2013-04-11 21:08:32

by Steven Rostedt

Subject: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem

3.6.11.2 stable review patch.
If anyone has any objections, please let me know.

------------------

From: "Eric W. Biederman" <[email protected]>

[ Upstream commit a636b702ed1805e988ad3d8ff8b52c060f8b341c ]

Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
rights over the ipc namespace. The principle here is if you create
or have capabilities over it you can mount it, otherwise you get to live
with what other people have mounted.

This information is not particularly sensitive and mqueue essentially
only reports which posix messages queues exist. Still when creating a
restricted environment for an application to live any extra
information may be of use to someone with sufficient creativity. The
historical if imperfect way this information has been restricted has
been not to allow mounts and restricting this to ipc namespace
creators maintains the spirit of the historical restriction.

Cc: [email protected]
Acked-by: Serge Hallyn <[email protected]>
Signed-off-by: "Eric W. Biederman" <[email protected]>
Signed-off-by: Steven Rostedt <[email protected]>
---
ipc/mqueue.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 9e4cf7f..f1df4bc 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -331,8 +331,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
int flags, const char *dev_name,
void *data)
{
- if (!(flags & MS_KERNMOUNT))
- data = current->nsproxy->ipc_ns;
+ if (!(flags & MS_KERNMOUNT)) {
+ struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+ /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+ * over the ipc namespace.
+ */
+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+
+ data = ns;
+ }
return mount_ns(fs_type, flags, data, mqueue_fill_super);
}

--
1.7.10.4

2013-04-11 20:56:10

by Eric W. Biederman

Subject: Re: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem

Steven Rostedt <[email protected]> writes:

> 3.6.11.2 stable review patch.
> If anyone has any objections, please let me know.

Mounting only with privilege in the user namespace only dates
back to 3.8 so this is not needed in 3.6.

Not that it should do any harm.

Eric

> ------------------
>
> From: "Eric W. Biederman" <[email protected]>
>
> [ Upstream commit a636b702ed1805e988ad3d8ff8b52c060f8b341c ]
>
> Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
> rights over the ipc namespace. The principle here is if you create
> or have capabilities over it you can mount it, otherwise you get to live
> with what other people have mounted.
>
> This information is not particularly sensitive and mqueue essentially
> only reports which posix messages queues exist. Still when creating a
> restricted environment for an application to live any extra
> information may be of use to someone with sufficient creativity. The
> historical if imperfect way this information has been restricted has
> been not to allow mounts and restricting this to ipc namespace
> creators maintains the spirit of the historical restriction.
>
> Cc: [email protected]
> Acked-by: Serge Hallyn <[email protected]>
> Signed-off-by: "Eric W. Biederman" <[email protected]>
> Signed-off-by: Steven Rostedt <[email protected]>
> ---
> ipc/mqueue.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> index 9e4cf7f..f1df4bc 100644
> --- a/ipc/mqueue.c
> +++ b/ipc/mqueue.c
> @@ -331,8 +331,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
> int flags, const char *dev_name,
> void *data)
> {
> - if (!(flags & MS_KERNMOUNT))
> - data = current->nsproxy->ipc_ns;
> + if (!(flags & MS_KERNMOUNT)) {
> + struct ipc_namespace *ns = current->nsproxy->ipc_ns;
> + /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
> + * over the ipc namespace.
> + */
> + if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> + return ERR_PTR(-EPERM);
> +
> + data = ns;
> + }
> return mount_ns(fs_type, flags, data, mqueue_fill_super);
> }

2013-04-11 20:59:40

by Steven Rostedt

Subject: Re: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem

On Thu, 2013-04-11 at 13:55 -0700, Eric W. Biederman wrote:
> Steven Rostedt <[email protected]> writes:
>
> > 3.6.11.2 stable review patch.
> > If anyone has any objections, please let me know.
>
> Mounting only with privilege in the user namespace only dates
> back to 3.8 so this is not needed in 3.6.

Hmm, I didn't see anything in the change log to suggest that.

If a patch applies, and there's nothing in the change log that tells me
that it shouldn't be added, I add it ;-)

>
> Not that it should do any harm.

OK, then, I guess I'll just keep it.

Thanks,

-- Steve

>
> Eric
>
> > ------------------
> >
> > From: "Eric W. Biederman" <[email protected]>
> >
> > [ Upstream commit a636b702ed1805e988ad3d8ff8b52c060f8b341c ]
> >
> > Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
> > rights over the ipc namespace. The principle here is if you create
> > or have capabilities over it you can mount it, otherwise you get to live
> > with what other people have mounted.
> >
> > This information is not particularly sensitive and mqueue essentially
> > only reports which posix messages queues exist. Still when creating a
> > restricted environment for an application to live any extra
> > information may be of use to someone with sufficient creativity. The
> > historical if imperfect way this information has been restricted has
> > been not to allow mounts and restricting this to ipc namespace
> > creators maintains the spirit of the historical restriction.
> >
> > Cc: [email protected]
> > Acked-by: Serge Hallyn <[email protected]>
> > Signed-off-by: "Eric W. Biederman" <[email protected]>
> > Signed-off-by: Steven Rostedt <[email protected]>
> > ---
> > ipc/mqueue.c | 12 ++++++++++--
> > 1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> > index 9e4cf7f..f1df4bc 100644
> > --- a/ipc/mqueue.c
> > +++ b/ipc/mqueue.c
> > @@ -331,8 +331,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
> > int flags, const char *dev_name,
> > void *data)
> > {
> > - if (!(flags & MS_KERNMOUNT))
> > - data = current->nsproxy->ipc_ns;
> > + if (!(flags & MS_KERNMOUNT)) {
> > + struct ipc_namespace *ns = current->nsproxy->ipc_ns;
> > + /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
> > + * over the ipc namespace.
> > + */
> > + if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> > + return ERR_PTR(-EPERM);
> > +
> > + data = ns;
> > + }
> > return mount_ns(fs_type, flags, data, mqueue_fill_super);
> > }