| Message ID | 1468520419-28220-3-git-send-email-avagin@openvz.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Jul 14, 2016 at 11:20:16AM -0700, Andrey Vagin wrote: > +struct ns_common *ns_get_owner(struct ns_common *ns) > +{ > + const struct cred *cred = current_cred(); > + struct user_namespace *user_ns, *p; > + > + user_ns = p = ns->user_ns; > + if (user_ns == NULL) { /* ns is init_user_ns */ > + /* Unprivileged user should not know that it's init_user_ns. */ > + if (capable(CAP_SYS_ADMIN)) > + return ERR_PTR(-ENOENT); > + return ERR_PTR(-EPERM); > + } > + > + for (;;) { > + if (p == cred->user_ns) > + break; > + if (p == &init_user_ns) > + return ERR_PTR(-EPERM); > + p = p->parent; > + } > + > + return &get_user_ns(user_ns)->ns; > +} I'm still not sure we need the CAP_SYS_ADMIN check [1]. Maybe “you have an open file descriptor for the namespace” means you've already been authorized to access the parent information (e.g. via POSIX permissions on /proc/<pid>/ns/… or the bind-mounted namespace). Whether you can get the parent information probably depends whether you can use setns to join the parent namespace (I haven't looked up the backing code for that). But whichever way we go there, I think we do want to be consistent between init_user_ns and other namespaces. So we should have a CAP_SYS_ADMIN check for init_user_ns if and only if we also have a CAP_SYS_ADMIN check for the returned parent in the non-init_user_ns case as well: user_ns = p = ns->user_ns; if (user_ns == NULL) { /* ns is init_user_ns */ /* Unprivileged user should not know that it's init_user_ns. */ if (capable(CAP_SYS_ADMIN)) return ERR_PTR(-ENOENT); return ERR_PTR(-EPERM); } else if (! capable_in(user_ns, CAP_SYS_ADMIN)) { /* Unprivileged user should not know about the owning user ns. */ return ERR_PTR(-ENOENT); } Although I'm not sure what the real name for capable_in is, or even if it exists. Cheers, Trevor [1]: https://github.com/avagin/linux-task-diag/commit/2663bc803d324785e328261f3c07a0fef37d2088#commitcomment-18223327
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index a941b44..e416b76 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -76,6 +76,8 @@ extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *); extern int proc_setgroups_show(struct seq_file *m, void *v); extern bool userns_may_setgroups(const struct user_namespace *ns); + +struct ns_common *ns_get_owner(struct ns_common *ns); #else static inline struct user_namespace *get_user_ns(struct user_namespace *ns) @@ -104,6 +106,11 @@ static inline bool userns_may_setgroups(const struct user_namespace *ns) { return true; } + +static inline struct ns_common *ns_get_owner(struct ns_common *ns) +{ + return ERR_PTR(-ENOENT); +} #endif #endif /* _LINUX_USER_H */ diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index a5bc78c..6382e5e 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -994,6 +994,30 @@ static int userns_install(struct nsproxy *nsproxy, struct ns_common *ns) return commit_creds(cred); } +struct ns_common *ns_get_owner(struct ns_common *ns) +{ + const struct cred *cred = current_cred(); + struct user_namespace *user_ns, *p; + + user_ns = p = ns->user_ns; + if (user_ns == NULL) { /* ns is init_user_ns */ + /* Unprivileged user should not know that it's init_user_ns. */ + if (capable(CAP_SYS_ADMIN)) + return ERR_PTR(-ENOENT); + return ERR_PTR(-EPERM); + } + + for (;;) { + if (p == cred->user_ns) + break; + if (p == &init_user_ns) + return ERR_PTR(-EPERM); + p = p->parent; + } + + return &get_user_ns(user_ns)->ns; +} + const struct proc_ns_operations userns_operations = { .name = "user", .type = CLONE_NEWUSER,
Return -EPERM if an owning user namespace is outside of a process current user namespace. Signed-off-by: Andrey Vagin <avagin@openvz.org> --- include/linux/user_namespace.h | 7 +++++++ kernel/user_namespace.c | 24 ++++++++++++++++++++++++ 2 files changed, 31 insertions(+)