Commit 18815a18 authored by Eric W. Biederman's avatar Eric W. Biederman

userns: Convert capabilities related permsion checks

- Use uid_eq when comparing kuids
  Use gid_eq when comparing kgids
- Use make_kuid(user_ns, 0) to talk about the user_namespace root uid
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent 9c806aa0
...@@ -316,7 +316,8 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) ...@@ -316,7 +316,8 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
if (!issecure(SECURE_NO_SETUID_FIXUP)) { if (!issecure(SECURE_NO_SETUID_FIXUP)) {
/* Clear the capabilities if we switch to a non-root user */ /* Clear the capabilities if we switch to a non-root user */
if (override_cred->uid) kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
if (!uid_eq(override_cred->uid, root_uid))
cap_clear(override_cred->cap_effective); cap_clear(override_cred->cap_effective);
else else
override_cred->cap_effective = override_cred->cap_effective =
......
...@@ -472,19 +472,22 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) ...@@ -472,19 +472,22 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
struct cred *new = bprm->cred; struct cred *new = bprm->cred;
bool effective, has_cap = false; bool effective, has_cap = false;
int ret; int ret;
kuid_t root_uid;
effective = false; effective = false;
ret = get_file_caps(bprm, &effective, &has_cap); ret = get_file_caps(bprm, &effective, &has_cap);
if (ret < 0) if (ret < 0)
return ret; return ret;
root_uid = make_kuid(new->user_ns, 0);
if (!issecure(SECURE_NOROOT)) { if (!issecure(SECURE_NOROOT)) {
/* /*
* If the legacy file capability is set, then don't set privs * If the legacy file capability is set, then don't set privs
* for a setuid root binary run by a non-root user. Do set it * for a setuid root binary run by a non-root user. Do set it
* for a root user just to cause least surprise to an admin. * for a root user just to cause least surprise to an admin.
*/ */
if (has_cap && new->uid != 0 && new->euid == 0) { if (has_cap && !uid_eq(new->uid, root_uid) && uid_eq(new->euid, root_uid)) {
warn_setuid_and_fcaps_mixed(bprm->filename); warn_setuid_and_fcaps_mixed(bprm->filename);
goto skip; goto skip;
} }
...@@ -495,12 +498,12 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) ...@@ -495,12 +498,12 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
* *
* If only the real uid is 0, we do not set the effective bit. * If only the real uid is 0, we do not set the effective bit.
*/ */
if (new->euid == 0 || new->uid == 0) { if (uid_eq(new->euid, root_uid) || uid_eq(new->uid, root_uid)) {
/* pP' = (cap_bset & ~0) | (pI & ~0) */ /* pP' = (cap_bset & ~0) | (pI & ~0) */
new->cap_permitted = cap_combine(old->cap_bset, new->cap_permitted = cap_combine(old->cap_bset,
old->cap_inheritable); old->cap_inheritable);
} }
if (new->euid == 0) if (uid_eq(new->euid, root_uid))
effective = true; effective = true;
} }
skip: skip:
...@@ -508,8 +511,8 @@ skip: ...@@ -508,8 +511,8 @@ skip:
/* Don't let someone trace a set[ug]id/setpcap binary with the revised /* Don't let someone trace a set[ug]id/setpcap binary with the revised
* credentials unless they have the appropriate permit * credentials unless they have the appropriate permit
*/ */
if ((new->euid != old->uid || if ((!uid_eq(new->euid, old->uid) ||
new->egid != old->gid || !gid_eq(new->egid, old->gid) ||
!cap_issubset(new->cap_permitted, old->cap_permitted)) && !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) { bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
/* downgrade; they get no more than they had, and maybe less */ /* downgrade; they get no more than they had, and maybe less */
...@@ -544,7 +547,7 @@ skip: ...@@ -544,7 +547,7 @@ skip:
*/ */
if (!cap_isclear(new->cap_effective)) { if (!cap_isclear(new->cap_effective)) {
if (!cap_issubset(CAP_FULL_SET, new->cap_effective) || if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
new->euid != 0 || new->uid != 0 || !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
issecure(SECURE_NOROOT)) { issecure(SECURE_NOROOT)) {
ret = audit_log_bprm_fcaps(bprm, new, old); ret = audit_log_bprm_fcaps(bprm, new, old);
if (ret < 0) if (ret < 0)
...@@ -569,16 +572,17 @@ skip: ...@@ -569,16 +572,17 @@ skip:
int cap_bprm_secureexec(struct linux_binprm *bprm) int cap_bprm_secureexec(struct linux_binprm *bprm)
{ {
const struct cred *cred = current_cred(); const struct cred *cred = current_cred();
kuid_t root_uid = make_kuid(cred->user_ns, 0);
if (cred->uid != 0) { if (!uid_eq(cred->uid, root_uid)) {
if (bprm->cap_effective) if (bprm->cap_effective)
return 1; return 1;
if (!cap_isclear(cred->cap_permitted)) if (!cap_isclear(cred->cap_permitted))
return 1; return 1;
} }
return (cred->euid != cred->uid || return (!uid_eq(cred->euid, cred->uid) ||
cred->egid != cred->gid); !gid_eq(cred->egid, cred->gid));
} }
/** /**
...@@ -668,15 +672,21 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name) ...@@ -668,15 +672,21 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
*/ */
static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old) static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
{ {
if ((old->uid == 0 || old->euid == 0 || old->suid == 0) && kuid_t root_uid = make_kuid(old->user_ns, 0);
(new->uid != 0 && new->euid != 0 && new->suid != 0) &&
if ((uid_eq(old->uid, root_uid) ||
uid_eq(old->euid, root_uid) ||
uid_eq(old->suid, root_uid)) &&
(!uid_eq(new->uid, root_uid) &&
!uid_eq(new->euid, root_uid) &&
!uid_eq(new->suid, root_uid)) &&
!issecure(SECURE_KEEP_CAPS)) { !issecure(SECURE_KEEP_CAPS)) {
cap_clear(new->cap_permitted); cap_clear(new->cap_permitted);
cap_clear(new->cap_effective); cap_clear(new->cap_effective);
} }
if (old->euid == 0 && new->euid != 0) if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
cap_clear(new->cap_effective); cap_clear(new->cap_effective);
if (old->euid != 0 && new->euid == 0) if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
new->cap_effective = new->cap_permitted; new->cap_effective = new->cap_permitted;
} }
...@@ -709,11 +719,12 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) ...@@ -709,11 +719,12 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
* if not, we might be a bit too harsh here. * if not, we might be a bit too harsh here.
*/ */
if (!issecure(SECURE_NO_SETUID_FIXUP)) { if (!issecure(SECURE_NO_SETUID_FIXUP)) {
if (old->fsuid == 0 && new->fsuid != 0) kuid_t root_uid = make_kuid(old->user_ns, 0);
if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
new->cap_effective = new->cap_effective =
cap_drop_fs_set(new->cap_effective); cap_drop_fs_set(new->cap_effective);
if (old->fsuid != 0 && new->fsuid == 0) if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
new->cap_effective = new->cap_effective =
cap_raise_fs_set(new->cap_effective, cap_raise_fs_set(new->cap_effective,
new->cap_permitted); new->cap_permitted);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment