From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751683AbdEBKEq (ORCPT ); Tue, 2 May 2017 06:04:46 -0400 Received: from mail-he1eur01on0118.outbound.protection.outlook.com ([104.47.0.118]:35872 "EHLO EUR01-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750983AbdEBKEn (ORCPT ); Tue, 2 May 2017 06:04:43 -0400 Authentication-Results: chromium.org; dkim=none (message not signed) header.d=none;chromium.org; dmarc=none action=none header.from=virtuozzo.com; Subject: Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces To: "Eric W. Biederman" , Linux Containers References: <149329634856.21195.14196911999722279118.stgit@localhost.localdomain> <87mvb16fv7.fsf@xmission.com> <12a73543-79ea-4bac-7e96-6ab237534af2@virtuozzo.com> <877f254yx0.fsf@xmission.com> <8737crt4dz.fsf@xmission.com> <87vapnrp7f.fsf_-_@xmission.com> CC: , , , , , , , , , , , , , , , From: Kirill Tkhai Message-ID: Date: Tue, 2 May 2017 13:04:37 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1PR08CA0033.eurprd08.prod.outlook.com (10.164.95.43) To DB6PR0802MB2279.eurprd08.prod.outlook.com (10.172.228.7) X-MS-Office365-Filtering-Correlation-Id: 4a507963-18ca-4be7-c272-08d49142a4f8 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:DB6PR0802MB2279; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2279;3:ZzMIvVjmHvLPxOe3E6dMQ4Lxruub9lq1wfFpwD3Lj9we4kv7LaO3Vv9HHFXy8xYDTQAUVbJp++BODe3DusccoaOYPCNsrBEJiD/jwbWqAX3vEAVwxtkhHhETlB9w/sMYCSZcZXyWluaPf6BlqjNKdMrTw8G+NOww8eugz6QP5oYFa3yZzhmWlfgwsNMsgAn7xTXFpX4k7Ae8i2I0JwQYAJbc/z+77bJ780rcA0l15EVNq86hEjtCVmA72toH0ecfG21hniJ+IYKBBRMzy/j1wFQFiZllAB+Aph64Woc/y6BLHbb0Z8j0W61JgzbhF8SfMVLNFZSCa18SF2y7dVNFsA==;25:tjkn1C9/H83SpVQAcXxSuerGzfabyWDscqw3oQI2ahO3u9D/HOEjhhbq3HHZREJl6lopvQO3hjLLhevKhaNig1SIN8FsjTz0ApGPyXBuQI7JmQvHPTtiUm+E8+lbFflVM28jX7SnbIbKF03bzSg1M1mEyFG5lzUEp5/ywg5fSMDs+JKxljyGkmeQsJX6RURg2dU04mnTB9Pyfp79sQmF1BNqLz1cNlwTAWXFYAHGyP4fSAzaL48veMm7M1LJRgUTHgnW5/ba2myYJ/f3UjTyhO0oZlOlHfqW/vLRAEbVAKVujCjSLNM7RMyfNUFgrrvauuc6myEaRJZEI1H59Qr5L/0q4S8+s1GtuN+UuSsZdB4PQ5b3GGv+AIbWCvjmV+gD9jo5CFPX7A8DDwIOgNZdAeNhtterIl5m0G6ZRMxdGN8j/C7E3kdCbWvYqsxg09Jo7MrlsUXg6PjyQ/IFGfytwg== X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2279;31:wg9YHPmd1L14dV7C9QINynu/rerIbNbVDLiFkw6U+COFn9X5n26E0aC9cT3uKY21o2O7B3X1TSMDX6Zy0n/5PyC6vGmMDROWpqqlP0h8r4CanAcMIwjtihzzku6pEpM6PHMZYZ3GyC6mBPtkX/mAL7cP3WnRG5qAJHaP+KiQj2ijx4/W5tOjw1vKfj6guwz8RqcUHWNwUfCiXaq0HzlsRbEz6MHgCrbdSoq4z234crJ4/rILdSEO4sbM1jhM7I2p;20:J2rqq+SuhDitWfU4oxgFioHE8Fk6QwGgyq5HyKYcblrNF8qHMTYPQKWIY2EPpUaOHCsUvlIjwKfS7CzOD8jJCFppbyZv8enLHmLdj2SsAidDCiz8sXvCyTVAIFPryIGhQtTCk7X0KgV/9NvDv6tpydLtRWgFA27BOaRPzNURXwxKKCRGDVBtB1VxKn7KPS/InTz2U7oxoYqV9dyeNFCh/rn7DQXP59S820oDexHqjENTEPiPCZCrhSF4APFdqLkvRUEP4dSiIx1RJVJpJR+WBD0BMt+kHM9hJv2nW2kIO4RjNZ+5d36lF/gYxb/JYpExdDuufl3hUUvQfkGAgB1cjI3Orah168xyRSQRYBoJ28aYbuRd3YavucmvOkQTDYTNrz/HqXWKOWIwOlneqRkKI4g9YexNSOro0NLRhFZRmZQ= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6041248)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(6072148);SRVR:DB6PR0802MB2279;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0802MB2279; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2279;4:Qul99Pz9kiX/3IdOl3z1nzLe35FKcpl9vHbPMQNoYaQpmmJ8XPlvLMzVak12aNYbNWbzWxZXSbTJT/zSCacxEtYv5RajKRf3ETbSAZ9CqoOgEea7xeEtHZ5LZmdK8ASgpiDkPzdokG3AR2gzjbd6+a7bHDZxijs8uejty8k5wRzhe/nDlBuI6iUbovEeD0vOqUGlHAin4gcjIhGjuuRg2QMFL0AegfNqZl+U0FYdWai2H78eN++KYLpTc0uXfhkDQDPHHI+MLKZqzUfsapBxJ1lPA4ow30Yct2FZAZa0JnqskwaDMMfJaiFXXj1UivdATLuuZhM0Wh7K1oI6VqVOSFUGBOqtgEx8ZLUrHGxDRcyDsoqkCkFTQsQi8HTQ2Ac3Hus4aFTYVcVb71+vycRSEZTvvkhXAj3DYJs7ETQkldRatN/AfPBXY53ftVH/7vYhSERZMEVEUWKqNTCFw4B6qM0yqpeV2wutMRbOi4kYsWtVI2NpxUPERTbbdebA5FAMc/FUT3xfTV7zh75aRS80ir/3VOgI7vBQ8fycxTxhahb00/CHNcFg3jegiQd1jItYPRcYWH/NkSY203JYjA4KP4Ra5+3HMNp8UHkSgHrMZUQeX7IChv1Iq8v0DNkzvjUIIgCdX+huMdy7KMxhRhR6ky0lX28FhO+oFpHr69TSNw1HmXSXsZNmz864DKQUz549orXhGIbFmt8jShXmVqa0K3Ebln166BsbJqwGKaPS2fcI4A2yeZmATp7axdlBSGbk5rdo1ycoIULB/ldQizK9G7ssnlyL9qHK/sVyXnrtj74= X-Forefront-PRVS: 02951C14DC X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(39830400002)(39400400002)(39410400002)(39450400003)(24454002)(77096006)(8676002)(76176999)(25786009)(6486002)(53546009)(36756003)(54356999)(229853002)(31696002)(4326008)(50986999)(93886004)(305945005)(6246003)(7736002)(33646002)(478600001)(38730400002)(50466002)(2906002)(23676002)(86362001)(4001350100001)(65826007)(31686004)(575784001)(47776003)(81166006)(66066001)(230700001)(2950100002)(3846002)(189998001)(83506001)(6116002)(53936002)(5660300001)(42186005)(142933001);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0802MB2279;H:[172.16.25.137];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtEQjZQUjA4MDJNQjIyNzk7MjM6R1dTVmo3YmpYN0xEYlVlcE5BdmJoNEln?= =?utf-8?B?YVJZNTdacGtTSWpxZi93SkNUeUMzSHVrSGdYUDdUY2FVR3NYTFZuRzJoTGFp?= =?utf-8?B?RWpoYWtPOTI4VVcwYy9pMlRTLzl1TFYyMm5zbFZWaU9Xa2t6UWIyRVpQMjVB?= =?utf-8?B?VUFCVEVBcmV5TFkvdXVnVnhOU1ZoYmcwSGJOVlhZY0JSSDNsRnJ4Tjd6QlFz?= =?utf-8?B?TG1zWkozVy9hMVFkZ2M5RTY5UVdPWUJYMG0xMDVjRDgwUkx5aDMvdTZaeVBF?= =?utf-8?B?Qm5JUFpXbCtiK092czlnSHNPb0JIaE93dlFYVm55eWF2ZDJTbnlwaEk1cUo5?= =?utf-8?B?azFqaFBFU1Q1ZVNwcXBZeVVJWENLL25TMVNqbmdFRWo3aGpUR0hMMHUxaWpL?= =?utf-8?B?YVRsci8rZ1c2UWtNV0ViZ2ZvOXRYcFpYelNsQVpYWC9GY0I3YjRYaEpUWFpl?= =?utf-8?B?ejhSYzBHZUFZT2dYNGcvcCtROEhNOHY3WVNhY1J4VUpiYml2N1VaYlhNeDgw?= =?utf-8?B?cE1ySXFROG1IQ3BMSFVXV3J3Zi9vTTJYSzZJU1BCbFRvZjUwVlVwSEpENGlq?= =?utf-8?B?SE5zem02Vll0TEtFTlJjTi9SdXRRZ1VnY29xVklFNEI4VitMOXhrbnpBanpa?= =?utf-8?B?ZXlRNGdUZWd4VkFtOHZZQXlaRnlSbEc5MEsvTWl5Zm5WZFk1emtZMFVoTjBV?= =?utf-8?B?V1FtaFdPUDFqYksydEdxYzgxVGZqQmFhbWk2RzZ4ejhMRnpnS1REYm5xYnpS?= =?utf-8?B?K21tQ1VCZkRUYVk0R3RGaHgxUnN5NmYzakxCb2c2VXZEYjlPRXlUbHZuSms5?= =?utf-8?B?V1IwenowUlFUN2hFdXRHRTRjdHpSVUVyblpmenpDOWlPT2Z0S2dhMnlpck90?= =?utf-8?B?cE90TGlFQys3YlluZHRFWHpQNHhETWpiZmE5U2dhQ0RiQzFWRXByREtVT04y?= =?utf-8?B?amwrRDRQYm5uTXpYczBINmR1VG01bDFpQmU1OGhqeXV6alZidXkwSXBaYTU1?= =?utf-8?B?MEpYZ2huVkMxd0xCZHZFUFQ4aENxdE15dllpVUJtUU0yMms5MStMM1FyQXdi?= =?utf-8?B?cHNKRGZ0RGJHNlFoeFZ4ajMwNzM0YU4rOXg1WjdadGxUUG41OFFFOHJYM0x6?= =?utf-8?B?UnJyL29BZWJIVXlsT0h4T0YwNUYrS0ZkaDlZMFJLZzZLRFpodnAyN3Nyc3Fi?= =?utf-8?B?YnBMaVdyeHJ5RkgxcmV4K05uTkpzcGVFR2U1cjkraW5ORjNhV1EzTnNoYnR5?= =?utf-8?B?QlpBTHhYWndkSEs2TmpHQm5rWVRHWW02Y0VQa2JueDBCY0wydnlzcW90dTk4?= =?utf-8?B?TWo4d1Zkei90aUZkcmFIc3FnTm9WSXFrVGl3ZjBiVloxaHFJNVU0UlFONFdx?= =?utf-8?B?QU9JNEN0Mml5bTVGVWVYREdZdjc4cnBNZkM0VVNuOGg1dFpaMzNPTE53NDlW?= =?utf-8?B?OVlxT3FrOXhFS3hYS1hrVTJ4cDJpNm9pY2VqQUFqNVhYWlEwQS9iTHIzNno3?= =?utf-8?B?ZXFqU3BWTXVnSk4vWm0xNlUvZ05GS1p4Rkt2Q2pjKzBtSHB0WlVqTkRnTkI3?= =?utf-8?B?NlE5UHY2SThoYVJkdDg4Q2xVVUdvdS94cnVpNTkxYld5czdSaklYaERFbFR2?= =?utf-8?Q?SYBvHq/UBn23OrlqTtd4wr?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2279;6:WZC5XvY/L7tgCrO9v3XgPnT7RB8KP/a2fnfAd4NOWCsjOd2GvN3KJkJ2v4cjMzsBcC4DNpntOhDKwFyP37OCYa6hj8S1QAbgjItYnFEpHS75ztE4c+GYigoZLV/7PhyVmlYLY3kjyGIojlOn8Hw8/Y7joxkhuPceCYHVKDmKFr/FGqcTbj73UePNiHwL8DrZHvVrH66/hYh1HEFuTWiP7gMxVo2blBgv8xN7LRHzxspW6Uoqneaj0a4FNDy0KeF+4NkcoxjOoHuYRzCNm4UfA1Yb1Gc9ygajtwVtkmS9k2BAetC2Oh0REnpjs8x2Jig4B9Ko6/6KW3RAbDR9yOeukpmfHAijvNsQgDTuzyJPiFxOgdogOECFBC6wpSE7vKcory0GSV4u4OM+jcLyKTRwH6P+ptvM+bt+1s3VhWmcUpP8gdxLUSdSkVJeAey7+SG7toRHOxUCJlTWdT5NZZsptHnTk2Lo4xegLnr8c7gVn6qGTNhnWw8SNgYTCarPNy2UfwaqcJ46opWKNI5XniLRhw==;5:yNNUXIM8L3cHKwf3546dWG28POXTj58cxyhmHhtsSrpXvaa06BkzhndC1QXlEQzB/Xf3sDHtGLAn/VZ5Vtht3uf+rpM75Z9HAy3sLCuemR997MjtsD4XV4qeet5Klt2afskl1W6jewhoDuC6R7+yj1fnIJKVZL5X/5HzKDLj9bo=;24:qWNlvOj/pmizOeFlSmBfSua+88AOh3/hMN7f2QuZNNv7KKCbeoXs9ZoF5gwWppy3bZs+Z8KSIIMRj+bcYiTw+rggMW2ZWROIXfR1ZlxhNRc= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2279;7:xroIOSRoO+lzIg35/a9feKqfhR2rkX/eTHJAm4SutiFwGM8Svpy0KYo0B6OGeEZsqZaz9p0teoZQT5QNg9yKyIt+Eb2qSYTfn7eFRC427jgI38DY0gCgv7m5fAMNaBkyC+sN3Ln6mO39hrfuK+5PDZwbLgy3mR3KtS2OTWmk7/LBFUX7LciX0HJZLFrHUdu68CgZ6lN1L1PX70hU8Gf/iAIoVMk8svpHbkfQTd7iNslpdlRz5fa1nL65sKgDQ+FW4A777GyXObN0pNENI25qri3bRt41ut6utXCzep5R5z+rgHAF8fY3s+wiYnChXS67grYfBv7hcrSV7xel7WgBdA==;20:lL5Igx83yjRHUQ+GkTEEU3is9hAdB7A+LRtpggYYmuGrZ7vW07sDL09ZBVo+ZBqp9QBD+0ZcL268NNOzU0VL5+Lb9NzXfe2awGOH8foLIZCM7lNrIP65HgZl3YipzE5/Osy1qcKqZ/Bwm2GSe5XrDQFwAfBsNdsbQ5UEbuMHLNo= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2017 10:04:36.8882 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0802MB2279 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02.05.2017 13:03, Kirill Tkhai wrote: > > > On 29.04.2017 22:25, Eric W. Biederman wrote: >> >> It is pointless and confusing to allow a pid namespace hierarchy and >> the user namespace hierarchy to get out of sync. The owner of a child >> pid namespace should be the owner of the parent pid namespace or >> a descendant of the owner of the parent pid namespace. >> >> Otherwise it is possible to construct scenarios where it is legal to >> do something in a parent pid namespace but in a child pid namespace. >> >> It requires use of setns into a pid namespace (but not into a user >> namespace) to create such a scenario. >> >> Add the function in_userns to help in making this determination. >> >> Signed-off-by: "Eric W. Biederman" >> --- >> >> While review a patch from Kiril Tkhai I realized we were missing this >> sanity check.... >> >> include/linux/user_namespace.h | 8 +++++++- >> kernel/pid_namespace.c | 4 ++++ >> kernel/user_namespace.c | 18 ++++++++++++------ >> 3 files changed, 23 insertions(+), 7 deletions(-) >> >> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h >> index 32354b4b4b2b..497ed50004db 100644 >> --- a/include/linux/user_namespace.h >> +++ b/include/linux/user_namespace.h >> @@ -112,8 +112,9 @@ extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, >> extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *); >> extern int proc_setgroups_show(struct seq_file *m, void *v); >> extern bool userns_may_setgroups(const struct user_namespace *ns); >> +extern bool in_userns(const struct user_namespace *ancestor, >> + const struct user_namespace *child); >> extern bool current_in_userns(const struct user_namespace *target_ns); >> - >> struct ns_common *ns_get_owner(struct ns_common *ns); >> #else >> >> @@ -144,6 +145,11 @@ static inline bool userns_may_setgroups(const struct user_namespace *ns) >> return true; >> } >> >> +static inline bool in_userns(const struct user_namespace *target_ns) >> +{ >> + return true; >> +} >> + >> static inline bool current_in_userns(const struct user_namespace *target_ns) >> { >> return true; >> diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c >> index de461aa0bf9a..749147f5a613 100644 >> --- a/kernel/pid_namespace.c >> +++ b/kernel/pid_namespace.c >> @@ -101,6 +101,10 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns >> int i; >> int err; >> >> + err = -EINVAL; >> + if (!in_userns(parent_pid_ns->user_ns, user_ns)) >> + goto out; >> + >> err = -ENOSPC; >> if (level > MAX_PID_NS_LEVEL) >> goto out; >> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c >> index 2f735cbe05e8..7d8658fbabc8 100644 >> --- a/kernel/user_namespace.c >> +++ b/kernel/user_namespace.c >> @@ -986,19 +986,25 @@ bool userns_may_setgroups(const struct user_namespace *ns) >> } >> >> /* >> - * Returns true if @ns is the same namespace as or a descendant of >> - * @target_ns. >> + * Returns true if @child is the same namespace or a descendant of >> + * @ancestor. >> */ >> -bool current_in_userns(const struct user_namespace *target_ns) >> +bool in_userns(const struct user_namespace *ancestor, >> + const struct user_namespace *child) >> { >> - struct user_namespace *ns; >> - for (ns = current_user_ns(); ns; ns = ns->parent) { >> - if (ns == target_ns) >> + const struct user_namespace *ns; >> + for (ns = child; ns; ns = ns->parent) { >> + if (ns == ancestor) >> return true; >> } >> return false; >> } > > We have user_namespace::level, so it's possible to stop iterations earlier > and save some cpu cycles: > > for (ns = child; ns->level >= ancestor->level; ns = ns->parent) Just ">" here. > ; > return (ns == ancestor); > >> >> +bool current_in_userns(const struct user_namespace *target_ns) >> +{ >> + return in_userns(target_ns, current_user_ns()); >> +} >> + >> static inline struct user_namespace *to_user_ns(struct ns_common *ns) >> { >> return container_of(ns, struct user_namespace, ns); >>