Skip to contentSkip to conversation

Set cred->user_ns in key_replace_session_keyring

PATCH In review Serge E. Hallyn 2 participants 5 messages May 26, 2011 – May 27, 2011

Subsystems (2)
Security (LSM) Keys/keyrings
lore
Share & tools
lore

Serge E. Hallyn

author maintainer
#0 lore raw

PATCH 1/1 Set cred->user_ns in key_replace_session_keyring

Since this cred was not created with copy_creds(), it needs to get initialized. Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT); can lead to a NULL deref. Thanks to Robert for finding this.

Signed-off-by Serge E. Hallyn <[email protected]>
Reported-by Robert Święcki <[email protected]>
Cc David Howells <[email protected]>
---
 security/keys/process_keys.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
security/keys/process_keys.c +1 -0
index 6c0480d..92a3a5d 100644
@@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
 	new-> sgid	= old-> sgid;
 	new->fsgid	= old->fsgid;
 	new->user	= get_uid(old->user);
+	new->user_ns	= new->user->user_ns;
 	new->group_info	= get_group_info(old->group_info);
 
 	new->securebits	= old->securebits;
Signature · 1 line
1.7.0.4
#1 lore raw

Shouldn't this also be "Cc: stable" for 2.6.39?

Bug introduced by commit 47a150edc2a, no?

Linus

Quoted 27 lines · Serge E. Hallyn

Since this cred was not created with copy_creds(), it needs to get initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT); can lead to a NULL deref.  Thanks to Robert for finding this.

Signed-off-by Serge E. Hallyn <[email protected]>
Reported-by Robert Święcki <[email protected]>
Cc David Howells <[email protected]>

---
 security/keys/process_keys.c |    1 +

 1 files changed, 1 insertions(+), 0 deletions(-)
security/keys/process_keys.c +1 -1
index 6c0480d..92a3a5d 100644
@@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
        new-> sgid      = old-> sgid;
        new->fsgid      = old->fsgid;
        new->user       = get_uid(old->user);
+       new->user_ns    = new->user->user_ns;
        new->group_info = get_group_info(old->group_info);
 
        new->securebits = old->securebits;
--

1.7.0.4

author maintainer
#2 lore raw
Quoted 3 lines · Linus Torvalds

Shouldn't this also be "Cc: stable" for 2.6.39?

Bug introduced by commit 47a150edc2a, no?

Yup, introduced there.

Stable/whoever, should I re-send this patch separately, or does this suffice?

thanks,
-serge

Quoted 30 lines

Linus

Quoted 27 lines · Serge E. Hallyn

Since this cred was not created with copy_creds(), it needs to get initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT); can lead to a NULL deref.  Thanks to Robert for finding this.

Signed-off-by Serge E. Hallyn <[email protected]>
Reported-by Robert Święcki <[email protected]>
Cc David Howells <[email protected]>

---
 security/keys/process_keys.c |    1 +

 1 files changed, 1 insertions(+), 0 deletions(-)
security/keys/process_keys.c +1 -1
index 6c0480d..92a3a5d 100644
@@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
        new-> sgid      = old-> sgid;
        new->fsgid      = old->fsgid;
        new->user       = get_uid(old->user);
+       new->user_ns    = new->user->user_ns;
        new->group_info = get_group_info(old->group_info);
 
        new->securebits = old->securebits;
--

1.7.0.4

#3 lore raw
Quoted 2 lines · Serge E. Hallyn

Stable/whoever, should I re-send this patch separately, or does this suffice?

I'll add the Cc and update the description to point to the commit it was introduced in, and it will all be fine. Then the stable team will get it automatically when I push out.

Linus

author maintainer
#4 lore raw
Quoted 9 lines · Linus Torvalds
Quoted 2 lines · Serge E. Hallyn

Stable/whoever, should I re-send this patch separately, or does this suffice?

I'll add the Cc and update the description to point to the commit it was introduced in, and it will all be fine. Then the stable team will get it automatically when I push out.

Linus

Thanks very much. (I see now)

-serge