Creates /proc/sys/vm/mlock_group.  The sysadmin places a group ID in here. 
Processes which belong to that group are able to perform mlock() operations
without restriction.

We want this as a stopgap because at present a racing remap_file_pages()
versus truncate can create unpageable memory, thus we need to make
remap_file_pages() available to only trusted users.



---

 25-akpm/Documentation/filesystems/proc.txt |    6 ++++++
 25-akpm/include/linux/sched.h              |    6 ++++++
 25-akpm/include/linux/sysctl.h             |    1 +
 25-akpm/ipc/shm.c                          |    2 +-
 25-akpm/kernel/capability.c                |    1 +
 25-akpm/kernel/sysctl.c                    |    8 ++++++++
 25-akpm/mm/mlock.c                         |    4 ++--
 25-akpm/mm/mmap.c                          |    2 +-
 8 files changed, 26 insertions(+), 4 deletions(-)

diff -puN include/linux/sched.h~mlock_group-sysctl include/linux/sched.h
--- 25/include/linux/sched.h~mlock_group-sysctl	2004-05-08 21:57:25.011253320 -0700
+++ 25-akpm/include/linux/sched.h	2004-05-08 21:57:25.025251192 -0700
@@ -861,6 +861,12 @@ static inline int capable(int cap)
 }
 #endif
 
+extern int sysctl_mlock_group;
+static inline int can_do_mlock(void)
+{	/* If someone bothered to call can_do_mlock() it's likely to be true */
+	return likely(capable(CAP_IPC_LOCK) || in_group_p(sysctl_mlock_group));
+}
+
 /*
  * Routines for handling mm_structs
  */
diff -puN include/linux/sysctl.h~mlock_group-sysctl include/linux/sysctl.h
--- 25/include/linux/sysctl.h~mlock_group-sysctl	2004-05-08 21:57:25.012253168 -0700
+++ 25-akpm/include/linux/sysctl.h	2004-05-08 21:57:25.026251040 -0700
@@ -164,6 +164,7 @@ enum
 	VM_LAPTOP_MODE=23,	/* vm laptop mode */
 	VM_BLOCK_DUMP=24,	/* block dump mode */
 	VM_HUGETLB_GROUP=25,	/* permitted hugetlb group */
+	VM_MLOCK_GROUP=26,	/* permitted mlock group */
 };
 
 
diff -puN ipc/shm.c~mlock_group-sysctl ipc/shm.c
--- 25/ipc/shm.c~mlock_group-sysctl	2004-05-08 21:57:25.014252864 -0700
+++ 25-akpm/ipc/shm.c	2004-05-08 21:57:25.027250888 -0700
@@ -507,7 +507,7 @@ asmlinkage long sys_shmctl (int shmid, i
 /* Allow superuser to lock segment in memory */
 /* Should the pages be faulted in here or leave it to user? */
 /* need to determine interaction with current->swappable */
-		if (!capable(CAP_IPC_LOCK)) {
+		if (!can_do_mlock()) {
 			err = -EPERM;
 			goto out;
 		}
diff -puN kernel/capability.c~mlock_group-sysctl kernel/capability.c
--- 25/kernel/capability.c~mlock_group-sysctl	2004-05-08 21:57:25.016252560 -0700
+++ 25-akpm/kernel/capability.c	2004-05-08 21:57:25.027250888 -0700
@@ -14,6 +14,7 @@
 
 unsigned securebits = SECUREBITS_DEFAULT; /* systemwide security settings */
 kernel_cap_t cap_bset = CAP_INIT_EFF_SET;
+int sysctl_mlock_group;
 
 EXPORT_SYMBOL(securebits);
 EXPORT_SYMBOL(cap_bset);
diff -puN kernel/sysctl.c~mlock_group-sysctl kernel/sysctl.c
--- 25/kernel/sysctl.c~mlock_group-sysctl	2004-05-08 21:57:25.017252408 -0700
+++ 25-akpm/kernel/sysctl.c	2004-05-08 21:57:25.029250584 -0700
@@ -795,6 +795,14 @@ static ctl_table vm_table[] = {
 		.strategy	= &sysctl_intvec,
 		.extra1		= &zero,
 	},
+	{
+		.ctl_name	= VM_MLOCK_GROUP,
+		.procname	= "mlock_group",
+		.data		= &sysctl_mlock_group,
+		.maxlen		= sizeof(sysctl_mlock_group),
+		.mode		= 0644,
+		.proc_handler	= &proc_dointvec,
+	},
 	{ .ctl_name = 0 }
 };
 
diff -puN mm/mlock.c~mlock_group-sysctl mm/mlock.c
--- 25/mm/mlock.c~mlock_group-sysctl	2004-05-08 21:57:25.018252256 -0700
+++ 25-akpm/mm/mlock.c	2004-05-08 21:57:25.029250584 -0700
@@ -57,7 +57,7 @@ static int do_mlock(unsigned long start,
 	struct vm_area_struct * vma, * next;
 	int error;
 
-	if (on && !capable(CAP_IPC_LOCK))
+	if (on && !can_do_mlock())
 		return -EPERM;
 	len = PAGE_ALIGN(len);
 	end = start + len;
@@ -139,7 +139,7 @@ static int do_mlockall(int flags)
 	unsigned int def_flags;
 	struct vm_area_struct * vma;
 
-	if (!capable(CAP_IPC_LOCK))
+	if (!can_do_mlock())
 		return -EPERM;
 
 	def_flags = 0;
diff -puN mm/mmap.c~mlock_group-sysctl mm/mmap.c
--- 25/mm/mmap.c~mlock_group-sysctl	2004-05-08 21:57:25.020251952 -0700
+++ 25-akpm/mm/mmap.c	2004-05-08 21:57:25.031250280 -0700
@@ -588,7 +588,7 @@ unsigned long do_mmap_pgoff(struct file 
 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 
 	if (flags & MAP_LOCKED) {
-		if (!capable(CAP_IPC_LOCK))
+		if (!can_do_mlock())
 			return -EPERM;
 		vm_flags |= VM_LOCKED;
 	}
diff -puN Documentation/filesystems/proc.txt~mlock_group-sysctl Documentation/filesystems/proc.txt
--- 25/Documentation/filesystems/proc.txt~mlock_group-sysctl	2004-05-08 21:57:25.022251648 -0700
+++ 25-akpm/Documentation/filesystems/proc.txt	2004-05-08 21:57:25.032250128 -0700
@@ -1216,6 +1216,12 @@ nr_hugepages configures number of hugetl
 hugetlb_shm_group contains group id that is allowed to create SysV shared
 memory segment using hugetlb page.
 
+mlock_group
+-----------
+
+Specifies a group ID.  Users who belong to this supplementary group are able
+to use mlock() without restrictions.
+
 2.5 /proc/sys/dev - Device specific parameters
 ----------------------------------------------
 

_