aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric W. Biederman2013-03-15 03:45:51 -0500
committerGreg Kroah-Hartman2013-04-05 11:26:01 -0500
commit7f60ac1533f522fe257dca74fbb4c4d3820a9b0f (patch)
treec569015738227d5f97f5932f7ba7e891c333540b
parent238f455f2f1af51a8c17db666cee5f380ab2bd01 (diff)
downloadkernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.tar.gz
kernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.tar.xz
kernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.zip
userns: Don't allow creation if the user is chrooted
commit 3151527ee007b73a0ebd296010f1c0454a919c7d upstream. Guarantee that the policy of which files may be access that is established by setting the root directory will not be violated by user namespaces by verifying that the root directory points to the root of the mount namespace at the time of user namespace creation. Changing the root is a privileged operation, and as a matter of policy it serves to limit unprivileged processes to files below the current root directory. For reasons of simplicity and comprehensibility the privilege to change the root directory is gated solely on the CAP_SYS_CHROOT capability in the user namespace. Therefore when creating a user namespace we must ensure that the policy of which files may be access can not be violated by changing the root directory. Anyone who runs a processes in a chroot and would like to use user namespace can setup the same view of filesystems with a mount namespace instead. With this result that this is not a practical limitation for using user namespaces. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Reported-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/namespace.c24
-rw-r--r--include/linux/fs_struct.h2
-rw-r--r--kernel/user_namespace.c9
3 files changed, 35 insertions, 0 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index a51054f4e293..8edbad385cb7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2758,6 +2758,30 @@ bool our_mnt(struct vfsmount *mnt)
2758 return check_mnt(real_mount(mnt)); 2758 return check_mnt(real_mount(mnt));
2759} 2759}
2760 2760
2761bool current_chrooted(void)
2762{
2763 /* Does the current process have a non-standard root */
2764 struct path ns_root;
2765 struct path fs_root;
2766 bool chrooted;
2767
2768 /* Find the namespace root */
2769 ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
2770 ns_root.dentry = ns_root.mnt->mnt_root;
2771 path_get(&ns_root);
2772 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
2773 ;
2774
2775 get_fs_root(current->fs, &fs_root);
2776
2777 chrooted = !path_equal(&fs_root, &ns_root);
2778
2779 path_put(&fs_root);
2780 path_put(&ns_root);
2781
2782 return chrooted;
2783}
2784
2761static void *mntns_get(struct task_struct *task) 2785static void *mntns_get(struct task_struct *task)
2762{ 2786{
2763 struct mnt_namespace *ns = NULL; 2787 struct mnt_namespace *ns = NULL;
diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
index d0ae3a84bcfb..324f9315fa9c 100644
--- a/include/linux/fs_struct.h
+++ b/include/linux/fs_struct.h
@@ -50,4 +50,6 @@ static inline void get_fs_root_and_pwd(struct fs_struct *fs, struct path *root,
50 spin_unlock(&fs->lock); 50 spin_unlock(&fs->lock);
51} 51}
52 52
53extern bool current_chrooted(void);
54
53#endif /* _LINUX_FS_STRUCT_H */ 55#endif /* _LINUX_FS_STRUCT_H */
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index dbfe36a724f4..1d9e40a525b4 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -61,6 +61,15 @@ int create_user_ns(struct cred *new)
61 kgid_t group = new->egid; 61 kgid_t group = new->egid;
62 int ret; 62 int ret;
63 63
64 /*
65 * Verify that we can not violate the policy of which files
66 * may be accessed that is specified by the root directory,
67 * by verifing that the root directory is at the root of the
68 * mount namespace which allows all files to be accessed.
69 */
70 if (current_chrooted())
71 return -EPERM;
72
64 /* The creator needs a mapping in the parent user namespace 73 /* The creator needs a mapping in the parent user namespace
65 * or else we won't be able to reasonably tell userspace who 74 * or else we won't be able to reasonably tell userspace who
66 * created a user_namespace. 75 * created a user_namespace.