User namespace: don't allow sysctl in non-init user ns

sysctl.c has its own custom uid check, which is not user namespace aware. As discovered by Richard, that allows root in a container privileged access to set all sysctls.

To fix that, just refuse access if current is not in init_user_ns. We may at some point want to relax that check so that some sysctls are allowed - for instance dmesg_restrict when syslog is containerized.

---
 kernel/sysctl.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

index 11d65b5..f2b42e2 100644
@@ -1697,6 +1697,8 @@ void register_sysctl_root(struct ctl_table_root *root)
 
 static int test_perm(int mode, int op)
 {
+	if (current_user_ns() != &init_user_ns)
+		return -EACCES;
 	if (!current_euid())
 		mode >>= 6;
 	else if (in_egroup_p(0))

1.7.5.4