• Eric W. Biederman's avatar
    connector/userns: replace netlink uses of cap_raised() with capable() · 38bf1953
    Eric W. Biederman authored
    In 2009 Philip Reiser notied that a few users of netlink connector
    interface needed a capability check and added the idiom
    cap_raised(nsp->eff_cap, CAP_SYS_ADMIN) to a few of them, on the premise
    that netlink was asynchronous.
    In 2011 Patrick McHardy noticed we were being silly because netlink is
    synchronous and removed eff_cap from the netlink_skb_params and changed
    the idiom to cap_raised(current_cap(), CAP_SYS_ADMIN).
    Looking at those spots with a fresh eye we should be calling
    capable(CAP_SYS_ADMIN).  The only reason I can see for not calling capable
    is that it once appeared we were not in the same task as the caller which
    would have made calling capable() impossible.
    In the initial user_namespace the only difference between between
    cap_raised(current_cap(), CAP_SYS_ADMIN) and capable(CAP_SYS_ADMIN) are a
    few sanity checks and the fact that capable(CAP_SYS_ADMIN) sets
    PF_SUPERPRIV if we use the capability.
    Since we are going to be using root privilege setting PF_SUPERPRIV seems
    the right thing to do.
    The motivation for this that patch is that in a child user namespace
    cap_raised(current_cap(),...) tests your capabilities with respect to that
    child user namespace not capabilities in the initial user namespace and
    thus will allow processes that should be unprivielged to use the kernel
    services that are only protected with cap_raised(current_cap(),..).
    To fix possible user_namespace issues and to just clean up the code
    replace cap_raised(current_cap(), CAP_SYS_ADMIN) with
    Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Philipp Reisner <philipp.reisner@linbit.com>
    Acked-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
    Acked-by: default avatarAndrew G. Morgan <morgan@kernel.org>
    Cc: Vasiliy Kulikov <segoon@openwall.com>
    Cc: David Howells <dhowells@redhat.com>
    Reviewed-by: default avatarJames Morris <james.l.morris@oracle.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
dm-log-userspace-transfer.c 7.11 KB