lkml.org 
[lkml]   [2015]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 65/84] userns: Allow setting gid_maps without privilege when setgroups is disabled
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Eric W. Biederman" <ebiederm@xmission.com>

    commit 66d2f338ee4c449396b6f99f5e75cd18eb6df272 upstream.

    Now that setgroups can be disabled and not reenabled, setting gid_map
    without privielge can now be enabled when setgroups is disabled.

    This restores most of the functionality that was lost when unprivileged
    setting of gid_map was removed. Applications that use this functionality
    will need to check to see if they use setgroups or init_groups, and if they
    don't they can be fixed by simply disabling setgroups before writing to
    gid_map.

    Reviewed-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/user_namespace.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/kernel/user_namespace.c
    +++ b/kernel/user_namespace.c
    @@ -826,6 +826,11 @@ static bool new_idmap_permitted(const st
    kuid_t uid = make_kuid(ns->parent, id);
    if (uid_eq(uid, cred->euid))
    return true;
    + } else if (cap_setid == CAP_SETGID) {
    + kgid_t gid = make_kgid(ns->parent, id);
    + if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
    + gid_eq(gid, cred->egid))
    + return true;
    }
    }




    \
     
     \ /
      Last update: 2015-01-07 04:01    [W:3.118 / U:0.304 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site