Re: [CFT][PATCH 6/7] userns: Add a knob to disable setgroups on a per user namespace basis
From: Andy Lutomirski <hidden>
Date: 2014-12-08 22:22:25
Also in:
linux-man, lkml, stable
Possibly related (same subject, not in this thread)
- 2014-12-09 · Re: [CFT][PATCH 6/7] userns: Add a knob to disable setgroups on a per user namespace basis · Eric W. Biederman <hidden>
- 2014-12-08 · Re: [CFT][PATCH 6/7] userns: Add a knob to disable setgroups on a per user namespace basis · Eric W. Biederman <hidden>
- 2014-12-08 · Re: [CFT][PATCH 6/7] userns: Add a knob to disable setgroups on a per user namespace basis · Andy Lutomirski <luto@amacapital.net>
- 2014-12-08 · Re: [CFT][PATCH 6/7] userns: Add a knob to disable setgroups on a per user namespace basis · Eric W. Biederman <hidden>
On Mon, Dec 8, 2014 at 2:11 PM, Eric W. Biederman [off-list ref] wrote:
- Expose the knob to user space through a proc file /proc/<pid>/setgroups A value of 0 means the setgroups system call is disabled in the
"deny"
current processes user namespace and can not be enabled in the future in this user namespace. A value of 1 means the segtoups system call is enabled.
"allow"
- Descedent user namespaces inherit the value of setgroups from
s/Descedent/Descendent/
quoted hunk ↗ jump to hunk
--- a/kernel/groups.c +++ b/kernel/groups.c@@ -222,6 +222,7 @@ bool may_setgroups(void) * the user namespace has been established. */ return userns_gid_mappings_established(user_ns) && + userns_setgroups_allowed(user_ns) && ns_capable(user_ns, CAP_SETGID); }
Can you add a comment explaining the ordering? For example: We need to check for a gid mapping before checking setgroups_allowed because an unprivileged user can create a userns with setgroups allowed, then disallow setgroups and add a mapping. If we check in the opposite order, then we have a race: we could see that setgroups is allowed before the user clears the bit and then see that there is a gid mapping after the other thread is done. --Andy -- Andy Lutomirski AMA Capital Management, LLC