Eric W. Biederman f95d7918bd userns: Only allow the creator of the userns unprivileged mappings ... If you did not create the user namespace and are allowed to write to uid_map or gid_map you should already have the necessary privilege in the parent user namespace to establish any mapping you want so this will not affect userspace in practice. Limiting unprivileged uid mapping establishment to the creator of the user namespace makes it easier to verify all credentials obtained with the uid mapping can be obtained without the uid mapping without privilege. Limiting unprivileged gid mapping establishment (which is temporarily absent) to the creator of the user namespace also ensures that the combination of uid and gid can already be obtained without privilege. This is part of the fix for CVE-2014-8989. Cc: stable@vger.kernel.org Reviewed-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2014-12-09 17:08:32 -06:00
..
bpf	bpf: split eBPF out of NET	2014-10-27 19:09:59 -04:00
configs
debug	kdb: replace strnicmp with strncasecmp	2014-10-14 02:18:25 +02:00
events	uprobes, x86: Fix _TIF_UPROBE vs _TIF_NOTIFY_RESUME	2014-11-23 14:25:28 -08:00
gcov	gcov: add ARM64 to GCOV_PROFILE_ALL	2014-10-29 16:33:14 -07:00
irq	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
locking	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 15:51:40 +02:00
power	PM / sleep: Fix entering suspend-to-IDLE if no freeze_oops is set	2014-11-08 22:30:05 +01:00
printk	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
rcu	rcu: Make rcu_barrier() understand about missing rcuo kthreads	2014-10-28 13:24:13 -07:00
sched	sched: Provide update_curr callbacks for stop/idle scheduling classes	2014-11-23 14:14:40 -08:00
time	sched/cputime: Fix cpu_timer_sample_group() double accounting	2014-11-16 10:04:18 +01:00
trace	tracing: Do not risk busy looping in buffer splice	2014-11-10 16:47:31 -05:00
.gitignore
acct.c	acct: eliminate compile warning	2014-10-09 22:26:04 -04:00
async.c	kernel/async.c: switch to pr_foo()	2014-10-09 22:26:04 -04:00
audit_tree.c	audit: keep inode pinned	2014-11-11 14:20:22 -05:00
audit_watch.c	audit: invalid op= values for rules	2014-09-23 16:37:53 -04:00
audit.c	Merge branch 'stable-3.18' of git://git.infradead.org/users/pcmoore/audit	2014-11-13 09:36:39 -08:00
audit.h	audit: reduce scope of audit_log_fcaps	2014-09-23 16:37:51 -04:00
auditfilter.c	Merge git://git.infradead.org/users/eparis/audit	2014-10-19 16:25:56 -07:00
auditsc.c	Merge git://git.infradead.org/users/eparis/audit	2014-10-19 16:25:56 -07:00
backtracetest.c
bounds.c
capability.c
cgroup_freezer.c
cgroup.c	Merge branch 'for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-10 07:26:02 -04:00
compat.c
configs.c
context_tracking.c	sched: stop the unbound recursion in preempt_schedule_context()	2014-10-28 10:46:05 +01:00
cpu_pm.c
cpu.c	rcu: More on deadlock between CPU hotplug and expedited grace periods	2014-10-23 07:51:17 -07:00
cpuset.c	Merge branch 'for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-10-10 07:24:40 -04:00
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
extable.c
fork.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
freezer.c	freezer: remove obsolete comments in __thaw_task()	2014-10-21 23:44:20 +02:00
futex_compat.c
futex.c	futex: Fix a race condition between REQUEUE_PI and task death	2014-10-26 16:16:18 +01:00
groups.c	userns: Don't allow setgroups until a gid mapping has been setablished	2014-12-09 16:58:40 -06:00
hung_task.c
irq_work.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
jump_label.c
kallsyms.c	kernel/kallsyms.c: use __seq_open_private()	2014-10-14 02:18:16 +02:00
kcmp.c	kcmp: fix standard comparison bug	2014-09-10 15:42:12 -07:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c	kexec: remove the unused function parameter	2014-10-14 02:18:21 +02:00
kmod.c	kernel/kmod: fix use-after-free of the sub_info structure	2014-10-29 16:33:14 -07:00
kprobes.c
ksysfs.c
kthread.c	kernel/kthread.c: partial revert of 81c98869fa ("kthread: ensure locality of task_struct allocations")	2014-10-09 22:25:51 -04:00
latencytop.c
Makefile	bpf: split eBPF out of NET	2014-10-27 19:09:59 -04:00
module_signing.c
module-internal.h
module.c	A single panic fix for a rare race, stable CC'd.	2014-10-18 10:24:26 -07:00
notifier.c
nsproxy.c
padata.c
panic.c	kernel/panic.c: update comments for print_tainted	2014-11-13 16:17:06 -08:00
params.c	kernel/param: consolidate __{start,stop}___param[] in <linux/moduleparam.h>	2014-10-14 02:18:28 +02:00
pid_namespace.c
pid.c
profile.c
ptrace.c
range.c
reboot.c	kernel: add support for kernel restart handler call chain	2014-09-26 00:00:06 -07:00
relay.c
res_counter.c
resource.c	x86: optimize resource lookups for ioremap	2014-10-14 02:18:22 +02:00
seccomp.c	Merge branch 'x86-seccomp-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-14 02:27:06 +02:00
signal.c
smp.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
smpboot.c
smpboot.h
softirq.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
stacktrace.c
stop_machine.c
sys_ni.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
sys.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
sysctl_binary.c	dmaengine-3.17	2014-10-07 20:39:25 -04:00
sysctl.c	sched/fair: Fix division by zero sysctl_numa_balancing_scan_size	2014-10-28 10:46:04 +01:00
system_certificates.S
system_keyring.c
task_work.c
taskstats.c
test_kprobes.c
torture.c	torture: Address race in module cleanup	2014-09-16 13:41:06 -07:00
tracepoint.c
tsacct.c
uid16.c	groups: Consolidate the setgroups permission checks	2014-12-05 17:19:27 -06:00
up.c
user_namespace.c	userns: Only allow the creator of the userns unprivileged mappings	2014-12-09 17:08:32 -06:00
user-return-notifier.c
user.c
utsname_sysctl.c
utsname.c
watchdog.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
workqueue_internal.h
workqueue.c	workqueue: Use cond_resched_rcu_qs macro	2014-10-06 05:58:26 -07:00