linux-kernel - Re: [ 109/171 ] userns: Dont allow creation if the user is chrooted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 22 Oct 2013 10:45:45 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Luis Henriques <luis.henriques@...onical.com>
Cc:	Steven Rostedt <rostedt@...dmis.org>, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org, Serge Hallyn <serge.hallyn@...onical.com>,
	Andy Lutomirski <luto@...capital.net>
Subject: Re: [ 109/171 ] userns: Dont allow creation if the user is chrooted

Luis Henriques <luis.henriques@...onical.com> writes:

> On Thu, Apr 11, 2013 at 04:26:52PM -0400, Steven Rostedt wrote:
>> 3.6.11.2 stable review patch.
>> If anyone has any objections, please let me know.
>> 
>> ------------------
>> 
>> From: "Eric W. Biederman" <ebiederm@...ssion.com>
>> 
>> [ Upstream commit 3151527ee007b73a0ebd296010f1c0454a919c7d ]
>
> While looking at some security bugs, I came across this one
> (CVE-2013-1956).  All the references I could find refer to the 3.8
> kernel only, and this was the only backport I could find to older
> stable kernels.
>
> Could someone clarify if this fix should be included in other stable
> kernels?  Or the only affected kernels were the 3.8.0 to 3.8.5?

Strictly speaking there are older kernels affected.  I think it was 3.5
that had my earliest user namespace bits, and this bug came in with the
first of those bits.  However prior to 3.8 simply not enough things were
converted for most people to build a kernel with user namespaces
enabled.  I don't think distro's will have user namespaces enabled prior
to 3.12 as that is when xfs the last hold out was finally converted.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/