From patchwork Wed Oct 19 02:25:52 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Serge Hallyn X-Patchwork-Id: 120547 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6D6D2B71B9 for ; Wed, 19 Oct 2011 13:26:25 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752655Ab1JSC0G (ORCPT ); Tue, 18 Oct 2011 22:26:06 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:32981 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752283Ab1JSC0E (ORCPT ); Tue, 18 Oct 2011 22:26:04 -0400 Received: from cpe-70-123-137-7.austin.res.rr.com ([70.123.137.7] helo=sergelap) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1RGLqw-0003hF-Vt; Wed, 19 Oct 2011 02:25:59 +0000 Date: Tue, 18 Oct 2011 21:25:52 -0500 From: "Serge E. Hallyn" To: "Serge E. Hallyn" Cc: Joe Perches , linux-kernel@vger.kernel.org, ebiederm@xmission.com, akpm@linux-foundation.org, oleg@redhat.com, richard@nod.at, mikevs@xs4all.net, segoon@openwall.com, gregkh@suse.de, dhowells@redhat.com, eparis@redhat.com, netdev@vger.kernel.org Subject: [PATCH 9/9] make net/core/scm.c uid comparisons user namespace aware (v2) Message-ID: <20111019022552.GA29251@sergelap> References: <1318974898-21431-1-git-send-email-serge@hallyn.com> <1318974898-21431-10-git-send-email-serge@hallyn.com> <1318976049.2273.7.camel@Joe-Laptop> <20111018232242.GA22950@hallyn.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20111018232242.GA22950@hallyn.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org (Thanks for the suggestions, Joe.) Currently uids are compared without regard for the user namespace. Fix that to prevent tasks in a different user namespace from wrongly matching on SCM_CREDENTIALS. In the past, either your uids had to match, or you had to have CAP_SETXID. In a namespaced world, you must either (both be in the same user namespace and have your uids match), or you must have CAP_SETXID targeted at the other user namespace. The latter can happen for instance if uid 500 created a new user namespace and now interacts with uid 0 in it. Changelog: Oct 18: Per Joe Perches: don't mark uidequiv and gidequiv fns inline (let the compiler do that if appropriate), and change the flow of id comparisons to make it clearer. Signed-off-by: Serge E. Hallyn Cc: Eric W. Biederman Cc: Joe Perches --- net/core/scm.c | 43 ++++++++++++++++++++++++++++++++++++------- 1 files changed, 36 insertions(+), 7 deletions(-) diff --git a/net/core/scm.c b/net/core/scm.c index 811b53f..2261607 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -43,17 +43,46 @@ * setu(g)id. */ -static __inline__ int scm_check_creds(struct ucred *creds) +static bool uidequiv(const struct cred *src, struct ucred *tgt, + struct user_namespace *ns) +{ + if (src->user_ns != ns) + goto check_capable; + if (tgt->uid == src->uid || + tgt->uid == src->euid || + tgt->uid == src->suid) + return true; +check_capable: + if (ns_capable(ns, CAP_SETUID)) + return true; + return false; +} + +static bool gidequiv(const struct cred *src, struct ucred *tgt, + struct user_namespace *ns) +{ + if (src->user_ns != ns) + goto check_capable; + if (tgt->gid == src->gid || + tgt->gid == src->egid || + tgt->gid == src->sgid) + return true; +check_capable: + if (ns_capable(ns, CAP_SETGID)) + return true; + return false; +} + +static int scm_check_creds(struct ucred *creds, struct socket *sock) { const struct cred *cred = current_cred(); + struct user_namespace *ns = sock_net(sock->sk)->user_ns; - if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) && - ((creds->uid == cred->uid || creds->uid == cred->euid || - creds->uid == cred->suid) || capable(CAP_SETUID)) && - ((creds->gid == cred->gid || creds->gid == cred->egid || - creds->gid == cred->sgid) || capable(CAP_SETGID))) { + if ((creds->pid == task_tgid_vnr(current) || ns_capable(ns, CAP_SYS_ADMIN)) && + uidequiv(cred, creds, ns) && gidequiv(cred, creds, ns)) { return 0; } + return -EPERM; } @@ -169,7 +198,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) goto error; memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred)); - err = scm_check_creds(&p->creds); + err = scm_check_creds(&p->creds, sock); if (err) goto error;