Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] security: kap: CLONE_NEWUSER skip in
kap_check_namespace_flags() breaks user:unshare rules
--
commit 9adc8e1a3a53f48cafa9cf1ec8d4bd24d0a65150
Author: HARIHARA SUDHAN. R [off-list ref]
kernel: add KAP checks for unshare and setns
This commit adds KAP namespace flag checks to ksys_unshare() and the setns
syscall.
quoted hunk ↗ jump to hunk
diff --git a/kernel/fork.c b/kernel/fork.c
index 33760ece3bb30..3dda9f211ceae 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -3286,6 +3287,9 @@ int ksys_unshare(unsigned long unshare_flags)
current->fs != current->real_fs);
err = check_unshare_flags(unshare_flags);
+ if (err)
+ goto bad_unshare_out;
+ err = kap_check_namespace_flags(unshare_flags, "unshare");
if (err)
goto bad_unshare_out;
/*
[Severity: High]
Does kap_check_namespace_flags() fail to enforce "user:unshare" and "user:*"
predicates when unshare() is called with CLONE_NEWUSER?
security/kap/kap_lsm.c:kap_check_namespace_flags() {
...
if (kap_namespaces[i].flag == CLONE_NEWUSER &&
strcmp(operation, "setns"))
continue;
...
}
Because kap_check_namespace_flags() skips CLONE_NEWUSER for "unshare", the
check is deferred to kap_userns_create(), which passes the bare target string
"user" to kap_check_static_target(). In kap_string_match(), "user" does not
match "user:unshare" or "user:*", so allow rules using the documented
TYPE:OPERATION syntax reject unshare(CLONE_NEWUSER) with -EACCES, while deny
rules for "user:unshare" or "user:*" paired with a broad allow rule such as
"*" are bypassed.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202246.274-1-harisudhan@armoriq.io?part=5