to owner only */
+ if (chmod(server_addr.sun_path, 0600)) {
pr_perror("Can't change permissions of the service socket");
goto err;
}
+ pr_msg("Service socket %s has permissions 0600. "
+ "Use chmod to make it accessible to other users if needed.\n",
+ server_addr.sun_path);
+
if (listen(server_fd, 16) == -1) {
pr_perror("Can't listen for socket connections");
goto err;
From 0ffb3bc268161b08d531973e5d8be0f37eab6e99 Mon Sep 17 00:00:00 2001
From: Adrian Reber <areber@redhat.com>
Date: Thu, 21 May 2026 12:35:22 +0000
Subject: [PATCH 2/2] test: adapt RPC test for restricted socket permissions
The service socket now defaults to 0600 (owner-only). Since the
test runs the setuid criu binary as a non-root user (uid 1000),
the socket ends up owned by root. Chown the socket to the test
user after service startup so it can connect, mirroring what an
administrator would do in production.
Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
Generated with Claude Code (https://claude.ai/code)
Signed-off-by: Adrian Reber <areber@redhat.com>
---
test/others/rpc/Makefile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/test/others/rpc/Makefile b/test/others/rpc/Makefile
index 1607779c4f..17fabb6955 100644
--- a/test/others/rpc/Makefile
+++ b/test/others/rpc/Makefile
@@ -32,6 +32,8 @@ run: all
-d --pidfile pidfile -o service.log --status-fd 200; \
$(PYTHON) read.py build/status"
rm -f build/status
+ @# Socket defaults to 0600; transfer ownership to the test user.
+ chown 1000:1000 build/criu_service.socket
chmod a+rw build/pidfile
sudo -g '#1000' -u '#1000' ./run.sh
sudo -g '#1000' -u '#1000' ./version.py

193
3071.patch Normal file
View File

@ -0,0 +1,193 @@
From bb22b4105c7e9ee6b89b740fe716db442375c296 Mon Sep 17 00:00:00 2001
From: Adrian Reber <areber@redhat.com>
Date: Fri, 26 Jun 2026 19:30:02 +0000
Subject: [PATCH] cgroup: fix stack buffer overflow in ctrl_dir_and_opt()
ctrl_dir_and_opt() builds comma-separated controller directory and
mount option strings by repeatedly appending via snprintf() into
stack-allocated buffers. The offsets (doff, ooff) are advanced by
the snprintf() return value, but snprintf() returns the number of
bytes that *would* have been written on truncation, not the number
actually written. When a controller name is long enough to cause
truncation, the offset advances past the buffer end. On the next
iteration, the remaining-length calculation (e.g. ds - doff) goes
negative and is implicitly cast to a large size_t, disabling the
truncation guard entirely. Subsequent snprintf() calls and the
trailing-comma removal then write out of bounds on the stack
(CWE-121: Stack-based Buffer Overflow).
A crafted cgroup.img with oversized cnames entries triggers this
during restore in any code path that calls ctrl_dir_and_opt():
prepare_cgns(), move_in_cgroup(), prepare_cgroup_properties(),
prepare_cgroup_sfd(), and cgroupd().
Fix this by checking every snprintf() call for truncation before
advancing the offset. Each append now verifies that remaining
space is positive and that snprintf() did not return a value
greater than or equal to the remaining space. On any overflow
the function returns -1 and all five callers now propagate this
error. Also change the type of `off` in prepare_cgroup_properties()
from unsigned int to int so the -1 return is not silently converted
to a large positive value.
This vulnerability was identified and analyzed by an AI security
analysis tool.
Assisted-by: claude-opus-4-6
Signed-off-by: Adrian Reber <areber@redhat.com>
---
criu/cgroup.c | 75 +++++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 67 insertions(+), 8 deletions(-)
diff --git a/criu/cgroup.c b/criu/cgroup.c
index d1f65df343..91547f87ed 100644
--- a/criu/cgroup.c
+++ b/criu/cgroup.c
@@ -1058,10 +1058,24 @@ int dump_cgroups(void)
return ret;
}
+/*
+ * Build the comma-separated controller directory name and mount option
+ * strings from a CgControllerEntry. Returns the length written into
+ * @dir (without the trailing comma, which is replaced by '\0'), or -1
+ * if the output would overflow the supplied buffers.
+ *
+ * Every snprintf() call is checked for truncation: snprintf() returns
+ * the number of bytes that *would* have been written, so blindly
+ * adding that to the offset can move it past the buffer end. The
+ * next append would then compute a negative remaining length, which
+ * wraps to a huge size_t, removing the truncation guard and causing
+ * a stack buffer overflow (CWE-121).
+ */
static int ctrl_dir_and_opt(CgControllerEntry *ctl, char *dir, int ds, char *opt, int os)
{
int i, doff = 0, ooff = 0;
bool none_opt = false;
+ int ret, rem;
for (i = 0; i < ctl->n_cnames; i++) {
char *n;
@@ -1070,25 +1084,58 @@ static int ctrl_dir_and_opt(CgControllerEntry *ctl, char *dir, int ds, char *opt
if (strstartswith(n, "name=")) {
n += 5;
if (opt && !none_opt) {
- ooff += snprintf(opt + ooff, os - ooff, "none,");
+ rem = os - ooff;
+ if (rem <= 0)
+ goto overflow;
+ ret = snprintf(opt + ooff, rem, "none,");
+ if (ret < 0 || ret >= rem)
+ goto overflow;
+ ooff += ret;
none_opt = true;
}
}
+ rem = ds - doff;
+ if (rem <= 0)
+ goto overflow;
+
if (n[0] == 0)
- doff += snprintf(dir + doff, ds - doff, "unified,");
+ ret = snprintf(dir + doff, rem, "unified,");
else
- doff += snprintf(dir + doff, ds - doff, "%s,", n);
- if (opt)
- ooff += snprintf(opt + ooff, os - ooff, "%s,", ctl->cnames[i]);
+ ret = snprintf(dir + doff, rem, "%s,", n);
+
+ if (ret < 0 || ret >= rem)
+ goto overflow;
+ doff += ret;
+
+ if (opt) {
+ rem = os - ooff;
+ if (rem <= 0)
+ goto overflow;
+ ret = snprintf(opt + ooff, rem, "%s,", ctl->cnames[i]);
+ if (ret < 0 || ret >= rem)
+ goto overflow;
+ ooff += ret;
+ }
}
+ /* Need at least one character written to strip the trailing ',' */
+ if (doff <= 0)
+ goto overflow;
+
/* Chop the trailing ','-s */
dir[--doff] = '\0';
- if (opt)
+ if (opt) {
+ if (ooff <= 0)
+ goto overflow;
opt[ooff - 1] = '\0';
+ }
return doff;
+
+overflow:
+ pr_err("ctrl_dir_and_opt: controller name data exceeds buffer\n");
+ return -1;
}
/* Some properties cannot be restored after the cgroup has children or tasks in
@@ -1169,6 +1216,8 @@ static int prepare_cgns(CgSetEntry *se)
}
aux_off = ctrl_dir_and_opt(ctrl, aux, sizeof(aux), NULL, 0);
+ if (aux_off < 0)
+ return -1;
/* We need to do an unshare() here as unshare() pins the root
* of the cgroup namespace to whatever the current cgroups are.
@@ -1235,6 +1284,8 @@ static int move_in_cgroup(CgSetEntry *se)
}
aux_off = ctrl_dir_and_opt(ctrl, aux, sizeof(aux), NULL, 0);
+ if (aux_off < 0)
+ return -1;
/* Note that unshare(CLONE_NEWCGROUP) doesn't change the view
* of previously mounted cgroupfses; since we're restoring via
@@ -1660,7 +1711,8 @@ static int prepare_cgroup_dir_properties(char *path, int off, CgroupDirEntry **e
int prepare_cgroup_properties(void)
{
char cname_path[PATH_MAX];
- unsigned int i, off;
+ unsigned int i;
+ int off;
for (i = 0; i < n_controllers; i++) {
CgControllerEntry *c = controllers[i];
@@ -1671,6 +1723,8 @@ int prepare_cgroup_properties(void)
}
off = ctrl_dir_and_opt(c, cname_path, sizeof(cname_path), NULL, 0);
+ if (off < 0)
+ return -1;
if (prepare_cgroup_dir_properties(cname_path, off, c->dirs, c->n_dirs) < 0)
return -1;
}
@@ -1918,7 +1972,10 @@ static int prepare_cgroup_sfd(CgroupEntry *ce)
return -1;
}
- ctl_off += ctrl_dir_and_opt(ctrl, paux + ctl_off, sizeof(paux) - ctl_off, opt, sizeof(opt));
+ ret = ctrl_dir_and_opt(ctrl, paux + ctl_off, sizeof(paux) - ctl_off, opt, sizeof(opt));
+ if (ret < 0)
+ return -1;
+ ctl_off += ret;
/* Create controller if not yet present */
if (access(paux, F_OK)) {
@@ -2037,6 +2094,8 @@ static int cgroupd(int sk)
continue;
aux_off = ctrl_dir_and_opt(ctrl, aux, sizeof(aux), NULL, 0);
+ if (aux_off < 0)
+ return -1;
format = ctrl->cnames[0][0] ? "/%s/tasks" : "/%s/cgroup.threads";
snprintf(aux + aux_off, sizeof(aux) - aux_off, format, ce->path);

21
criu.spec
View File

@ -13,7 +13,7 @@
Name: criu
Version: 4.2
Release: 4%{?dist}.alma.1
Release: 6%{?dist}.alma.1
Summary: Tool for Checkpoint/Restore in User-space
License: GPL-2.0-only AND LGPL-2.1-only AND MIT
URL: http://criu.org/
@ -29,6 +29,11 @@ Patch0: disable.network.locking.via.rpc.patch
# retain the full LDFLAGS set.
Patch1: 0001-build-keep-LDFLAGS-intact-filter-Wl-only-for-direct-ld.patch
# RHEL-189247
Patch2: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3071.patch
# RHEL-189245 RHEL-189246 RHEL-189248
Patch3: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3025.patch
# Add protobuf-c as a dependency.
# We use this patch because the protobuf-c package name
# in RPM and DEB is different.
@ -111,6 +116,8 @@ This script can help to workaround the so called "PID mismatch" problem.
%setup -q
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
%patch -P 99 -p1
%build
@ -186,9 +193,19 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
%doc %{_mandir}/man1/criu-ns.1*
%changelog
* Fri May 22 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.2-4.alma.1
* Fri Jul 03 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.2-6.alma.1
- Add riscv64 to ExclusiveArch
* Thu Jul 02 2026 Adrian Reber <areber@redhat.com> - 4.2-6
- Apply patch to fix RHEL-189245 RHEL-189246 RHEL-189248
- Resolves: RHEL-189245
- Resolves: RHEL-189246
- Resolves: RHEL-189248
* Wed Jul 01 2026 Adrian Reber <areber@redhat.com> - 4.2-5
- Apply patch to fix RHEL-189247
- Resolves: RHEL-189247
* Fri Mar 27 2026 Christopher Lusk <clusk@redhat.com> - 4.2-4
- Fix full RELRO: patch nmk build.mk to preserve -Wl flags for gcc-linked targets
- Resolves: RHEL-152222