Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751808AbaKYBHx (ORCPT ); Mon, 24 Nov 2014 20:07:53 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34797 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751751AbaKYBHw (ORCPT ); Mon, 24 Nov 2014 20:07:52 -0500 Subject: [RFC PATCH 4/4] KEYS: exec request-key within the requesting task's namespace From: Ian Kent To: Kernel Mailing List Cc: "J. Bruce Fields" , Oleg Nesterov , Stanislav Kinsbursky , Trond Myklebust , David Howells , Benjamin Coddington , Al Viro , "Eric W. Biederman" Date: Tue, 25 Nov 2014 09:07:42 +0800 Message-ID: <20141125010741.4974.7022.stgit@pluto.fritz.box> In-Reply-To: <20141125005255.4974.54193.stgit@pluto.fritz.box> References: <20141125005255.4974.54193.stgit@pluto.fritz.box> User-Agent: StGit/0.17-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Benjamin Coddington Copy the current task's namespaces into the request-key userspace helper to restrict contained processes from executing key instantiation processes outside their containers. Signed-off-by: Benjamin Coddington Signed-off-by: Ian Kent Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Stanislav Kinsbursky Cc: Oleg Nesterov Cc: Eric W. Biederman --- security/keys/request_key.c | 45 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 39 insertions(+), 6 deletions(-) diff --git a/security/keys/request_key.c b/security/keys/request_key.c index bb4337c..b03feec 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -17,6 +17,8 @@ #include #include #include +#include +#include #include "internal.h" #define key_negative_timeout 60 /* default timeout on a negative key's existence */ @@ -46,6 +48,11 @@ void complete_request_key(struct key_construction *cons, int error) } EXPORT_SYMBOL(complete_request_key); +struct request_key_info { + struct key *keyring; + struct nsproxy *nsproxy; +}; + /* * Initialise a usermode helper that is going to have a specific session * keyring. @@ -55,9 +62,14 @@ EXPORT_SYMBOL(complete_request_key); */ static int umh_keys_init(struct subprocess_info *info, struct cred *cred) { - struct key *keyring = info->data; + struct request_key_info *rki = info->data; + struct nsproxy *ns = rki->nsproxy; - return install_session_keyring_to_cred(cred, keyring); + if (ns) { + mntns_setfs(ns->mnt_ns); + switch_task_namespaces(current, ns); + } + return install_session_keyring_to_cred(cred, rki->keyring); } /* @@ -65,8 +77,9 @@ static int umh_keys_init(struct subprocess_info *info, struct cred *cred) */ static void umh_keys_cleanup(struct subprocess_info *info) { - struct key *keyring = info->data; - key_put(keyring); + struct request_key_info *rki = info->data; + key_put(rki->keyring); + kfree(rki); } /* @@ -76,12 +89,32 @@ static int call_usermodehelper_keys(char *path, char **argv, char **envp, struct key *session_keyring, int wait) { struct subprocess_info *info; + struct request_key_info *rki; + struct nsproxy *ns; + + ns = umh_open_ns(); + if (ns && IS_ERR(ns)) + return PTR_ERR(ns); + + rki = kmalloc(sizeof(*rki), GFP_KERNEL); + if (!rki) { + if (ns) + free_nsproxy(ns); + return -ENOMEM; + } + + rki->keyring = session_keyring; + rki->nsproxy = ns; info = call_usermodehelper_setup(path, argv, envp, GFP_KERNEL, umh_keys_init, umh_keys_cleanup, - session_keyring); - if (!info) + rki); + if (!info) { + if (ns) + free_nsproxy(ns); + kfree(rki); return -ENOMEM; + } key_get(session_keyring); return call_usermodehelper_exec(info, wait); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/