linux-kernel - Re: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1365713976.9609.63.camel@gandalf.local.home>
Date:	Thu, 11 Apr 2013 16:59:36 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Serge Hallyn <serge.hallyn@...onical.com>
Subject: Re: [ 111/171 ] ipc: Restrict mounting the mqueue filesystem

On Thu, 2013-04-11 at 13:55 -0700, Eric W. Biederman wrote:
> Steven Rostedt <rostedt@...dmis.org> writes:
> 
> > 3.6.11.2 stable review patch.
> > If anyone has any objections, please let me know.
> 
> Mounting only with privilege in the user namespace only dates
> back to 3.8 so this is not needed in 3.6.

Hmm, I didn't see anything in the change log to suggest that.

If a patch applies, and there's nothing in the change log that tells me
that it shouldn't be added, I add it ;-)

> 
> Not that it should do any harm.

OK, then, I guess I'll just keep it.

Thanks,

-- Steve

> 
> Eric
> 
> > ------------------
> >
> > From: "Eric W. Biederman" <ebiederm@...ssion.com>
> >
> > [ Upstream commit a636b702ed1805e988ad3d8ff8b52c060f8b341c ]
> >
> > Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
> > rights over the ipc namespace.   The principle here is if you create
> > or have capabilities over it you can mount it, otherwise you get to live
> > with what other people have mounted.
> >
> > This information is not particularly sensitive and mqueue essentially
> > only reports which posix messages queues exist.  Still when creating a
> > restricted environment for an application to live any extra
> > information may be of use to someone with sufficient creativity.  The
> > historical if imperfect way this information has been restricted has
> > been not to allow mounts and restricting this to ipc namespace
> > creators maintains the spirit of the historical restriction.
> >
> > Cc: stable@...r.kernel.org
> > Acked-by: Serge Hallyn <serge.hallyn@...onical.com>
> > Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
> > Signed-off-by: Steven Rostedt <rostedt@...dmis.org>
> > ---
> >  ipc/mqueue.c |   12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> > index 9e4cf7f..f1df4bc 100644
> > --- a/ipc/mqueue.c
> > +++ b/ipc/mqueue.c
> > @@ -331,8 +331,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
> >  			 int flags, const char *dev_name,
> >  			 void *data)
> >  {
> > -	if (!(flags & MS_KERNMOUNT))
> > -		data = current->nsproxy->ipc_ns;
> > +	if (!(flags & MS_KERNMOUNT)) {
> > +		struct ipc_namespace *ns = current->nsproxy->ipc_ns;
> > +		/* Don't allow mounting unless the caller has CAP_SYS_ADMIN
> > +		 * over the ipc namespace.
> > +		 */
> > +		if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> > +			return ERR_PTR(-EPERM);
> > +
> > +		data = ns;
> > +	}
> >  	return mount_ns(fs_type, flags, data, mqueue_fill_super);
> >  }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/