| Message ID | d055925e5d5c0099e9e9c871004fb45fab67e4bc.1512041070.git.dongsu@kinvolk.io (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Dec 22, 2017 at 03:32:33PM +0100, Dongsu Park wrote: > From: Seth Forshee <seth.forshee@canonical.com> > > Unprivileged users are normally restricted from mounting with the > allow_other option by system policy, but this could be bypassed > for a mount done with user namespace root permissions. In such > cases allow_other should not allow users outside the userns > to access the mount as doing so would give the unprivileged user > the ability to manipulate processes it would otherwise be unable > to manipulate. Restrict allow_other to apply to users in the same > userns used at mount or a descendant of that namespace. Also > export current_in_userns() for use by fuse when built as a > module. > > Patch v4 is available: https://patchwork.kernel.org/patch/8944671/ > > Cc: linux-fsdevel@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: "Eric W. Biederman" <ebiederm@xmission.com> > Cc: Serge Hallyn <serge@hallyn.com> > Cc: Miklos Szeredi <mszeredi@redhat.com> > Signed-off-by: Seth Forshee <seth.forshee@canonical.com> > Signed-off-by: Dongsu Park <dongsu@kinvolk.io> Reviewed-by: Serge Hallyn <serge@hallyn.com> > --- > fs/fuse/dir.c | 2 +- > kernel/user_namespace.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c > index ad1cfac1..d41559a0 100644 > --- a/fs/fuse/dir.c > +++ b/fs/fuse/dir.c > @@ -1030,7 +1030,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) > const struct cred *cred; > > if (fc->allow_other) > - return 1; > + return current_in_userns(fc->user_ns); > > cred = current_cred(); > if (uid_eq(cred->euid, fc->user_id) && > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 246d4d4c..492c255e 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns) > { > return in_userns(target_ns, current_user_ns()); > } > +EXPORT_SYMBOL(current_in_userns); I have to say I'm not happy with this name. I wish it had been called current_under_userns or something to indicate it may also be in a child. > > static inline struct user_namespace *to_user_ns(struct ns_common *ns) > { > -- > 2.13.6
Dongsu Park <dongsu@kinvolk.io> writes: > From: Seth Forshee <seth.forshee@canonical.com> > > Unprivileged users are normally restricted from mounting with the > allow_other option by system policy, but this could be bypassed > for a mount done with user namespace root permissions. In such > cases allow_other should not allow users outside the userns > to access the mount as doing so would give the unprivileged user > the ability to manipulate processes it would otherwise be unable > to manipulate. Restrict allow_other to apply to users in the same > userns used at mount or a descendant of that namespace. Also > export current_in_userns() for use by fuse when built as a > module. > > Patch v4 is available: https://patchwork.kernel.org/patch/8944671/ > > Cc: linux-fsdevel@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: "Eric W. Biederman" <ebiederm@xmission.com> > Cc: Serge Hallyn <serge@hallyn.com> > Cc: Miklos Szeredi <mszeredi@redhat.com> > Signed-off-by: Seth Forshee <seth.forshee@canonical.com> > Signed-off-by: Dongsu Park <dongsu@kinvolk.io> Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > fs/fuse/dir.c | 2 +- > kernel/user_namespace.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c > index ad1cfac1..d41559a0 100644 > --- a/fs/fuse/dir.c > +++ b/fs/fuse/dir.c > @@ -1030,7 +1030,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) > const struct cred *cred; > > if (fc->allow_other) > - return 1; > + return current_in_userns(fc->user_ns); > > cred = current_cred(); > if (uid_eq(cred->euid, fc->user_id) && > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 246d4d4c..492c255e 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns) > { > return in_userns(target_ns, current_user_ns()); > } > +EXPORT_SYMBOL(current_in_userns); > > static inline struct user_namespace *to_user_ns(struct ns_common *ns) > {
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index ad1cfac1..d41559a0 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1030,7 +1030,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) const struct cred *cred; if (fc->allow_other) - return 1; + return current_in_userns(fc->user_ns); cred = current_cred(); if (uid_eq(cred->euid, fc->user_id) && diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 246d4d4c..492c255e 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns) { return in_userns(target_ns, current_user_ns()); } +EXPORT_SYMBOL(current_in_userns); static inline struct user_namespace *to_user_ns(struct ns_common *ns) {