aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric W. Biederman2013-03-15 03:45:51 -0500
committerGreg Kroah-Hartman2013-04-05 11:26:01 -0500
commit7f60ac1533f522fe257dca74fbb4c4d3820a9b0f (patch)
treec569015738227d5f97f5932f7ba7e891c333540b /fs/namespace.c
parent238f455f2f1af51a8c17db666cee5f380ab2bd01 (diff)
downloadkernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.tar.gz
kernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.tar.xz
kernel-omap-7f60ac1533f522fe257dca74fbb4c4d3820a9b0f.zip
userns: Don't allow creation if the user is chrooted
commit 3151527ee007b73a0ebd296010f1c0454a919c7d upstream. Guarantee that the policy of which files may be access that is established by setting the root directory will not be violated by user namespaces by verifying that the root directory points to the root of the mount namespace at the time of user namespace creation. Changing the root is a privileged operation, and as a matter of policy it serves to limit unprivileged processes to files below the current root directory. For reasons of simplicity and comprehensibility the privilege to change the root directory is gated solely on the CAP_SYS_CHROOT capability in the user namespace. Therefore when creating a user namespace we must ensure that the policy of which files may be access can not be violated by changing the root directory. Anyone who runs a processes in a chroot and would like to use user namespace can setup the same view of filesystems with a mount namespace instead. With this result that this is not a practical limitation for using user namespaces. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Reported-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/namespace.c')
-rw-r--r--fs/namespace.c24
1 files changed, 24 insertions, 0 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index a51054f4e293..8edbad385cb7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2758,6 +2758,30 @@ bool our_mnt(struct vfsmount *mnt)
2758 return check_mnt(real_mount(mnt)); 2758 return check_mnt(real_mount(mnt));
2759} 2759}
2760 2760
2761bool current_chrooted(void)
2762{
2763 /* Does the current process have a non-standard root */
2764 struct path ns_root;
2765 struct path fs_root;
2766 bool chrooted;
2767
2768 /* Find the namespace root */
2769 ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
2770 ns_root.dentry = ns_root.mnt->mnt_root;
2771 path_get(&ns_root);
2772 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
2773 ;
2774
2775 get_fs_root(current->fs, &fs_root);
2776
2777 chrooted = !path_equal(&fs_root, &ns_root);
2778
2779 path_put(&fs_root);
2780 path_put(&ns_root);
2781
2782 return chrooted;
2783}
2784
2761static void *mntns_get(struct task_struct *task) 2785static void *mntns_get(struct task_struct *task)
2762{ 2786{
2763 struct mnt_namespace *ns = NULL; 2787 struct mnt_namespace *ns = NULL;