From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751772AbcGNTHs (ORCPT ); Thu, 14 Jul 2016 15:07:48 -0400 Received: from resqmta-ch2-10v.sys.comcast.net ([69.252.207.42]:42747 "EHLO resqmta-ch2-10v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751570AbcGNTHq (ORCPT ); Thu, 14 Jul 2016 15:07:46 -0400 Date: Thu, 14 Jul 2016 12:07:42 -0700 From: "W. Trevor King" To: Andrey Vagin Cc: linux-kernel@vger.kernel.org, criu@openvz.org, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH 2/5] kernel: add a helper to get an owning user namespace for a namespace Message-ID: <20160714190742.GA24913@odin.tremily.us> References: <1468520419-28220-1-git-send-email-avagin@openvz.org> <1468520419-28220-3-git-send-email-avagin@openvz.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="0F1p//8PRICkK4MW" Content-Disposition: inline In-Reply-To: <1468520419-28220-3-git-send-email-avagin@openvz.org> OpenPGP: id=39A2F3FA2AB17E5D8764F388FC29BDCDF15F5BE8; url=http://tremily.us/pubkey.txt User-Agent: Mutt/1.5.23 (2014-03-12) X-CMAE-Envelope: MS4wfGZR4s5Ozgi2+o6y9TUBLBDDNLvAcZNr7Co76RP38oXNDHNZxXsu4Gor+wevxsiiDbQIk9XCsfKK4emCuok9T9L2xn+kwrswhRBe0aZiIWtgDF44YcUp ouCpxG9iLsqeCxxtf+9FF9z1Ak0RnZVj6RT3l+X2yTTIIDCQXCaxXu1+Sc9FNUqRb8yKGj+OoS1prUhmQAjc7LECOdpCor5ia26m2UTkCvNZkqt8zLMHtIzC NeBp5NCJODWdvdDiZI3V755DMJFshJnAM3f2sdg26TJJdGDEYnqUj+f1U1bcPlELU8eQQZGfYp/QNxuS9xa0+FqlDXea8vcEGVJJrWWmBKH/+1o1RiYUspZS 6J4rPSv01mHDjwqjALyiMl3XJ57G7A== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --0F1p//8PRICkK4MW Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 14, 2016 at 11:20:16AM -0700, Andrey Vagin wrote: > +struct ns_common *ns_get_owner(struct ns_common *ns) > +{ > + const struct cred *cred =3D current_cred(); > + struct user_namespace *user_ns, *p; > + > + user_ns =3D p =3D ns->user_ns; > + if (user_ns =3D=3D NULL) { /* ns is init_user_ns */ > + /* Unprivileged user should not know that it's init_user_ns. */ > + if (capable(CAP_SYS_ADMIN)) > + return ERR_PTR(-ENOENT); > + return ERR_PTR(-EPERM); > + } > + > + for (;;) { > + if (p =3D=3D cred->user_ns) > + break; > + if (p =3D=3D &init_user_ns) > + return ERR_PTR(-EPERM); > + p =3D p->parent; > + } > + > + return &get_user_ns(user_ns)->ns; > +} I'm still not sure we need the CAP_SYS_ADMIN check [1]. Maybe =E2=80=9Cyou have an open file descriptor for the namespace=E2=80=9D means you've already been authorized to access the parent information (e.g. via POSIX permissions on /proc//ns/=E2=80=A6 or the bind-mounted namespace). Whether you can get the parent information probably depends whether you can use setns to join the parent namespace (I haven't looked up the backing code for that). But whichever way we go there, I think we do want to be consistent between init_user_ns and other namespaces. So we should have a CAP_SYS_ADMIN check for init_user_ns if and only if we also have a CAP_SYS_ADMIN check for the returned parent in the non-init_user_ns case as well: user_ns =3D p =3D ns->user_ns; if (user_ns =3D=3D NULL) { /* ns is init_user_ns */ /* Unprivileged user should not know that it's init_user_ns. */ if (capable(CAP_SYS_ADMIN)) return ERR_PTR(-ENOENT); return ERR_PTR(-EPERM); } else if (! capable_in(user_ns, CAP_SYS_ADMIN)) { /* Unprivileged user should not know about the owning user ns. */ return ERR_PTR(-ENOENT); } Although I'm not sure what the real name for capable_in is, or even if it exists. Cheers, Trevor [1]: https://github.com/avagin/linux-task-diag/commit/2663bc803d324785e3282= 61f3c07a0fef37d2088#commitcomment-18223327 --=20 This email may be signed or encrypted with GnuPG (http://www.gnupg.org). For more information, see http://en.wikipedia.org/wiki/Pretty_Good_Privacy --0F1p//8PRICkK4MW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJXh+L9AAoJEBBpoQVgXJg1WAQP/3zGzSbt3KtNcjY0VzJjWx6B zRUoohunKTRl4SLBr5I+cJdMZn1UPqeJC9V9k1uekAJfaM4cSPSEJ1TKPcjiIyu2 iJrRRIiq6JE735pQMzCYM5iMuMT0oBcdLzxiuL8qcDPY8uxYTHTDdLxvHMfB2/IM YomjJqequ/Hr8wBXM9WCpwgrc/MnSmHpIqgVXJWPKSdD+UCXoRH6vOdruKx1msWB tJw+zjMYfFY9Uxbe6lduR/hwAPXPRvsxk3FHQlK+E2pmFegTXX9pK7fRnPnLmTdc u+GycDEZD+Gw1va28Na49VKxLBTXQVbKzQSBPL3Gf/nVzXZD7YuubiIUp5mreQIM 6fz+LOql3Mt6Hez/ZfSrPys4FLobuE71KFHyB+hDbwlMHxA6bxv9R9mbyUXWBkHA r2nUczB1pHg7/v1S77ZrQjiViSgfYkEc4WsFcGa5d84aW4R7WGQKfifu6DwE+MNz SuPgtFRlxsMjDkHspNTVT8sNXr+5J1MTJEd8L95nvRH/R5ZUVjLbzoarCS62GqG8 qf45B8Z/56DNRDOBuEhdXRLZqbXc4hKRwlYv30Pk+1cYY5O9bRmYsakvdJXTueIY fxQ5gAfmcV3StwKDOq5NAX2SMJdgDmnX8eRF+rUm0ERafZPlQ5+TQ7w60pU9U5Mn rppYaIy0ePnMwEaPvJ4T =3AMb -----END PGP SIGNATURE----- --0F1p//8PRICkK4MW--