On Fri, Dec 14, 2012 at 2:03 PM, Eric W. Biederman <[email protected]> wrote: > > Andy Lutomirski <[email protected]> found a nasty little bug in > the permissions of setns. With unprivileged user namespaces it > became possible to create new namespaces without privilege. > > However the setns calls were relaxed to only require CAP_SYS_ADMIN in > the user nameapce of the targed namespace. > > Which made the following nasty sequence possible. > > pid = clone(CLONE_NEWUSER | CLONE_NEWNS); > if (pid == 0) { /* child */ > system("mount --bind /home/me/passwd /etc/passwd"); > } > else if (pid != 0) { /* parent */ > char path[PATH_MAX]; > snprintf(path, sizeof(path), "/proc/%u/ns/mnt"); > fd = open(path, O_RDONLY); > setns(fd, 0); > system("su -"); > } > > Prevent this possibility by requiring CAP_SYS_ADMIN > in the current user namespace when joing all but the user namespace. > > Signed-off-by: "Eric W. Biederman" <[email protected]> > --- > fs/namespace.c | 3 ++- > ipc/namespace.c | 3 ++- > kernel/pid_namespace.c | 3 ++- > kernel/utsname.c | 3 ++- > net/core/net_namespace.c | 3 ++- > 5 files changed, 10 insertions(+), 5 deletions(-)
Acked-by: Andy Lutomirski <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
