user namespace fixes

Andy Lutomirski <[email protected]> found a nasty little bug in the permissions of setns. With unprivileged user namespaces it became possible to create new namespaces without privilege.

However the setns calls were relaxed to only require CAP_SYS_ADMIN in the user nameapce of the targed namespace.

Which made the following nasty sequence possible.

pid = clone(CLONE_NEWUSER | CLONE_NEWNS);
if (pid == 0) { /* child */

	system("mount --bind /home/me/passwd /etc/passwd");
}
else if (pid != 0) { /* parent */
	char path[PATH_MAX];
	snprintf(path, sizeof(path), "/proc/%u/ns/mnt");
	fd = open(path, O_RDONLY);
	setns(fd, 0);
	system("su -");
}

Prevent this possibility by requiring CAP_SYS_ADMIN
in the current user namespace when joing all but the user namespace.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
 fs/namespace.c           |    3 ++-
 ipc/namespace.c          |    3 ++-
 kernel/pid_namespace.c   |    3 ++-
 kernel/utsname.c         |    3 ++-
 net/core/net_namespace.c |    3 ++-
 5 files changed, 10 insertions(+), 5 deletions(-)

fs/namespace.c +2 -1

index c1bbe86..398a50f 100644
@@ -2781,7 +2781,8 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns)
 	struct path root;
 
 	if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
-	    !nsown_capable(CAP_SYS_CHROOT))
+	    !nsown_capable(CAP_SYS_CHROOT) ||
+	    !nsown_capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	if (fs->users != 1)

ipc/namespace.c +2 -1

index cf3386a..7c1fa45 100644
@@ -170,7 +170,8 @@ static void ipcns_put(void *ns)
 static int ipcns_install(struct nsproxy *nsproxy, void *new)
 {
 	struct ipc_namespace *ns = new;
-	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
+	    !nsown_capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	/* Ditch state from the old ipc namespace */

kernel/pid_namespace.c +2 -1

index 560da0d..fdbd0cd 100644
@@ -325,7 +325,8 @@ static int pidns_install(struct nsproxy *nsproxy, void *ns)
 	struct pid_namespace *active = task_active_pid_ns(current);
 	struct pid_namespace *ancestor, *new = ns;
 
-	if (!ns_capable(new->user_ns, CAP_SYS_ADMIN))
+	if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
+	    !nsown_capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	/*

kernel/utsname.c +2 -1

index f6336d5..08b197e 100644
@@ -113,7 +113,8 @@ static int utsns_install(struct nsproxy *nsproxy, void *new)
 {
 	struct uts_namespace *ns = new;
 
-	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
+	    !nsown_capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	get_uts_ns(ns);

net/core/net_namespace.c +2 -1

index 2e9a313..8acce01 100644
@@ -649,7 +649,8 @@ static int netns_install(struct nsproxy *nsproxy, void *ns)
 {
 	struct net *net = ns;
 
-	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN))
+	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
+	    !nsown_capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	put_net(nsproxy->net_ns);

Signature · 1 line

1.7.5.4

Andy Lutomirski <[email protected]> found a nasty little bug in the permissions of setns. With unprivileged user namespaces it
became possible to create new namespaces without privilege.

However the setns calls were relaxed to only require CAP_SYS_ADMIN in the user nameapce of the targed namespace.

Which made the following nasty sequence possible.

pid = clone(CLONE_NEWUSER | CLONE_NEWNS);
if (pid == 0) { /* child */

        system("mount --bind /home/me/passwd /etc/passwd");
}
else if (pid != 0) { /* parent */
        char path[PATH_MAX];
        snprintf(path, sizeof(path), "/proc/%u/ns/mnt");
        fd = open(path, O_RDONLY);
        setns(fd, 0);
        system("su -");
}

Prevent this possibility by requiring CAP_SYS_ADMIN
in the current user namespace when joing all but the user namespace.

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

---
 fs/namespace.c           |    3 ++-
 ipc/namespace.c          |    3 ++-
 kernel/pid_namespace.c   |    3 ++-
 kernel/utsname.c         |    3 ++-
 net/core/net_namespace.c |    3 ++-
 5 files changed, 10 insertions(+), 5 deletions(-)

Andy Lutomirski <[email protected]> found a nasty little bug in the permissions of setns. With unprivileged user namespaces it became possible to create new namespaces without privilege.

However the setns calls were relaxed to only require CAP_SYS_ADMIN in the user nameapce of the targed namespace.

Which made the following nasty sequence possible.

pid = clone(CLONE_NEWUSER | CLONE_NEWNS);
if (pid == 0) { /* child */

        system("mount --bind /home/me/passwd /etc/passwd");
}
else if (pid != 0) { /* parent */
        char path[PATH_MAX];
        snprintf(path, sizeof(path), "/proc/%u/ns/mnt");
        fd = open(path, O_RDONLY);
        setns(fd, 0);
        system("su -");
}

Prevent this possibility by requiring CAP_SYS_ADMIN
in the current user namespace when joing all but the user namespace.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
 fs/namespace.c           |    3 ++-
 ipc/namespace.c          |    3 ++-
 kernel/pid_namespace.c   |    3 ++-
 kernel/utsname.c         |    3 ++-
 net/core/net_namespace.c |    3 ++-
 5 files changed, 10 insertions(+), 5 deletions(-)

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <[email protected]>

kernel/cred.c +12 -0

+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset.
+	 */
 
+	while (subset_ns != &init_user_ns) {
+		if (set_ns == subset_ns->parent)
+			return true;
+		subset_ns = subset_ns->parent;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task

* @new: The credentials to be assigned

kernel/cred.c +1 -1

@@ -493,7 +517,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

Quoted 6 lines · Eric W. Biederman

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

Quoted 8 lines

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

Acked-by Serge Hallyn <[email protected]>

Quoted 4 lines

---
 kernel/cred.c |   26 +++++++++++++++++++++++++-
 1 files changed, 25 insertions(+), 1 deletions(-)

kernel/cred.c error_put: · line 457

Quoted 8 lines

kernel/cred.c +0 -0

index 48cea3d..993a7ea41 100644
@@ -455,6 +455,30 @@ error_put:
 	return ret;
 }
 

Do you think we need to warn that this can only be used for commit_creds? (i.e. if someone tried ot use this in some other context, the 'creds are subset of target ns is a child of current_ns' assumption would be wrong)

Quoted 6 lines

kernel/cred.c +6 -0

+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+	const struct user_namespace *set_ns = set->user_ns;
+	const struct user_namespace *subset_ns = subset->user_ns;
+
+	/* If the two credentials are in the same user namespace see if

kernel/cred.c error_put: · line 469

Quoted 6 lines

kernel/cred.c +6 -0

+	 * the capabilities of subset are a subset of set.
+	 */
+	if (set_ns == subset_ns)
+		return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+	/* The credentials are in a different user namespaces

This can only happen during setns and CLONE_NEWUSER right?

Quoted 27 lines

kernel/cred.c +12 -0

+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset.
+	 */
 
+	while (subset_ns != &init_user_ns) {
+		if (set_ns == subset_ns->parent)
+			return true;
+		subset_ns = subset_ns->parent;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task

* @new: The credentials to be assigned

kernel/cred.c +1 -1

@@ -493,7 +517,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

Quoted 6 lines · Eric W. Biederman

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

Quoted 8 lines

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Quoted 4 lines

---
 kernel/cred.c |   26 +++++++++++++++++++++++++-
 1 files changed, 25 insertions(+), 1 deletions(-)

kernel/cred.c error_put: · line 457

Quoted 8 lines

kernel/cred.c +0 -0

index 48cea3d..993a7ea41 100644
@@ -455,6 +455,30 @@ error_put:
 	return ret;
 }
 

Do you think we need to warn that this can only be used for commit_creds? (i.e. if someone tried ot use this in some other context, the 'creds are subset of target ns is a child of current_ns' assumption would be wrong)

Quoted 6 lines

kernel/cred.c +6 -0

+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+	const struct user_namespace *set_ns = set->user_ns;
+	const struct user_namespace *subset_ns = subset->user_ns;
+
+	/* If the two credentials are in the same user namespace see if

kernel/cred.c error_put: · line 469

Quoted 6 lines

kernel/cred.c +6 -0

+	 * the capabilities of subset are a subset of set.
+	 */
+	if (set_ns == subset_ns)
+		return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+	/* The credentials are in a different user namespaces

This can only happen during setns and CLONE_NEWUSER right?

Quoted 27 lines

kernel/cred.c +12 -0

+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset.
+	 */
 
+	while (subset_ns != &init_user_ns) {
+		if (set_ns == subset_ns->parent)
+			return true;
+		subset_ns = subset_ns->parent;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task

* @new: The credentials to be assigned

kernel/cred.c +1 -1

@@ -493,7 +517,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

Quoted 22 lines · Serge E. Hallyn

Quoted 6 lines · Eric W. Biederman

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

Quoted 8 lines

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Quoted 4 lines

---
 kernel/cred.c |   26 +++++++++++++++++++++++++-
 1 files changed, 25 insertions(+), 1 deletions(-)

Quoted 13 lines

kernel/cred.c error_put: · line 457

Quoted 8 lines

kernel/cred.c +0 -0

index 48cea3d..993a7ea41 100644
@@ -455,6 +455,30 @@ error_put:
 	return ret;
 }
 

Do you think we need to warn that this can only be used for commit_creds? (i.e. if someone tried ot use this in some other context, the 'creds are subset of target ns is a child of current_ns' assumption would be wrong)

This function should be a general test valid at any time.

Except that I forgot the bit of the test that asks is the original cred the owner of the subset user namespace.

I will respin this patch.

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
 kernel/cred.c |   27 ++++++++++++++++++++++++++-
 1 files changed, 26 insertions(+), 1 deletions(-)

kernel/cred.c +26 -1

index 48cea3d..709d521 100644
@@ -455,6 +455,31 @@ error_put:
 	return ret;
 }
 
+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+	const struct user_namespace *set_ns = set->user_ns;
+	const struct user_namespace *subset_ns = subset->user_ns;
+
+	/* If the two credentials are in the same user namespace see if
+	 * the capabilities of subset are a subset of set.
+	 */
+	if (set_ns == subset_ns)
+		return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+	/* The credentials are in a different user namespaces
+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset and set->euid is owner of subset or one
+	 * of subsets ancestors.
+	 */
+	for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
+		if ((set_ns == subset_ns->parent)  &&
+		    uid_eq(subset_ns->owner, set->euid))
+			return true;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task
  * @new: The credentials to be assigned

@@ -493,7 +518,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

---
 kernel/cred.c |   27 ++++++++++++++++++++++++++-
 1 files changed, 26 insertions(+), 1 deletions(-)

kernel/cred.c +26 -1

index 48cea3d..709d521 100644
@@ -455,6 +455,31 @@ error_put:
 	return ret;
 }
 
+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+	const struct user_namespace *set_ns = set->user_ns;
+	const struct user_namespace *subset_ns = subset->user_ns;
+
+	/* If the two credentials are in the same user namespace see if
+	 * the capabilities of subset are a subset of set.
+	 */
+	if (set_ns == subset_ns)
+		return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+	/* The credentials are in a different user namespaces
+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset and set->euid is owner of subset or one
+	 * of subsets ancestors.
+	 */
+	for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
+		if ((set_ns == subset_ns->parent)  &&
+		    uid_eq(subset_ns->owner, set->euid))
+			return true;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task
  * @new: The credentials to be assigned

@@ -493,7 +518,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

---
 kernel/cred.c |   27 ++++++++++++++++++++++++++-
 1 files changed, 26 insertions(+), 1 deletions(-)

kernel/cred.c +26 -2

index 48cea3d..709d521 100644
@@ -455,6 +455,31 @@ error_put:
        return ret;
 }
 
+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+       const struct user_namespace *set_ns = set->user_ns;
+       const struct user_namespace *subset_ns = subset->user_ns;
+
+       /* If the two credentials are in the same user namespace see if
+        * the capabilities of subset are a subset of set.
+        */
+       if (set_ns == subset_ns)
+               return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+       /* The credentials are in a different user namespaces
+        * therefore one is a subset of the other only if a set is an
+        * ancestor of subset and set->euid is owner of subset or one
+        * of subsets ancestors.
+        */
+       for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
+               if ((set_ns == subset_ns->parent)  &&
+                   uid_eq(subset_ns->owner, set->euid))
+                       return true;
+       }
+
+       return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task
  * @new: The credentials to be assigned

@@ -493,7 +518,7 @@ int commit_creds(struct cred *new)
            !gid_eq(old->egid, new->egid) ||
            !uid_eq(old->fsuid, new->fsuid) ||
            !gid_eq(old->fsgid, new->fsgid) ||
-           !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+           !cred_cap_issubset(old, new)) {
                if (task->mm)
                        set_dumpable(task->mm, suid_dumpable);
                task->pdeath_signal = 0;
--

1.7.5.4

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
 kernel/cred.c |   27 ++++++++++++++++++++++++++-
 1 files changed, 26 insertions(+), 1 deletions(-)

kernel/cred.c +26 -2

index 48cea3d..709d521 100644
@@ -455,6 +455,31 @@ error_put:
        return ret;
 }
 
+static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
+{
+       const struct user_namespace *set_ns = set->user_ns;
+       const struct user_namespace *subset_ns = subset->user_ns;
+
+       /* If the two credentials are in the same user namespace see if
+        * the capabilities of subset are a subset of set.
+        */
+       if (set_ns == subset_ns)
+               return cap_issubset(subset->cap_permitted, set->cap_permitted);
+
+       /* The credentials are in a different user namespaces
+        * therefore one is a subset of the other only if a set is an
+        * ancestor of subset and set->euid is owner of subset or one
+        * of subsets ancestors.
+        */
+       for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
+               if ((set_ns == subset_ns->parent)  &&
+                   uid_eq(subset_ns->owner, set->euid))
+                       return true;
+       }
+
+       return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task
  * @new: The credentials to be assigned

@@ -493,7 +518,7 @@ int commit_creds(struct cred *new)
            !gid_eq(old->egid, new->egid) ||
            !uid_eq(old->fsuid, new->fsuid) ||
            !gid_eq(old->fsgid, new->fsgid) ||
-           !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+           !cred_cap_issubset(old, new)) {
                if (task->mm)
                        set_dumpable(task->mm, suid_dumpable);
                task->pdeath_signal = 0;
--

1.7.5.4

When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag.

This allows an unprivileged program to do:
unshare(CLONE_NEWUSER);
fd = open("/proc/self/uid_map", O_RDWR);

Where previously opening the uid_map writable would fail because the the task had been made non-dumpable.

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

kernel/cred.c +12 -0

+	 * therefore one is a subset of the other only if a set is an
+	 * ancestor of subset.
+	 */
 
+	while (subset_ns != &init_user_ns) {
+		if (set_ns == subset_ns->parent)
+			return true;
+		subset_ns = subset_ns->parent;
+	}
+
+	return false;
+}
+
 /**
  * commit_creds - Install new credentials upon the current task

* @new: The credentials to be assigned

kernel/cred.c +1 -1

@@ -493,7 +517,7 @@ int commit_creds(struct cred *new)
 	    !gid_eq(old->egid, new->egid) ||
 	    !uid_eq(old->fsuid, new->fsuid) ||
 	    !gid_eq(old->fsgid, new->fsgid) ||
-	    !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+	    !cred_cap_issubset(old, new)) {
 		if (task->mm)
 			set_dumpable(task->mm, suid_dumpable);
 		task->pdeath_signal = 0;

Signature · 1 line

1.7.5.4

Signed-off-by "Eric W. Biederman" <[email protected]>

---
 kernel/user_namespace.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

kernel/user_namespace.c +1 -1

index f5975cc..2b042c4 100644
@@ -799,7 +799,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
 	if (user_ns == current_user_ns())
 		return -EINVAL;
 
-	/* Threaded many not enter a different user namespace */
+	/* Threaded processes may not enter a different user namespace */
 	if (atomic_read(&current->mm->mm_users) > 1)
 		return -EINVAL;
 

Signature · 1 line

1.7.5.4

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

---
 kernel/user_namespace.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

kernel/user_namespace.c +1 -1

index f5975cc..2b042c4 100644
@@ -799,7 +799,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
 	if (user_ns == current_user_ns())
 		return -EINVAL;
 
-	/* Threaded many not enter a different user namespace */
+	/* Threaded processes may not enter a different user namespace */
 	if (atomic_read(&current->mm->mm_users) > 1)
 		return -EINVAL;
 

Signature · 1 line

1.7.5.4

Signed-off-by "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/[email protected]>

---
 kernel/user_namespace.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

kernel/user_namespace.c +1 -2

index f5975cc..2b042c4 100644
@@ -799,7 +799,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
        if (user_ns == current_user_ns())
                return -EINVAL;
 
-       /* Threaded many not enter a different user namespace */
+       /* Threaded processes may not enter a different user namespace */
        if (atomic_read(&current->mm->mm_users) > 1)
                return -EINVAL;
 
--

1.7.5.4

These are fixes from Andys review of my user namespace tree.

The first two patches are critical must fix fixes.

The third patch fixing commit_creds is a nice to have but fixing it would be good.

Andy, Serge if you could give these patches a once over to make certain I am not doing something stupid.

Thank you,
Eric

---

Eric W. Biederman (4):
Fix cap_capable to only allow owners in the parent user namespace to have caps.

userns: Require CAP_SYS_ADMIN for most uses of setns.
userns: Add a more complete capability subset test to commit_creds
userns: Fix typo in description of the limitation of userns_install

Quoted 14 lines · Eric W. Biederman

These are fixes from Andys review of my user namespace tree.

The first two patches are critical must fix fixes.

The third patch fixing commit_creds is a nice to have but fixing it would be good.

Andy, Serge if you could give these patches a once over to make certain I am not doing something stupid.

Thank you,
Eric

Quoted 4 lines

---

Eric W. Biederman (4):
Fix cap_capable to only allow owners in the parent user namespace to have caps.

For whatever reason, I didn't get the actual email.

Assuming this is
5e4a08476b50fa39210fca82e03325cc46b9c235:

Acked-by Andy Lutomirski <[email protected]>

Quoted 14 lines · Eric W. Biederman

These are fixes from Andys review of my user namespace tree.

The first two patches are critical must fix fixes.

The third patch fixing commit_creds is a nice to have but fixing it would be good.

Andy, Serge if you could give these patches a once over to make certain I am not doing something stupid.

Thank you,
Eric

Quoted 4 lines

---

Eric W. Biederman (4):
Fix cap_capable to only allow owners in the parent user namespace to have caps.

For whatever reason, I didn't get the actual email.

Assuming this is
5e4a08476b50fa39210fca82e03325cc46b9c235:

Acked-by Andy Lutomirski <[email protected]>