lkml.org 
[lkml]   [2011]   [Jul]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH 05/14] userns: clamp down users of cap_raised
    On Tue, Jul 26, 2011 at 18:58 +0000, Serge Hallyn wrote:
    > From: Serge E. Hallyn <serge.hallyn@canonical.com>
    >
    > A few modules are using cap_raised(current_cap(), cap) to authorize
    > actions, but the privilege should be applicable against the initial
    > user namespace. Refuse privilege if the caller is not in init_user_ns.
    >
    > Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
    > Cc: Eric W. Biederman <ebiederm@xmission.com>
    > ---
    > drivers/block/drbd/drbd_nl.c | 5 +++++
    > drivers/md/dm-log-userspace-transfer.c | 3 +++
    > drivers/staging/pohmelfs/config.c | 3 +++
    > drivers/video/uvesafb.c | 3 +++
    > 4 files changed, 14 insertions(+), 0 deletions(-)
    >
    > diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
    > index 515bcd9..7717f8a 100644
    > --- a/drivers/block/drbd/drbd_nl.c
    > +++ b/drivers/block/drbd/drbd_nl.c
    > @@ -2297,6 +2297,11 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
    > return;
    > }
    >
    > + if (current_user_ns() != &init_user_ns) {
    [...]
    > if (!cap_raised(current_cap(), CAP_SYS_ADMIN)) {
    [...]

    Looks like it is an often pattern. Maybe move both checks to a
    function?


    Thanks,

    --
    Vasiliy Kulikov
    http://www.openwall.com - bringing security into open computing environments

    \
     
     \ /
      Last update: 2011-07-29 01:25    [W:0.020 / U:59.656 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site