Message-ID: <1365713976.9609.63.camel@gandalf.local.home>
Subject: Re: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem
From: Steven Rostedt <rostedt@goodmis.org>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Serge Hallyn <serge.hallyn@canonical.com>
Date: Thu, 11 Apr 2013 16:59:36 -0400
In-Reply-To: <8738uwvlb7.fsf@xmission.com>
References: <20130411202503.783159048@goodmis.org>
	 <20130411202604.512616100@goodmis.org> <8738uwvlb7.fsf@xmission.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2835
Lines: 82

On Thu, 2013-04-11 at 13:55 -0700, Eric W. Biederman wrote:
> Steven Rostedt <rostedt@goodmis.org> writes:
> 
> > 3.6.11.2 stable review patch.
> > If anyone has any objections, please let me know.
> 
> Mounting only with privilege in the user namespace only dates
> back to 3.8 so this is not needed in 3.6.

Hmm, I didn't see anything in the change log to suggest that.

If a patch applies, and there's nothing in the change log that tells me
that it shouldn't be added, I add it ;-)

> 
> Not that it should do any harm.

OK, then, I guess I'll just keep it.

Thanks,

-- Steve

> 
> Eric
> 
> > ------------------
> >
> > From: "Eric W. Biederman" <ebiederm@xmission.com>
> >
> > [ Upstream commit a636b702ed1805e988ad3d8ff8b52c060f8b341c ]
> >
> > Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
> > rights over the ipc namespace.   The principle here is if you create
> > or have capabilities over it you can mount it, otherwise you get to live
> > with what other people have mounted.
> >
> > This information is not particularly sensitive and mqueue essentially
> > only reports which posix messages queues exist.  Still when creating a
> > restricted environment for an application to live any extra
> > information may be of use to someone with sufficient creativity.  The
> > historical if imperfect way this information has been restricted has
> > been not to allow mounts and restricting this to ipc namespace
> > creators maintains the spirit of the historical restriction.
> >
> > Cc: stable@vger.kernel.org
> > Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
> > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
> > Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> > ---
> >  ipc/mqueue.c |   12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> > index 9e4cf7f..f1df4bc 100644
> > --- a/ipc/mqueue.c
> > +++ b/ipc/mqueue.c
> > @@ -331,8 +331,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
> >  			 int flags, const char *dev_name,
> >  			 void *data)
> >  {
> > -	if (!(flags & MS_KERNMOUNT))
> > -		data = current->nsproxy->ipc_ns;
> > +	if (!(flags & MS_KERNMOUNT)) {
> > +		struct ipc_namespace *ns = current->nsproxy->ipc_ns;
> > +		/* Don't allow mounting unless the caller has CAP_SYS_ADMIN
> > +		 * over the ipc namespace.
> > +		 */
> > +		if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> > +			return ERR_PTR(-EPERM);
> > +
> > +		data = ns;
> > +	}
> >  	return mount_ns(fs_type, flags, data, mqueue_fill_super);
> >  }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/