Check unshare and setns against the bound task's authority. Neither
has an LSM hook, so they call KAP directly. Every namespace type is
checked, and setns checks the type of the namespace it is given.
Unbound tasks are not checked.
Assisted-by: Claude
Co-developed-by: Ketan Bhardwaj <redacted>
Signed-off-by: Ketan Bhardwaj <redacted>
Signed-off-by: HARIHARA SUDHAN. R <redacted>
---
kernel/fork.c | 4 ++++
kernel/nsproxy.c | 5 +++++
2 files changed, 9 insertions(+)
diff --git a/kernel/fork.c b/kernel/fork.c
index eb198c8..4216a2d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -52,6 +52,7 @@
#include <linux/cpu.h>
#include <linux/cgroup.h>
#include <linux/security.h>
+#include <linux/kap.h>
#include <linux/hugetlb.h>
#include <linux/seccomp.h>
#include <linux/swap.h>
@@ -3276,6 +3277,9 @@ int ksys_unshare(unsigned long unshare_flags)
current->fs != current->real_fs);
err = check_unshare_flags(unshare_flags);
+ if (err)
+ goto bad_unshare_out;
+ err = kap_check_namespace_flags(unshare_flags, "unshare");
if (err)
goto bad_unshare_out;
/*
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 3fb1595..d41d7f5 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -25,6 +25,7 @@
#include <linux/proc_ns.h>
#include <linux/file.h>
#include <linux/syscalls.h>
+#include <linux/kap.h>
#include <linux/cgroup.h>
#include <linux/perf_event.h>
#include <linux/nstree.h>
@@ -589,6 +590,10 @@ SYSCALL_DEFINE2(setns, int, fd, int, flags)
if (err)
goto out;
+ err = kap_check_namespace_flags(flags, "setns");
+ if (err)
+ goto out;
+
err = prepare_nsset(flags, &nsset);
if (err)
goto out;
--
2.53.0