diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2017-04-29 14:12:15 -0500 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2017-07-20 07:43:58 -0500 |
| commit | a2b426267c56773201f968fdb5eda6ab9ae94e34 (patch) | |
| tree | b58af67eb704fcd9d3306b0b725c935a1dbcadae /kernel/pid_namespace.c | |
| parent | 5771a8c08880cdca3bfb4a3fc6d309d6bba20877 (diff) | |
userns,pidns: Verify the userns for new pid namespaces
It is pointless and confusing to allow a pid namespace hierarchy and
the user namespace hierarchy to get out of sync. The owner of a child
pid namespace should be the owner of the parent pid namespace or
a descendant of the owner of the parent pid namespace.
Otherwise it is possible to construct scenarios where a process has a
capability over a parent pid namespace but does not have the
capability over a child pid namespace. Which confusingly makes
permission checks non-transitive.
It requires use of setns into a pid namespace (but not into a user
namespace) to create such a scenario.
Add the function in_userns to help in making this determination.
v2: Optimized in_userns by using level as suggested
by: Kirill Tkhai <ktkhai@virtuozzo.com>
Ref: 49f4d8b93ccf ("pidns: Capture the user namespace and filter ns_last_pid")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'kernel/pid_namespace.c')
| -rw-r--r-- | kernel/pid_namespace.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 74a5a7255b4d..4918314893bc 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -101,6 +101,10 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns int i; int err; + err = -EINVAL; + if (!in_userns(parent_pid_ns->user_ns, user_ns)) + goto out; + err = -ENOSPC; if (level > MAX_PID_NS_LEVEL) goto out; |