diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2016-11-16 22:06:51 -0600 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-01-01 20:52:11 +0000 |
| commit | a0d8337f16fb5d5dd7b963f092779bc990a1cc0e (patch) | |
| tree | b2f834817947bc1e8bd82a3e771b5118eb367195 /include | |
| parent | d55a94ed03a24794d47f80d5300825f6c095a0a7 (diff) | |
exec: Ensure mm->user_ns contains the execed files
commit f84df2a6f268de584a201e8911384a2d244876e3 upstream.
When the user namespace support was merged the need to prevent
ptrace from revealing the contents of an unreadable executable
was overlooked.
Correct this oversight by ensuring that the executed file
or files are in mm->user_ns, by adjusting mm->user_ns.
Use the new function privileged_wrt_inode_uidgid to see if
the executable is a member of the user namespace, and as such
if having CAP_SYS_PTRACE in the user namespace should allow
tracing the executable. If not update mm->user_ns to
the parent user namespace until an appropriate parent is found.
Reported-by: Jann Horn <jann@thejh.net>
Fixes: 9e4a36ece652 ("userns: Fail exec for suid and sgid binaries with ids outside our user namespace.")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
[bwh: Backported to 3.16:
- Add #include <linux/user_namespace.h>
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/capability.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/capability.h b/include/linux/capability.h index 8248121687d1..4a12b8d51f1b 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -213,6 +213,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, struct user_namespace *ns, int cap); extern bool capable(int cap); extern bool ns_capable(struct user_namespace *ns, int cap); +extern bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode); extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); |