| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1462372014-3786-2-git-send-email-tixxdz@gmail.com>
Date: Wed, 4 May 2016 16:26:47 +0200
From: Djalal Harouni <tixxdz@...il.com>
To: Alexander Viro <viro@...iv.linux.org.uk>, Chris Mason <clm@...com>,
<tytso@....edu>, Serge Hallyn <serge.hallyn@...onical.com>,
Josh Triplett <josh@...htriplett.org>,
"Eric W. Biederman" <ebiederm@...ssion.com>,
Andy Lutomirski <luto@...nel.org>,
Seth Forshee <seth.forshee@...onical.com>,
linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-security-module@...r.kernel.org,
Dongsu Park <dongsu@...ocode.com>,
David Herrmann <dh.herrmann@...glemail.com>,
Miklos Szeredi <mszeredi@...hat.com>,
Alban Crequy <alban.crequy@...il.com>
Cc: Djalal Harouni <tixxdz@...il.com>,
Djalal Harouni <tixxdz@...ndz.org>
Subject: [RFC v2 PATCH 1/8] VFS: add CLONE_MNTNS_SHIFT_UIDGID flag to allow mounts to shift their UIDs/GIDs
Add CLONE_MNTNS_SHIFT_UIDGID flag which is a mount namespace flag when
set mount points on filesystems that support UID/GID shifts will have
their UIDs and GIDs shifted by the VFS. The UID and GID mapping rules are per
mount namespace, they follow the rules of the user namespace of the containing
mount namespace. The UID/GID of inodes are supposed to always contain
the on-disk values, hence, the shift will be done inside VFS and it's a read
shift when we access the inodes.
This is a preparation patch.
Goal:
/* (1) */
clone4(CLONE_NEWNS|CLONE_MNTNS_SHIFT_UIDGID, ...)
/*
Setup container base mount namespace, rootfs and mount all
necessary mount points and filesystems that can't be mounted
in user namespaces. Filesystems that support uid/gid shifts
should set the mount parameters.
mount(..., mount_options=[vfs_shift_uids, vfs_shift_gids])
*/
/* (2) */
/*
Setup new mount and user namespaces and inherit the
CLONE_MNTNS_SHIFT_UIDGID flag from (1) into the new mount
namespace (2).
*/
clone4(CLONE_NEWUSER|CLONE_NEWNS|CLONE_MNTNS_SHIFT_UIDGID, ...)
/*
inodes of mount points here that support UID/GID shifts will have
automatically their UID/GID shifted according to the user
namespace rules of the current mount namespace (2).
*/
We create the new user and mount namespaces where:
1) The mount namespace allows mounts inside it that support UID and GID
shifting to perform the shifts if the CLONE_MNTNS_SHIFT_UIDGID is set
in the current mount namespace.
2) The UID and GID mapping is done according to the rules of the user
namespace of the containing mount namespace. The CLONE_MNTNS_SHIFT_UIDGID
follows the CLONE_NEWUSER|CLONE_NEWNS combination. This ensures that
only the creator of the mount namespace is able to adjust the user
namespace mapping rules.
The flag CLONE_MNTNS_SHIFT_UIDGID can be set on the mount namespace
only if:
1) The parent namespace has already CLONE_MNTNS_SHIFT_UIDGID set on
its mount namespace.
2) The caller has CAP_SYS_ADMIN in the init_user_ns namespace, since we
start from that namespace and we inherit some mount points we have to
protect files from privileged userns doing:
clone(CLONE_NEWUSER|CLONE_NEWNS|CLONE_MNTNS_SHIFT_UIDGID...)
This is blocked.
If a filesystem was mounted with "vfs_shift_uids" and "vfs_shift_gids"
and shows up in a mount namespace that does not include the
CLONE_MNTNS_SHIFT_UIDGID, then no shift is done. UIDs and GIDs will
not be changed at all, and things will continue to work as they are now.
Signed-off-by: Dongsu Park <dongsu@...ocode.com>
Signed-off-by: Djalal Harouni <tixxdz@...ndz.org>
---
fs/mount.h | 1 +
fs/namespace.c | 20 ++++++++++++++++++++
include/uapi/linux/sched.h | 1 +
kernel/fork.c | 4 ++++
4 files changed, 26 insertions(+)
diff --git a/fs/mount.h b/fs/mount.h
index 14db05d..1e317eb 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -6,6 +6,7 @@
struct mnt_namespace {
atomic_t count;
+ int flags;
struct ns_common ns;
struct mount * root;
struct list_head list;
diff --git a/fs/namespace.c b/fs/namespace.c
index 4fb1691..940ecfc 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2774,6 +2774,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
INIT_LIST_HEAD(&new_ns->list);
init_waitqueue_head(&new_ns->poll);
new_ns->event = 0;
+ new_ns->flags = 0;
new_ns->user_ns = get_user_ns(user_ns);
return new_ns;
}
@@ -2801,6 +2802,25 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
if (IS_ERR(new_ns))
return new_ns;
+ if (flags & CLONE_MNTNS_SHIFT_UIDGID) {
+ /*
+ * If parent has the CLONE_MNTNS_SHIFT_UIDGID flag set
+ * or current is capable in init_user_ns, then we set the
+ * CLONE_MNTNS_SHIFT_UIDGID flag and allow mounts inside
+ * this namespace to shift their UID and GID.
+ *
+ * We check the init_user_ns here since we always start from
+ * that user namespace and mounts are by default available to all
+ * users. In this regard, only CAP_SYS_ADMIN in init_user_ns is
+ * allowed to start and propagate the CLONE_MNTNS_SHIFT_UIDGID
+ * flag to new mount namespaces.
+ */
+ if ((ns->flags & CLONE_MNTNS_SHIFT_UIDGID) || capable(CAP_SYS_ADMIN))
+ new_ns->flags |= CLONE_MNTNS_SHIFT_UIDGID;
+ else
+ return ERR_PTR(-EPERM);
+ }
+
namespace_lock();
/* First pass: copy the tree topology */
copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
index 5f0fe01..9ba2124 100644
--- a/include/uapi/linux/sched.h
+++ b/include/uapi/linux/sched.h
@@ -19,6 +19,7 @@
#define CLONE_PARENT_SETTID 0x00100000 /* set the TID in the parent */
#define CLONE_CHILD_CLEARTID 0x00200000 /* clear the TID in the child */
#define CLONE_DETACHED 0x00400000 /* Unused, ignored */
+#define CLONE_MNTNS_SHIFT_UIDGID 0x00400000 /* If set allows to shift UID and GID for mounts that support it */
#define CLONE_UNTRACED 0x00800000 /* set if the tracing process can't force CLONE_PTRACE on this clone */
#define CLONE_CHILD_SETTID 0x01000000 /* set the TID in the child */
#define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */
diff --git a/kernel/fork.c b/kernel/fork.c
index d277e83..41223cd 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1264,6 +1264,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
return ERR_PTR(-EINVAL);
+ if ((clone_flags & CLONE_MNTNS_SHIFT_UIDGID) &&
+ !(clone_flags & CLONE_NEWNS))
+ return ERR_PTR(-EINVAL);
+
if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
return ERR_PTR(-EINVAL);
--
2.5.5
Powered by blists - more mailing lists