From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751869Ab2DHFMP (ORCPT ); Sun, 8 Apr 2012 01:12:15 -0400 Received: from out08.mta.xmission.com ([166.70.13.238]:56878 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751422Ab2DHFMN (ORCPT ); Sun, 8 Apr 2012 01:12:13 -0400 From: "\"Eric W. Beiderman" To: Cc: , , Linux Containers , Andrew Morton , Linus Torvalds , Al Viro , Cyrill Gorcunov , "Eric W. Biederman" Date: Sat, 7 Apr 2012 22:14:57 -0700 Message-Id: <1333862139-31737-1-git-send-email-ebiederm@xmission.com> X-Mailer: git-send-email 1.7.2.5 In-Reply-To: References: X-XM-SPF: eid=;;;mid=;;;hst=in02.mta.xmission.com;;;ip=98.207.153.68;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1+f6cJn6nRwM7vxBBHaS0UC81hiPJXafyM= X-SA-Exim-Connect-IP: 98.207.153.68 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * 1.1 FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.) * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.1 XMSubLong Long Subject * 0.0 T_TM2_M_HEADER_IN_MSG BODY: T_TM2_M_HEADER_IN_MSG * -3.0 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa02 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject * 0.4 UNTRUSTED_Relay Comes from a non-trusted relay X-Spam-DCC: XMission; sa02 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ; X-Spam-Relay-Country: ** Subject: [PATCH 01/43] vfs: Don't allow a user namespace root to make device nodes X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Fri, 06 Aug 2010 16:31:04 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric W. Biederman Safely making device nodes in a container is solvable but simply having the capability in a user namespace is not sufficient to make this work. Acked-by: Serge Hallyn Signed-off-by: Eric W. Biederman --- fs/namei.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 1898198..701954d 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -2560,8 +2560,7 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) if (error) return error; - if ((S_ISCHR(mode) || S_ISBLK(mode)) && - !ns_capable(inode_userns(dir), CAP_MKNOD)) + if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) return -EPERM; if (!dir->i_op->mknod) -- 1.7.2.5