Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp10752764ybi; Thu, 25 Jul 2019 04:44:39 -0700 (PDT) X-Google-Smtp-Source: APXvYqxOaUcJH67AbFbNbKhXBR78vUR+fmvPTVKMRRA4hDX6iABPEp5pdurKCfm016iwil208S6I X-Received: by 2002:a17:902:2a27:: with SMTP id i36mr89114091plb.161.1564055079538; Thu, 25 Jul 2019 04:44:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564055079; cv=none; d=google.com; s=arc-20160816; b=ri8HkOdnL2Nstt6FKMv8hx/Xs2q89FUS47FN0yq3c4rcCZhTSfxvp3mEIL5hlF6Wyz 7CNc+3So/56SD3APIsMyzVCXGS3wuGFx5TG9M27HRwmnoHO02aeg/VXCKds6/2S5maQP s1e6M0OAB3seDy8C5mpAYG6Z57flVbkgLz4e4nlyobgDBPCi+hcLM+GSblwKv4Tu7HP1 86RX1LbgZ57WV5G5mIVsGB39ubQnltfesPVMCNwnawWQFE7amX2EQfTAASPKMc1NyJNU +cK5b3Zz3ej29U1kFLZ2ftRUe4vsIqzu3e1smb0rRTaeb2IFdwoVzDp++wZq4Kb3QJbd AzVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+DCztiuRFI6q2coQcfdFZZudESdTnRv51rB74hoV4B8=; b=mXv6clGgiLOLhbmo3OlwMe70S0dZjtV7hkXGlHqQrco6BDuB31yQJXhqqABHSfNJ9K PgXWB8KLabglK5ptaCuRY5hpFIIfUfojyEGp7bJAcFHAaqiW0Xo00LAP+SftE8mxB4rg EQ3QWZPrLTZQy7DYdFLUVweydnGFlTgC3mT4WJj6T+m8KvEwsVcGJTdSlqzdRPpmli8L 9c0F5g3p4T4NoRsElnMY5aTZSC992C9qb7DCR1I0pe3niB1CUANF9K2SgiV3mr22vEzB TTAgkNfxep0jF4VwjUONJj0Ai0S1vPEqH3fNoxqXeAux2tj8SJRvrG4fmTPYHFNrxLf3 WfYA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=BD7MDMvG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t23si15209387pjw.56.2019.07.25.04.44.22; Thu, 25 Jul 2019 04:44:39 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=BD7MDMvG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391415AbfGYFqX (ORCPT + 99 others); Thu, 25 Jul 2019 01:46:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:33848 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726870AbfGYFqT (ORCPT ); Thu, 25 Jul 2019 01:46:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AFAC222BF3; Thu, 25 Jul 2019 05:46:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564033578; bh=AILK7DP9X50hhJTzq8VqHW7fZk/yuQgyTU9wiXDKOBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BD7MDMvGVIxyCJK9ISUjBTLVBpDIPl9rBjh9kksDO6kKvG3/f4MaEm1MfSj3pIolD sGiBXORVBL84ly1d8PlXPzr5fnIWBafzoiDbeUtvw4LYWUye0HSL+9LVneyZ96gl1R g3QCh4UGMUaHp3rIgUL/T18KHw/73k0QQYVg0hnQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Radoslaw Burny , Luis Chamberlain , Kees Cook , "Eric W . Biederman" , Seth Forshee , John Sperbeck , Alexey Dobriyan , Andrew Morton , Linus Torvalds Subject: [PATCH 4.19 215/271] fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. Date: Wed, 24 Jul 2019 21:21:24 +0200 Message-Id: <20190724191713.517461667@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190724191655.268628197@linuxfoundation.org> References: <20190724191655.268628197@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Radoslaw Burny commit 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf upstream. Normally, the inode's i_uid/i_gid are translated relative to s_user_ns, but this is not a correct behavior for proc. Since sysctl permission check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense to use these values in u_[ug]id of proc inodes. In other words: although uid/gid in the inode is not read during test_perm, the inode logically belongs to the root of the namespace. I have confirmed this with Eric Biederman at LPC and in this thread: https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com Consequences ============ Since the i_[ug]id values of proc nodes are not used for permissions checks, this change usually makes no functional difference. However, it causes an issue in a setup where: * a namespace container is created without root user in container - hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID * container creator tries to configure it by writing /proc/sys files, e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit Kernel does not allow to open an inode for writing if its i_[ug]id are invalid, making it impossible to write shmmax and thus - configure the container. Using a container with no root mapping is apparently rare, but we do use this configuration at Google. Also, we use a generic tool to configure the container limits, and the inability to write any of them causes a failure. History ======= The invalid uids/gids in inodes first appeared due to 81754357770e (fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns). However, AFAIK, this did not immediately cause any issues. The inability to write to these "invalid" inodes was only caused by a later commit 0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown to the vfs). Tested: Used a repro program that creates a user namespace without any mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside. Before the change, it shows the overflow uid, with the change it's 0. The overflow uid indicates that the uid in the inode is not correct and thus it is not possible to open the file for writing. Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs") Signed-off-by: Radoslaw Burny Acked-by: Luis Chamberlain Cc: Kees Cook Cc: "Eric W . Biederman" Cc: Seth Forshee Cc: John Sperbeck Cc: Alexey Dobriyan Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/proc/proc_sysctl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/proc/proc_sysctl.c +++ b/fs/proc/proc_sysctl.c @@ -498,6 +498,10 @@ static struct inode *proc_sys_make_inode if (root->set_ownership) root->set_ownership(head, table, &inode->i_uid, &inode->i_gid); + else { + inode->i_uid = GLOBAL_ROOT_UID; + inode->i_gid = GLOBAL_ROOT_GID; + } return inode; }