OpenVZ Forum: Devel » userns: targeted capabilities v5

Home » Mailing lists » Devel » userns: targeted capabilities v5

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

[PATCH] userns: ptrace: incorporate feedback from Eric [message #41877 is a reply to message #41772]

Thu, 24 February 2011 00:49

serge
Messages: 72
Registered: January 2007

Member

same_or_ancestore_user_ns() was not an appropriate check to
constrain cap_issubset. Rather, cap_issubset() only is
meaningful when both capsets are in the same user_ns.

Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
---
include/linux/user_namespace.h | 9 ---------
kernel/user_namespace.c | 16 ----------------
security/commoncap.c | 28 ++++++++++------------------
3 files changed, 10 insertions(+), 43 deletions(-)

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 862fc59..faf4679 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -39,9 +39,6 @@ static inline void put_user_ns(struct user_namespace *ns)
uid_t user_ns_map_uid(struct user_namespace *to, const struct cred *cred, uid_t uid);
gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t gid);

-int same_or_ancestor_user_ns(struct task_struct *task,
- struct task_struct *victim);
-
#else

static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
@@ -69,12 +66,6 @@ static inline gid_t user_ns_map_gid(struct user_namespace *to,
return gid;
}

-static inline int same_or_ancestor_user_ns(struct task_struct *task,
- struct task_struct *victim)
-{
- return 1;
-}
-
#endif

#endif /* _LINUX_USER_H */
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 0ef2258..9da289c 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -129,22 +129,6 @@ gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t
return overflowgid;
}

-int same_or_ancestor_user_ns(struct task_struct *task,
- struct task_struct *victim)
-{
- struct user_namespace *u1 = task_cred_xxx(task, user)->user_ns;
- struct user_namespace *u2 = task_cred_xxx(victim, user)->user_ns;
- for (;;) {
- if (u1 == u2)
- return 1;
- if (u1 == &init_user_ns)
- return 0;
- u1 = u1->creator->user_ns;
- }
- /* We never get here */
- return 0;
-}
-
static __init int user_namespaces_init(void)
{
user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
diff --git a/security/commoncap.c b/security/commoncap.c
index 12ff65c..526106f 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -142,19 +142,15 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
{
int ret = 0;
- const struct cred *cred, *tcred;
+ const struct cred *cred, *child_cred;

rcu_read_lock();
cred = current_cred();
- tcred = __task_cred(child);
- /*
- * The ancestor user_ns check may be gratuitous, as I think
- * we've already guaranteed that in kernel/ptrace.c.
- */
- if (same_or_ancestor_user_ns(current, child) &&
- cap_issubset(tcred->cap_permitted, cred->cap_permitted))
+ child_cred = __task_cred(child);
+ if (cred->user->user_ns == child_cred->user->user_ns &&
+ cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
goto out;
- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
+ if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
goto out;
ret = -EPERM;
out:
@@ -178,19 +174,15 @@ out:
int cap_ptrace_traceme(struct task_struct *parent)
{
int ret = 0;
- const struct cred *cred, *tcred;
+ const struct cred *cred, *child_cred;

rcu_read_lock();
cred = __task_cred(parent);
- tcred = current_cred();
- /*
- * The ancestor user_ns check may be gratuitous, as I think
- * we've already guaranteed that in kernel/ptrace.c.
- */
- if (same_or_ancestor_user_ns(parent, current) &&
- cap_issubset(tcred->cap_permitted, cred->cap_permitted))
+ child_cred = current_cred();
+ if (cred->user->user_ns == child_cred->user->user_ns &&
+ cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
goto out;
- if (has_ns_capability(parent, tcred->user->user_ns, CAP_SYS_PTRACE))
+ if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
goto out;
ret = -EPERM;
out:
--
1.7.0.4

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs

Report message to a moderator

[Message index]

		userns: targeted capabilities v5 By: serge on Thu, 17 February 2011 15:02
		[PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: ebiederm on Fri, 18 February 2011 03:46
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: Daniel Lezcano on Fri, 18 February 2011 23:44
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 12:01
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Wed, 23 February 2011 13:43
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 11:40
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 16:59
		[PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 17 February 2011 15:04
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: ebiederm on Fri, 18 February 2011 01:29
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 24 February 2011 03:24
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Thu, 24 February 2011 05:08
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: Daniel Lezcano on Sat, 19 February 2011 19:22
		[PATCH 7/9] add a user namespace owner of ipc ns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: ebiederm on Fri, 18 February 2011 03:19
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: Daniel Lezcano on Sat, 19 February 2011 17:57
		[PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: serge on Thu, 17 February 2011 15:02
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Fri, 18 February 2011 03:31
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: Daniel Lezcano on Fri, 18 February 2011 16:57
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 17:16
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 21:21
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 23:19
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 23:54
		[PATCH 3/9] allow sethostname in a container By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 3/9] allow sethostname in a container By: ebiederm on Fri, 18 February 2011 03:05
		Re: [PATCH 3/9] allow sethostname in a container By: Daniel Lezcano on Fri, 18 February 2011 23:46
		[PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: ebiederm on Fri, 18 February 2011 03:00
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 24 February 2011 00:48
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Thu, 24 February 2011 00:54
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: Daniel Lezcano on Sat, 19 February 2011 10:55
		[PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: ebiederm on Fri, 18 February 2011 01:57
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Sat, 19 February 2011 00:01
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: Daniel Lezcano on Sat, 19 February 2011 17:52
		[PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: ebiederm on Fri, 18 February 2011 02:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Fri, 18 February 2011 04:36
		[PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 00:49
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: akpm on Thu, 24 February 2011 00:56
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 03:15
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 24 February 2011 00:43
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: Daniel Lezcano on Sat, 19 February 2011 17:49
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:05
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:11
		[PATCH 8/9] user namespaces: convert several capable() calls By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: ebiederm on Fri, 18 February 2011 01:51
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: Daniel Lezcano on Sat, 19 February 2011 19:07
		Re: userns: targeted capabilities v5 By: akpm on Fri, 18 February 2011 00:21
		Re: userns: targeted capabilities v5 By: ebiederm on Fri, 18 February 2011 03:53
		Re: userns: targeted capabilities v5 By: serge on Fri, 18 February 2011 04:28
		User namespaces and keys By: David Howells on Wed, 23 February 2011 12:05
		Re: User namespaces and keys By: serge on Wed, 23 February 2011 13:58
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 14:46
		Re: User namespaces and keys By: David Howells on Wed, 23 February 2011 15:06
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 15:45
		Re: User namespaces and keys By: Serge E. Hallyn on Wed, 23 February 2011 15:53
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 19:24
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 20:55
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 21:37
		Re: User namespaces and keys By: ebiederm on Thu, 24 February 2011 06:56

Previous Topic:	[PATCH 0/5] blk-throttle: writeback and swap IO control
Next Topic:	[PATCH 1/4] userns: let clone_uts_ns() handle setting uts->user_ns

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Tue Oct 07 16:55:16 GMT 2025

Total time taken to generate the page: 0.32015 seconds