lkml.org 
[lkml]   [2012]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v3 3/4] Allow unprivileged CLONE_NEWUTS and CLONE_NEWIPC with no_new_privs
Date
They are normally disallowed because they could be used to subvert
setuid programs. But if setuid is disabled, then they are safe.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
---
kernel/nsproxy.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index b576f7f..47cf873 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -191,7 +191,13 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
CLONE_NEWNET)))
return 0;

- if (!capable(CAP_SYS_ADMIN))
+ /* We require either no_new_privs or CAP_SYS_ADMIN for all modes */
+ if (!current->no_new_privs && !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ /* NEWNS and NEWNET always require CAP_SYS_ADMIN. */
+ if ((unshare_flags & (CLONE_NEWNS | CLONE_NEWNET)) &&
+ !capable(CAP_SYS_ADMIN))
return -EPERM;

*new_nsp = create_new_namespaces(unshare_flags, current,
--
1.7.7.6


\
 
 \ /
  Last update: 2012-01-30 17:21    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site