Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752412Ab1AAEo3 (ORCPT ); Fri, 31 Dec 2010 23:44:29 -0500 Received: from 184-106-158-135.static.cloud-ips.com ([184.106.158.135]:45740 "EHLO mail" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750812Ab1AAEo1 (ORCPT ); Fri, 31 Dec 2010 23:44:27 -0500 Date: Sat, 1 Jan 2011 04:45:22 +0000 From: "Serge E. Hallyn" To: "Eric W. Biederman" Cc: "Serge E. Hallyn" , LSM , James Morris , Kees Cook , containers@lists.linux-foundation.org, kernel list , Alexey Dobriyan , Michael Kerrisk Subject: Re: [RFC 4/5] user namespaces: allow killing tasks in your own or child userns Message-ID: <20110101044522.GA26476@mail.hallyn.com> References: <20101217152246.GA8221@mail.hallyn.com> <20101217152458.GA11162@mail.hallyn.com> <20101217152547.GB11162@mail.hallyn.com> <20101217152625.GC11162@mail.hallyn.com> <20101217152659.GD11162@mail.hallyn.com> <20101217200903.GA15528@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3241 Lines: 103 Quoting Eric W. Biederman (ebiederm@xmission.com): > "Serge E. Hallyn" writes: > > > Quoting Eric W. Biederman (ebiederm@xmission.com): > >> > --- a/kernel/signal.c > >> > +++ b/kernel/signal.c > >> > @@ -659,11 +686,7 @@ static int check_kill_permission(int sig, struct siginfo *info, > >> > cred = current_cred(); > >> > tcred = __task_cred(t); > >> Nit pick you don't need to compute cred and tcred here now. > > > > Just to make sure I understand right: you mean wait until after the > > same_thread_group() check to save calculation in that case, right? > > I mean cred and tcred are only use in kill_ok_by_cred. > So we can eliminate those two variables from check_kill_permission. Thanks for the review. Here is an updated version. Subject: [PATCH 4/5] allow killing tasks in your own or child userns Changelog: Dec 8: Fixed bug in my check_kill_permission pointed out by Eric Biederman. Dec 13: Apply Eric's suggestion to pass target task into kill_ok_by_cred() for clarity Dec 31: address comment by Eric Biederman: don't need cred/tcred in check_kill_permission. Signed-off-by: Serge E. Hallyn --- kernel/signal.c | 36 ++++++++++++++++++++++++++++-------- 1 files changed, 28 insertions(+), 8 deletions(-) diff --git a/kernel/signal.c b/kernel/signal.c index 4e3cff1..d890c99 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -636,13 +636,39 @@ static inline bool si_fromuser(const struct siginfo *info) } /* + * called with RCU read lock from check_kill_permission() + */ +static inline int kill_ok_by_cred(struct task_struct *t) +{ + struct cred *cred = current_cred(); + struct cred *tcred = __task_cred(t); + + if (cred->user->user_ns != tcred->user->user_ns) { + /* userids are not equivalent - either you have the + capability to the target user ns or you don't */ + if (ns_capable(tcred->user->user_ns, CAP_KILL)) + return 1; + return 0; + } + + /* same user namespace - usual credentials checks apply */ + if ((cred->euid ^ tcred->suid) && + (cred->euid ^ tcred->uid) && + (cred->uid ^ tcred->suid) && + (cred->uid ^ tcred->uid) && + !ns_capable(tcred->user->user_ns, CAP_KILL)) + return 0; + + return 1; +} + +/* * Bad permissions for sending the signal * - the caller must hold the RCU read lock */ static int check_kill_permission(int sig, struct siginfo *info, struct task_struct *t) { - const struct cred *cred, *tcred; struct pid *sid; int error; @@ -656,14 +682,8 @@ static int check_kill_permission(int sig, struct siginfo *info, if (error) return error; - cred = current_cred(); - tcred = __task_cred(t); if (!same_thread_group(current, t) && - (cred->euid ^ tcred->suid) && - (cred->euid ^ tcred->uid) && - (cred->uid ^ tcred->suid) && - (cred->uid ^ tcred->uid) && - !capable(CAP_KILL)) { + !kill_ok_by_cred(t)) { switch (sig) { case SIGCONT: sid = task_session(t); -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/