lkml.org 
[lkml]   [2012]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 30/43] userns: Fail exec for suid and sgid binaries with ids outside our user namespace.
    From: Eric W. Biederman <ebiederm@xmission.com>

    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    ---
    fs/exec.c | 5 +++++
    1 files changed, 5 insertions(+), 0 deletions(-)

    diff --git a/fs/exec.c b/fs/exec.c
    index 00ae2ef..e001bdf 100644
    --- a/fs/exec.c
    +++ b/fs/exec.c
    @@ -1291,8 +1291,11 @@ int prepare_binprm(struct linux_binprm *bprm)
    if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
    /* Set-uid? */
    if (mode & S_ISUID) {
    + if (!kuid_has_mapping(bprm->cred->user_ns, inode->i_uid))
    + return -EPERM;
    bprm->per_clear |= PER_CLEAR_ON_SETID;
    bprm->cred->euid = inode->i_uid;
    +
    }

    /* Set-gid? */
    @@ -1302,6 +1305,8 @@ int prepare_binprm(struct linux_binprm *bprm)
    * executable.
    */
    if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
    + if (!kgid_has_mapping(bprm->cred->user_ns, inode->i_gid))
    + return -EPERM;
    bprm->per_clear |= PER_CLEAR_ON_SETID;
    bprm->cred->egid = inode->i_gid;
    }
    --
    1.7.2.5


    \
     
     \ /
      Last update: 2012-04-08 07:21    [W:0.023 / U:61.028 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site