rpms/criu
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Apply patch to fix RHEL-189245 RHEL-189246 RHEL-189248

Browse Source 
Resolves: RHEL-189245
Resolves: RHEL-189246
Resolves: RHEL-189248

Signed-off-by: Adrian Reber <areber@redhat.com>
This commit is contained in:
Adrian Reber 2026-07-02 15:16:46 +02:00
parent f435649fea
commit 982c1d322f
2 changed files with 88 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
3025.patch Normal file
View File

@ -0,0 +1,78 @@
From 7b5b7ed2715e367d50fff2e23b4d6172cc7e506b Mon Sep 17 00:00:00 2001
From: Adrian Reber <areber@redhat.com>
Date: Thu, 21 May 2026 12:35:13 +0000
Subject: [PATCH 1/2] service: restrict socket permissions to 0600
Change the service socket permissions from 0666 (world-accessible)
to 0600 (owner-only) to prevent unauthorized local users from
connecting to the CRIU service socket.
Print a message informing the administrator that the socket is
restricted and that chmod should be used to widen access if needed.
Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
Generated with Claude Code (https://claude.ai/code)
Signed-off-by: Adrian Reber <areber@redhat.com>
---
criu/cr-service.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/criu/cr-service.c b/criu/cr-service.c
index b3ba7f03f0..d4c206d569 100644
--- a/criu/cr-service.c
+++ b/criu/cr-service.c
@@ -1534,12 +1534,16 @@ int cr_service(bool daemon_mode)
pr_info("The service socket is bound to %s\n", server_addr.sun_path);
- /* change service socket permissions, so anyone can connect to it */
- if (chmod(server_addr.sun_path, 0666)) {
+ /* restrict service socket permissions to owner only */
+ if (chmod(server_addr.sun_path, 0600)) {
pr_perror("Can't change permissions of the service socket");
goto err;
}
+ pr_msg("Service socket %s has permissions 0600. "
+ "Use chmod to make it accessible to other users if needed.\n",
+ server_addr.sun_path);
+
if (listen(server_fd, 16) == -1) {
pr_perror("Can't listen for socket connections");
goto err;
From 0ffb3bc268161b08d531973e5d8be0f37eab6e99 Mon Sep 17 00:00:00 2001
From: Adrian Reber <areber@redhat.com>
Date: Thu, 21 May 2026 12:35:22 +0000
Subject: [PATCH 2/2] test: adapt RPC test for restricted socket permissions
The service socket now defaults to 0600 (owner-only). Since the
test runs the setuid criu binary as a non-root user (uid 1000),
the socket ends up owned by root. Chown the socket to the test
user after service startup so it can connect, mirroring what an
administrator would do in production.
Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
Generated with Claude Code (https://claude.ai/code)
Signed-off-by: Adrian Reber <areber@redhat.com>
---
test/others/rpc/Makefile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/test/others/rpc/Makefile b/test/others/rpc/Makefile
index 1607779c4f..17fabb6955 100644
--- a/test/others/rpc/Makefile
+++ b/test/others/rpc/Makefile
@@ -32,6 +32,8 @@ run: all
-d --pidfile pidfile -o service.log --status-fd 200; \
$(PYTHON) read.py build/status"
rm -f build/status
+ @# Socket defaults to 0600; transfer ownership to the test user.
+ chown 1000:1000 build/criu_service.socket
chmod a+rw build/pidfile
sudo -g '#1000' -u '#1000' ./run.sh
sudo -g '#1000' -u '#1000' ./version.py

11
criu.spec
View File

@ -13,7 +13,7 @@
Name: criu
Version: 4.2
Release: 5%{?dist}
Release: 6%{?dist}
Summary: Tool for Checkpoint/Restore in User-space
License: GPL-2.0-only AND LGPL-2.1-only AND MIT
URL: http://criu.org/
@ -31,6 +31,8 @@ Patch1: 0001-build-keep-LDFLAGS-intact-filter-Wl-only-for-direct-ld.patch
# RHEL-189247
Patch2: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3071.patch
# RHEL-189245 RHEL-189246 RHEL-189248
Patch3: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3025.patch
# Add protobuf-c as a dependency.
# We use this patch because the protobuf-c package name
@ -115,6 +117,7 @@ This script can help to workaround the so called "PID mismatch" problem.
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
%patch -P 99 -p1
%build
@ -190,6 +193,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
%doc %{_mandir}/man1/criu-ns.1*
%changelog
* Thu Jul 02 2026 Adrian Reber <areber@redhat.com> - 4.2-6
- Apply patch to fix RHEL-189245 RHEL-189246 RHEL-189248
- Resolves: RHEL-189245
- Resolves: RHEL-189246
- Resolves: RHEL-189248
* Wed Jul 01 2026 Adrian Reber <areber@redhat.com> - 4.2-5
- Apply patch to fix RHEL-189247
- Resolves: RHEL-189247