[PATCH] virt: vbox: Do not report user namespace root as root to the host

[PATCH] virt: vbox: Do not report user namespace root as root to the host

[Hungyu Lin]

vbg_misc_device_requestor() decides whether the opener of the vboxguest
or vboxuser device is reported to the host as root:

	if (from_kuid(current_user_ns(), current_uid()) == 0)
		requestor |= VMMDEV_REQUESTOR_USR_ROOT;

from_kuid() translates the uid into the user namespace of the caller.
An unprivileged user who creates a user namespace and maps their uid to
0 in it is therefore reported as VMMDEV_REQUESTOR_USR_ROOT for every
request of that session, although the uid has no privileges outside of
that namespace. The host uses the user class to account the HGCM
requests of a session, so such a user is charged to the budget of root
instead of the one for ordinary users.

Compare the uid against GLOBAL_ROOT_UID so that only root in the initial
user namespace is reported as root.

Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/virt/vboxguest/vboxguest_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
index 7474bae2cd9a..ff66c00c27da 100644
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -35,7 +35,7 @@ static u32 vbg_misc_device_requestor(struct inode *inode)
 			VMMDEV_REQUESTOR_CON_DONT_KNOW |
 			VMMDEV_REQUESTOR_TRUST_NOT_GIVEN;

-	if (from_kuid(current_user_ns(), current_uid()) == 0)
+	if (uid_eq(current_uid(), GLOBAL_ROOT_UID))
 		requestor |= VMMDEV_REQUESTOR_USR_ROOT;
 	else
 		requestor |= VMMDEV_REQUESTOR_USR_USER;
--
2.43.0

Re: [PATCH] virt: vbox: Do not report user namespace root as root to the host

[Hans de Goede]

Hi,

On 13-Nov-26 10:07, Hungyu Lin wrote:
> vbg_misc_device_requestor() decides whether the opener of the vboxguest
> or vboxuser device is reported to the host as root:
> 
> 	if (from_kuid(current_user_ns(), current_uid()) == 0)
> 		requestor |= VMMDEV_REQUESTOR_USR_ROOT;
> 
> from_kuid() translates the uid into the user namespace of the caller.
> An unprivileged user who creates a user namespace and maps their uid to
> 0 in it is therefore reported as VMMDEV_REQUESTOR_USR_ROOT for every
> request of that session, although the uid has no privileges outside of
> that namespace. The host uses the user class to account the HGCM
> requests of a session, so such a user is charged to the budget of root
> instead of the one for ordinary users.
> 
> Compare the uid against GLOBAL_ROOT_UID so that only root in the initial
> user namespace is reported as root.
> 
> Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Thanks, patch looks good to me:

Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>

Regards,

Hans



> ---
>  drivers/virt/vboxguest/vboxguest_linux.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
> index 7474bae2cd9a..ff66c00c27da 100644
> --- a/drivers/virt/vboxguest/vboxguest_linux.c
> +++ b/drivers/virt/vboxguest/vboxguest_linux.c
> @@ -35,7 +35,7 @@ static u32 vbg_misc_device_requestor(struct inode *inode)
>  			VMMDEV_REQUESTOR_CON_DONT_KNOW |
>  			VMMDEV_REQUESTOR_TRUST_NOT_GIVEN;
> 
> -	if (from_kuid(current_user_ns(), current_uid()) == 0)
> +	if (uid_eq(current_uid(), GLOBAL_ROOT_UID))
>  		requestor |= VMMDEV_REQUESTOR_USR_ROOT;
>  	else
>  		requestor |= VMMDEV_REQUESTOR_USR_USER;
> --
> 2.43.0