Ready for merge.

On Wed, Apr 10, 2019 at 10:16 AM Kees Cook [off-list ref] wrote:

On Wed, Apr 10, 2019 at 9:56 AM Micah Morton [off-list ref] wrote:

quoted

From: Jann Horn <jannh@google.com>

Looking at current_cred() in write handlers is bad form, stop doing that.

Also, let's just require that the write is coming from the initial user
namespace. Especially SAFESETID_WHITELIST_FLUSH requires privilege over all
namespaces, and SAFESETID_WHITELIST_ADD should probably require it as well.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Micah Morton <mortonm@chromium.org>

Reviewed-by: Kees Cook <redacted>

-Kees

quoted

---
 security/safesetid/securityfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c
index 87e42b7f3e33..76c1e8a6ab93 100644
--- a/security/safesetid/securityfs.c
+++ b/security/safesetid/securityfs.c

@@ -59,8 +59,8 @@ static int parse_policy_line(
        if (ret)
                return ret;

-       *parent = make_kuid(current_user_ns(), parsed_parent);
-       *child = make_kuid(current_user_ns(), parsed_child);
+       *parent = make_kuid(file->f_cred->user_ns, parsed_parent);
+       *child = make_kuid(file->f_cred->user_ns, parsed_child);
        if (!uid_valid(*parent) || !uid_valid(*child))
                return -EINVAL;

@@ -92,7 +92,7 @@ static ssize_t safesetid_file_write(struct file *file,
        kuid_t child;
        int ret;

-       if (!ns_capable(current_user_ns(), CAP_MAC_ADMIN))
+       if (!file_ns_capable(file, &init_user_ns, CAP_MAC_ADMIN))
                return -EPERM;

        if (*ppos != 0)
--

2.21.0.392.gf8f6787159e-goog

--
Kees Cook