Eric W. Biederman 5e4a08476b userns: Require CAP_SYS_ADMIN for most uses of setns. ... Andy Lutomirski <luto@amacapital.net> found a nasty little bug in the permissions of setns. With unprivileged user namespaces it became possible to create new namespaces without privilege. However the setns calls were relaxed to only require CAP_SYS_ADMIN in the user nameapce of the targed namespace. Which made the following nasty sequence possible. pid = clone(CLONE_NEWUSER | CLONE_NEWNS); if (pid == 0) { /* child */ system("mount --bind /home/me/passwd /etc/passwd"); } else if (pid != 0) { /* parent */ char path[PATH_MAX]; snprintf(path, sizeof(path), "/proc/%u/ns/mnt"); fd = open(path, O_RDONLY); setns(fd, 0); system("su -"); } Prevent this possibility by requiring CAP_SYS_ADMIN in the current user namespace when joing all but the user namespace. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2012-12-14 16:12:03 -08:00
..
9p	The following changes since commit 4cbe5a555fa58a79b6ecbb6c531b8bab0650778d:	2012-10-12 09:59:23 +09:00
adfs
affs
afs
autofs4	userns: Support autofs4 interacing with multiple user namespaces	2012-11-14 22:05:32 -08:00
befs
bfs
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2012-10-26 09:34:04 -07:00
cachefiles
ceph
cifs	Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux	2012-10-14 13:39:34 -07:00
coda
configfs
cramfs
debugfs
devpts
dlm
ecryptfs
efs
exofs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-10-12 10:52:03 +09:00
exportfs
ext2
ext3	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2012-10-16 18:12:38 -07:00
ext4	Various bug fixes for ext4. The most serious of them fixes a security	2012-10-23 08:48:26 +03:00
fat
freevxfs
fscache
fuse	userns: Support fuse interacting with multiple user namespaces	2012-11-14 22:05:33 -08:00
gfs2
hfs
hfsplus
hostfs
hpfs
hppfs	pidns: Use task_active_pid_ns where appropriate	2012-11-19 05:59:09 -08:00
hugetlbfs
isofs
jbd
jbd2
jffs2
jfs	jfs: Fix FITRIM argument handling	2012-10-17 09:18:38 -05:00
lockd	LOCKD: Clear ln->nsm_clnt only when ln->nsm_users is zero	2012-10-24 10:46:22 -04:00
logfs
minix
ncpfs
nfs	NFSv4: Fix the return value for nfs_callback_start_svc	2012-10-16 13:14:42 -04:00
nfs_common
nfsd
nilfs2
nls
notify
ntfs
ocfs2
omfs
openpromfs
proc	proc: Usable inode numbers for the namespace file descriptors.	2012-11-20 04:19:49 -08:00
pstore
qnx4
qnx6
quota	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2012-10-16 18:12:38 -07:00
ramfs
reiserfs
romfs
squashfs
sysfs	userns: Allow unprivilged mounts of proc and sysfs	2012-11-20 04:19:18 -08:00
sysv
ubifs
udf
ufs
xfs
aio.c
anon_inodes.c
attr.c	userns: Allow chown and setgid preservation	2012-11-20 04:17:24 -08:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
bio-integrity.c
bio.c
block_dev.c	Lock splice_read and splice_write functions	2012-10-28 10:59:37 -07:00
buffer.c
char_dev.c	char_dev: pin parent kobject	2012-10-22 08:50:37 +03:00
compat_binfmt_elf.c
compat_ioctl.c	fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check	2012-10-25 14:37:53 -07:00
compat.c	vfs: define struct filename and have getname() return it	2012-10-12 20:14:55 -04:00
coredump.c	fix a leak in replace_fd() users	2012-10-16 13:36:50 -04:00
coredump.h
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c
exec.c	userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped	2012-11-19 05:59:23 -08:00
fcntl.c
fhandle.c
fifo.c
file_table.c
file.c
filesystems.c	vfs: define struct filename and have getname() return it	2012-10-12 20:14:55 -04:00
fs_struct.c
fs-writeback.c	Merge branch 'writeback-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux	2012-10-12 10:46:03 +09:00
generic_acl.c
inode.c
internal.h	vfs: make path_openat take a struct filename pointer	2012-10-12 20:15:09 -04:00
ioctl.c
ioprio.c
Kconfig
Kconfig.binfmt
libfs.c
locks.c
Makefile
mbcache.c
mount.h	proc: Usable inode numbers for the namespace file descriptors.	2012-11-20 04:19:49 -08:00
mpage.c
namei.c	VFS: don't do protected {sym,hard}links by default	2012-10-26 10:05:07 -07:00
namespace.c	userns: Require CAP_SYS_ADMIN for most uses of setns.	2012-12-14 16:12:03 -08:00
no-block.c
open.c	vfs: Allow chroot if you have CAP_SYS_CHROOT in your user namespace	2012-11-19 05:59:17 -08:00
pipe.c
pnode.c
pnode.h	vfs: Only support slave subtrees across different user namespaces	2012-11-19 05:59:20 -08:00
posix_acl.c
proc_namespace.c
read_write.c
read_write.h
readdir.c
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
utimes.c
xattr_acl.c	userns: Fix posix_acl_file_xattr_userns gid conversion	2012-10-12 13:16:48 -07:00
xattr.c	fs, xattr: fix bug when removing a name not in xattr list	2012-10-18 12:35:58 -07:00