| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 Sep 2011 16:45:31 -0500
From: "Serge E. Hallyn" <serge.hallyn@...onical.com>
To: lkml <linux-kernel@...r.kernel.org>
Cc: richard@....at, Andrew Morton <akpm@...gle.com>,
Oleg Nesterov <oleg@...hat.com>,
"Eric W. Biederman" <ebiederm@...ssion.com>,
Tejun Heo <tj@...nel.org>, serge@...lyn.com,
serge.hallyn@...onical.com
Subject: [PATCH] user namespace: make signal.c respect user namespaces
__send_signal: convert the uid being sent in SI_USER to the target task's
user namespace.
do_notify_parent and do_notify_parent_cldstop: map task's uid to parent's
user namespace
ptrace_signal: map parent's uid into current's user namespace before
including in signal to current.
Signed-off-by: Serge Hallyn <serge.hallyn@...onical.com>
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: Tejun Heo <tj@...nel.org>
---
kernel/signal.c | 19 +++++++++++++++----
1 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/kernel/signal.c b/kernel/signal.c
index 291c970..bb8ce03 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -27,6 +27,7 @@
#include <linux/capability.h>
#include <linux/freezer.h>
#include <linux/pid_namespace.h>
+#include <linux/user_namespace.h>
#include <linux/nsproxy.h>
#define CREATE_TRACE_POINTS
#include <trace/events/signal.h>
@@ -1073,7 +1074,8 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
q->info.si_code = SI_USER;
q->info.si_pid = task_tgid_nr_ns(current,
task_active_pid_ns(t));
- q->info.si_uid = current_uid();
+ q->info.si_uid = user_ns_map_uid(task_cred_xxx(t, user_ns),
+ current_cred(), current_uid());
break;
case (unsigned long) SEND_SIG_PRIV:
q->info.si_signo = sig;
@@ -1618,7 +1620,8 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
*/
rcu_read_lock();
info.si_pid = task_pid_nr_ns(tsk, tsk->parent->nsproxy->pid_ns);
- info.si_uid = __task_cred(tsk)->uid;
+ info.si_uid = user_ns_map_uid(task_cred_xxx(tsk->parent, user_ns),
+ __task_cred(tsk), __task_cred(tsk)->uid);
rcu_read_unlock();
info.si_utime = cputime_to_clock_t(cputime_add(tsk->utime,
@@ -1688,6 +1691,7 @@ static void do_notify_parent_cldstop(struct task_struct *tsk,
unsigned long flags;
struct task_struct *parent;
struct sighand_struct *sighand;
+ const struct cred *cred;
if (for_ptracer) {
parent = tsk->parent;
@@ -1703,7 +1707,9 @@ static void do_notify_parent_cldstop(struct task_struct *tsk,
*/
rcu_read_lock();
info.si_pid = task_pid_nr_ns(tsk, parent->nsproxy->pid_ns);
- info.si_uid = __task_cred(tsk)->uid;
+ cred = __task_cred(tsk);
+ info.si_uid = user_ns_map_uid(task_cred_xxx(parent, user_ns),
+ cred, cred->uid);
rcu_read_unlock();
info.si_utime = cputime_to_clock_t(tsk->utime);
@@ -2118,11 +2124,16 @@ static int ptrace_signal(int signr, siginfo_t *info,
* have updated *info via PTRACE_SETSIGINFO.
*/
if (signr != info->si_signo) {
+ const struct cred *pcred;
info->si_signo = signr;
info->si_errno = 0;
info->si_code = SI_USER;
info->si_pid = task_pid_vnr(current->parent);
- info->si_uid = task_uid(current->parent);
+ rcu_read_lock();
+ pcred = __task_cred(current->parent);
+ info->si_uid = user_ns_map_uid(current_user_ns(),
+ pcred, pcred->uid);
+ rcu_read_unlock();
}
/* If the (new) signal is now blocked, requeue it. */
--
1.7.5.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists