From: Todd Poynor <toddpoynor@gmail.com>
To: Rob Springer <rspringer@google.com>,
John Joseph <jnjoseph@google.com>,
Ben Chan <benchan@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org,
Dmitry Torokhov <dtor@chromium.org>,
Todd Poynor <toddpoynor@google.com>
Subject: [PATCH 04/13] staging: gasket: core: allow root access based on user namespace
Date: Sun, 29 Jul 2018 12:36:37 -0700 [thread overview]
Message-ID: <20180729193646.201721-5-toddpoynor@gmail.com> (raw)
In-Reply-To: <20180729193646.201721-1-toddpoynor@gmail.com>
From: Todd Poynor <toddpoynor@google.com>
Use user namespace to determine whether gasket device file opener is
root, allowing root access to containers, if necessary.
Reported-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Todd Poynor <toddpoynor@google.com>
---
drivers/staging/gasket/gasket_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/gasket/gasket_core.c b/drivers/staging/gasket/gasket_core.c
index b832a4f529f27..291cd6d074a2e 100644
--- a/drivers/staging/gasket/gasket_core.c
+++ b/drivers/staging/gasket/gasket_core.c
@@ -13,13 +13,16 @@
#include "gasket_page_table.h"
#include "gasket_sysfs.h"
+#include <linux/capability.h>
#include <linux/compiler.h>
#include <linux/delay.h>
#include <linux/device.h>
#include <linux/fs.h>
#include <linux/init.h>
#include <linux/of.h>
+#include <linux/pid_namespace.h>
#include <linux/printk.h>
+#include <linux/sched.h>
#ifdef GASKET_KERNEL_TRACE_SUPPORT
#define CREATE_TRACE_POINTS
@@ -1064,7 +1067,8 @@ static int gasket_open(struct inode *inode, struct file *filp)
char task_name[TASK_COMM_LEN];
struct gasket_cdev_info *dev_info =
container_of(inode->i_cdev, struct gasket_cdev_info, cdev);
- int is_root = capable(CAP_SYS_ADMIN);
+ struct pid_namespace *pid_ns = task_active_pid_ns(current);
+ int is_root = ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN);
gasket_dev = dev_info->gasket_dev_ptr;
driver_desc = gasket_dev->internal_desc->driver_desc;
@@ -1147,6 +1151,8 @@ static int gasket_release(struct inode *inode, struct file *file)
char task_name[TASK_COMM_LEN];
struct gasket_cdev_info *dev_info =
container_of(inode->i_cdev, struct gasket_cdev_info, cdev);
+ struct pid_namespace *pid_ns = task_active_pid_ns(current);
+ int is_root = ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN);
gasket_dev = dev_info->gasket_dev_ptr;
driver_desc = gasket_dev->internal_desc->driver_desc;
@@ -1158,7 +1164,7 @@ static int gasket_release(struct inode *inode, struct file *file)
"Releasing device node. Call origin: tgid %u (%s) "
"(f_mode: 0%03o, fmode_write: %d, is_root: %u)\n",
current->tgid, task_name, file->f_mode,
- (file->f_mode & FMODE_WRITE), capable(CAP_SYS_ADMIN));
+ (file->f_mode & FMODE_WRITE), is_root);
dev_dbg(gasket_dev->dev, "Current open count (owning tgid %u): %d\n",
ownership->owner, ownership->write_open_count);
--
2.18.0.345.g5c9ce644c3-goog
next prev parent reply other threads:[~2018-07-29 19:37 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-29 19:36 [PATCH 00/13] staging: gasket: fixes and cleanups Todd Poynor
2018-07-29 19:36 ` [PATCH 01/13] staging: gasket: core: hold reference to pci_dev while used Todd Poynor
2018-07-31 6:18 ` Dmitry Torokhov
2018-07-31 6:29 ` Todd Poynor
2018-07-29 19:36 ` [PATCH 02/13] staging: gasket: sysfs: hold reference to device while in use Todd Poynor
2018-07-29 19:36 ` [PATCH 03/13] staging: gasket: page table: hold references to device and pci_dev Todd Poynor
2018-07-29 19:36 ` Todd Poynor [this message]
2018-07-30 17:56 ` [PATCH 04/13] staging: gasket: core: allow root access based on user namespace Dmitry Torokhov
2018-07-30 18:02 ` Todd Poynor
2018-07-29 19:36 ` [PATCH 05/13] staging: gasket: apex: simplify comments for static functions Todd Poynor
2018-07-29 19:36 ` [PATCH 06/13] staging: gasket: core: " Todd Poynor
2018-07-29 19:36 ` [PATCH 07/13] staging: gasket: ioctl: " Todd Poynor
2018-07-29 19:36 ` [PATCH 08/13] staging: gasket: page table: " Todd Poynor
2018-07-29 19:36 ` [PATCH 09/13] staging: gasket: interrupt: " Todd Poynor
2018-07-29 19:36 ` [PATCH 10/13] staging: gasket: sysfs: " Todd Poynor
2018-07-29 19:36 ` [PATCH 11/13] staging: gasket: TODO: remove entry for static function kernel docs Todd Poynor
2018-07-29 19:36 ` [PATCH 12/13] staging: gasket: apex: remove static function forward declarations Todd Poynor
2018-07-29 19:36 ` [PATCH 13/13] staging: gasket: apex: fix function param line continuation style Todd Poynor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180729193646.201721-5-toddpoynor@gmail.com \
--to=toddpoynor@gmail.com \
--cc=benchan@chromium.org \
--cc=devel@driverdev.osuosl.org \
--cc=dtor@chromium.org \
--cc=gregkh@linuxfoundation.org \
--cc=jnjoseph@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rspringer@google.com \
--cc=toddpoynor@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome