lkml.org 
[lkml]   [2012]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 3/4] Allow unprivileged CLONE_NEWUTS and CLONE_NEWIPC with no_new_privs
    Date
    They are normally disallowed because they could be used to subvert
    setuid programs. But if setuid is disabled, then they are safe.

    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    ---
    kernel/nsproxy.c | 8 +++++++-
    1 files changed, 7 insertions(+), 1 deletions(-)

    diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
    index b576f7f..47cf873 100644
    --- a/kernel/nsproxy.c
    +++ b/kernel/nsproxy.c
    @@ -191,7 +191,13 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
    CLONE_NEWNET)))
    return 0;

    - if (!capable(CAP_SYS_ADMIN))
    + /* We require either no_new_privs or CAP_SYS_ADMIN for all modes */
    + if (!current->no_new_privs && !capable(CAP_SYS_ADMIN))
    + return -EPERM;
    +
    + /* NEWNS and NEWNET always require CAP_SYS_ADMIN. */
    + if ((unshare_flags & (CLONE_NEWNS | CLONE_NEWNET)) &&
    + !capable(CAP_SYS_ADMIN))
    return -EPERM;

    *new_nsp = create_new_namespaces(unshare_flags, current,
    --
    1.7.7.6


    \
     
     \ /
      Last update: 2012-01-30 17:21    [W:0.021 / U:60.288 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site