Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751818AbbBKICW (ORCPT ); Wed, 11 Feb 2015 03:02:22 -0500 Received: from mail-lb0-f172.google.com ([209.85.217.172]:46142 "EHLO mail-lb0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751285AbbBKICT convert rfc822-to-8bit (ORCPT ); Wed, 11 Feb 2015 03:02:19 -0500 MIME-Version: 1.0 Reply-To: mtk.manpages@gmail.com In-Reply-To: <54CF9995.1050409@gmail.com> References: <52e0643bd47b1e5c65921d6e00aea1f724bb510a.1417281801.git.luto@amacapital.net> <87h9x5re41.fsf_-_@x220.int.ebiederm.org> <87mw6xpzb0.fsf_-_@x220.int.ebiederm.org> <87ppbtn4mv.fsf@x220.int.ebiederm.org> <87a92xn2io.fsf@x220.int.ebiederm.org> <87r3w8liw4.fsf@x220.int.ebiederm.org> <87iohklfvj.fsf_-_@x220.int.ebiederm.org> <87fvcok11h.fsf_-_@x220.int.ebiederm.org> <971ad3f6-90fd-4e3f-916c-8988af3c826d@email.android.com> <87wq5zf83t.fsf@x220.int.ebiederm.org> <87iohh3c9c.fsf@x220.int.ebiederm.org> <8761dh3b7k.fsf_-_@x220.int.ebiederm.org> <878uicy1r9.fsf_-_@x220.int.ebiederm.org> <87vblg1qme.fsf@x220.int.ebiederm.org> <54CF9995.1050409@gmail.com> From: "Michael Kerrisk (man-pages)" Date: Wed, 11 Feb 2015 09:01:57 +0100 Message-ID: Subject: Re: [PATCH 1/2] proc.5: Document /proc/[pid]/setgroups To: "Eric W. Biederman" Cc: Michael Kerrisk , Linux Containers , Josh Triplett , Andrew Morton , Kees Cook , Linux API , linux-man , "linux-kernel@vger.kernel.org" , LSM , Casey Schaufler , "Serge E. Hallyn" , Richard Weinberger , Kenton Varda , stable , Andy Lutomirski Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3740 Lines: 107 Hi Eric, Ping! Cheers, Michael On 2 February 2015 at 16:36, Michael Kerrisk (man-pages) wrote: > [Adding Josh to CC in case he has anything to add.] > > On 12/12/2014 10:54 PM, Eric W. Biederman wrote: >> >> Signed-off-by: Eric W. Biederman >> --- >> man5/proc.5 | 15 +++++++++++++++ >> 1 file changed, 15 insertions(+) >> >> diff --git a/man5/proc.5 b/man5/proc.5 >> index 96077d0dd195..d661e8cfeac9 100644 >> --- a/man5/proc.5 >> +++ b/man5/proc.5 >> @@ -1097,6 +1097,21 @@ are not available if the main thread has already terminated >> .\" Added in 2.6.9 >> .\" CONFIG_SCHEDSTATS >> .TP >> +.IR /proc/[pid]/setgroups " (since Linux 3.19-rc1)" >> +This file reports >> +.BR allow >> +if the setgroups system call is allowed in the current user namespace. >> +This file reports >> +.BR deny >> +if the setgroups system call is not allowed in the current user namespace. >> +This file may be written to with values of >> +.BR allow >> +and >> +.BR deny >> +before >> +.IR /proc/[pid]/gid_map >> +is written to (enabling setgroups) in a user namespace. >> +.TP >> .IR /proc/[pid]/smaps " (since Linux 2.6.14)" >> This file shows memory consumption for each of the process's mappings. >> (The > > Hi Eric, > > Thanks for this patch. I applied it, and then tried to work in > quite a few other details gleaned from the source code and commit > message, and Jon Corbet's article at http://lwn.net/Articles/626665/. > Could you please let me know if the following is correct: > > /proc/[pid]/setgroups (since Linux 3.19) > This file displays the string "allow" if processes in > the user namespace that contains the process pid are > permitted to employ the setgroups(2) system call, and > "deny" if setgroups(2) is not permitted in that user > namespace. > > A privileged process (one with the CAP_SYS_ADMIN capa‐ > bility in the namespace) may write either of the strings > "allow" or "deny" to this file before writing a group ID > mapping for this user namespace to the file > /proc/[pid]/gid_map. Writing the string "deny" prevents > any process in the user namespace from employing set‐ > groups(2). > > The default value of this file in the initial user > namespace is "allow". > > Once /proc/[pid]/gid_map has been written to (which has > the effect of enabling setgroups(2) in the user names‐ > pace), it is no longer possible to deny setgroups(2) by > writing to /proc/[pid]/setgroups. > > A child user namespace inherits the /proc/[pid]/gid_map > setting from its parent. > > If the setgroups file has the value "deny", then the > setgroups(2) system call can't subsequently be reenabled > (by writing "allow" to the file) in this user namespace. > This restriction also propagates down to all child user > namespaces of this user namespace. > > Thanks, > > Michael > > -- > Michael Kerrisk > Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ > Linux/UNIX System Programming Training: http://man7.org/training/ -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/