linux-kernel - Re: [PATCH] user namespace: usb: make usb urbs user namespace aware (v2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110921183101.GB25590@redhat.com>
Date:	Wed, 21 Sep 2011 20:31:01 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	"Serge E. Hallyn" <serge.hallyn@...onical.com>
Cc:	lkml <linux-kernel@...r.kernel.org>, richard@....at,
	Andrew Morton <akpm@...gle.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Tejun Heo <tj@...nel.org>, serge@...lyn.com
Subject: Re: [PATCH] user namespace: usb: make usb urbs user namespace
	aware (v2)

On 09/21, Serge E. Hallyn wrote:
>
> Add to the dev_state and alloc_async structures the user namespace
> corresponding to the uid and euid.  Pass these to kill_pid_info_as_uid(),
> which can then implement a proper, user-namespace-aware uid check.

Looks correct.



But I have off-topic question. And in fact I am a bit confused,
please help.

First of all, I assume that CLONE_NEWUSER is the only way to change
->user_ns, right?

And, looking at copy_creds() I think that cred->user_ns is always
equal to cred->user->user_ns. However, grep shows a lot of
cred->user->user_ns examples. Why?

> +static int kill_as_cred_perm(const struct cred *cred,
> +			     struct task_struct *target)
> +{
> +	const struct cred *pcred = __task_cred(target);
> +	if (cred->user_ns != pcred->user_ns)
> +		return 0;

Should we really fail if cred->user_ns == pcred->user_ns->creator ?
(or creator of creator, etc).

IOW, shouldn't this match kill_ok_by_cred() path which (at least
cap_capable) checks the ->creator chain when ->user_ns differ?

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/