[PATCH RFC v3 09/90] user_namespace: keep legacy maps out of the window

[Josef Bacik <josef@toxicpanda.com>]

It is safe to hand a block of ids to an unprivileged user only because
nobody else can hold an id of that block.

Refuse to map an ordinary user namespace into the window, no matter who
writes the map.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 kernel/user_namespace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 4155e2e77497..5c2cf3dc02c1 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -1230,6 +1230,11 @@ static ssize_t map_write(struct file *file, const char __user *buf,
 		if (lower_first == (u32) -1)
 			goto out;
 
+		/* Those ids are the kernel's to hand out, to cells. */
+		if (cap_valid(cap_setid) &&
+		    cell_range_in_window(lower_first, e->count))
+			goto out;
+
 		e->lower_first = lower_first;
 	}
 

-- 
2.55.0