Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Oleg Nesterov
On 11/02, Jann Horn wrote: > > On Wed, Nov 02, 2016 at 07:16:41PM +0100, Oleg Nesterov wrote: > > On 10/31, Jann Horn wrote: > > > > > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > > > task_struct *t) > > > { > > > - if (current_user_ns() == task_cred_xxx(t,

Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Oleg Nesterov
On 11/02, Jann Horn wrote: > > On Wed, Nov 02, 2016 at 07:16:41PM +0100, Oleg Nesterov wrote: > > On 10/31, Jann Horn wrote: > > > > > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > > > task_struct *t) > > > { > > > - if (current_user_ns() == task_cred_xxx(t,

Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Jann Horn
On Wed, Nov 02, 2016 at 07:16:41PM +0100, Oleg Nesterov wrote: > On 10/31, Jann Horn wrote: > > > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > > task_struct *t) > > { > > - if (current_user_ns() == task_cred_xxx(t, user_ns)) > > + if (_user_ns ==

Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Jann Horn
On Wed, Nov 02, 2016 at 07:16:41PM +0100, Oleg Nesterov wrote: > On 10/31, Jann Horn wrote: > > > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > > task_struct *t) > > { > > - if (current_user_ns() == task_cred_xxx(t, user_ns)) > > + if (_user_ns ==

Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Oleg Nesterov
On 10/31, Jann Horn wrote: > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > task_struct *t) > { > - if (current_user_ns() == task_cred_xxx(t, user_ns)) > + if (_user_ns == task_cred_xxx(t, user_ns)) > return; > > if

Re: [PATCH] signal: fix overflow_uid signal sender

2016-11-02 Thread Oleg Nesterov
On 10/31, Jann Horn wrote: > > static inline void userns_fixup_signal_uid(struct siginfo *info, struct > task_struct *t) > { > - if (current_user_ns() == task_cred_xxx(t, user_ns)) > + if (_user_ns == task_cred_xxx(t, user_ns)) > return; > > if

[PATCH] signal: fix overflow_uid signal sender

2016-10-31 Thread Jann Horn
This fixes the case where a signal that was sent by a user-namespaced process appears to come from a different uid. This happens if the following conditions are met: - sender is in a user namespace - sender's uid isn't mapped into sender's user namespace - target is in the init user namespace

[PATCH] signal: fix overflow_uid signal sender

2016-10-31 Thread Jann Horn
This fixes the case where a signal that was sent by a user-namespaced process appears to come from a different uid. This happens if the following conditions are met: - sender is in a user namespace - sender's uid isn't mapped into sender's user namespace - target is in the init user namespace