lkml.org 
[lkml]   [2017]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] userns: honour no_new_privs for cap_bset during user ns creation/switch
Date
From: Maciej Żenczykowski <maze@google.com>

This allows locking down user namespaces tighter,
and it could even be considered a security fix.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
---
kernel/user_namespace.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 246d4d4ce5c7..2354f7ade78a 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -50,11 +50,12 @@ static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
* anything as the capabilities are bound to the new user namespace.
*/
cred->securebits = SECUREBITS_DEFAULT;
+ cred->cap_bset = task_no_new_privs(current) ? current_cred()->cap_bset
+ : CAP_FULL_SET;
cred->cap_inheritable = CAP_EMPTY_SET;
- cred->cap_permitted = CAP_FULL_SET;
- cred->cap_effective = CAP_FULL_SET;
+ cred->cap_permitted = cred->cap_bset;
+ cred->cap_effective = cred->cap_bset;
cred->cap_ambient = CAP_EMPTY_SET;
- cred->cap_bset = CAP_FULL_SET;
#ifdef CONFIG_KEYS
key_put(cred->request_key_auth);
cred->request_key_auth = NULL;
--
2.15.1.620.gb9897f4670-goog
\
 
 \ /
  Last update: 2017-12-21 22:07    [W:0.047 / U:1.932 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site