Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755086AbaLIXAu (ORCPT ); Tue, 9 Dec 2014 18:00:50 -0500 Received: from mail-la0-f49.google.com ([209.85.215.49]:34138 "EHLO mail-la0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755045AbaLIXAq (ORCPT ); Tue, 9 Dec 2014 18:00:46 -0500 MIME-Version: 1.0 In-Reply-To: <874mt4lfr6.fsf_-_@x220.int.ebiederm.org> References: <52e0643bd47b1e5c65921d6e00aea1f724bb510a.1417281801.git.luto@amacapital.net> <87h9xez20g.fsf@x220.int.ebiederm.org> <87mw75ygwp.fsf@x220.int.ebiederm.org> <87fvcxyf28.fsf_-_@x220.int.ebiederm.org> <874mtdyexp.fsf_-_@x220.int.ebiederm.org> <87a935u3nj.fsf@x220.int.ebiederm.org> <87388xodlj.fsf@x220.int.ebiederm.org> <87h9x5re41.fsf_-_@x220.int.ebiederm.org> <87mw6xpzb0.fsf_-_@x220.int.ebiederm.org> <87ppbtn4mv.fsf@x220.int.ebiederm.org> <87a92xn2io.fsf@x220.int.ebiederm.org> <87r3w8liw4.fsf@x220.int.ebiederm.org> <87iohklfvj.fsf_-_@x220.int.ebiederm.org> <874mt4lfr6.fsf_-_@x220.int.ebiederm.org> From: Andy Lutomirski Date: Tue, 9 Dec 2014 15:00:24 -0800 Message-ID: Subject: Re: [CFT][PATCH 3/8] userns: Don't allow unprivileged creation of gid mappings To: "Eric W. Biederman" Cc: Linux Containers , Josh Triplett , Andrew Morton , Kees Cook , Michael Kerrisk-manpages , Linux API , linux-man , "linux-kernel@vger.kernel.org" , LSM , Casey Schaufler , "Serge E. Hallyn" , Richard Weinberger , Kenton Varda , stable Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 9, 2014 at 12:39 PM, Eric W. Biederman wrote: > > As any gid mapping will allow and must allow for backwards > compatibility dropping groups don't allow any gid mappings to be > established without CAP_SETGID in the parent user namespace. > > For a small class of applications this change breaks userspace > and removes useful functionality. This small class of applications > includes tools/testing/selftests/mount/unprivilged-remount-test.c > > Most of the removed functionality will be added back with the addition > of a one way knob to disable setgroups. Once setgroups is disabled > setting the gid_map becomes as safe as setting the uid_map. > > For more common applications that set the uid_map and the gid_map > with privilege this change will have no affect. > Reviewed-by: Andy Lutomirski > This is part of a fix for CVE-2014-8989. > > Cc: stable@vger.kernel.org > Signed-off-by: "Eric W. Biederman" > --- > kernel/user_namespace.c | 4 ---- > 1 file changed, 4 deletions(-) > > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 27c8dab48c07..1ce6d67c07b7 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -821,10 +821,6 @@ static bool new_idmap_permitted(const struct file *file, > kuid_t uid = make_kuid(ns->parent, id); > if (uid_eq(uid, file->f_cred->fsuid)) > return true; > - } else if (cap_setid == CAP_SETGID) { > - kgid_t gid = make_kgid(ns->parent, id); > - if (gid_eq(gid, file->f_cred->fsgid)) > - return true; > } > } > > -- > 1.9.1 > -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/