Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18815a18 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

userns: Convert capabilities related permsion checks 



- Use uid_eq when comparing kuids
  Use gid_eq when comparing kgids
- Use make_kuid(user_ns, 0) to talk about the user_namespace root uid

Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent 9c806aa0

fs/open.c

+2 −1
Original line number Diff line number Diff line
@@ -316,7 +316,8 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) 


	if (!issecure(SECURE_NO_SETUID_FIXUP)) {

		/* Clear the capabilities if we switch to a non-root user */

		if (override_cred->uid)

		kuid_t root_uid = make_kuid(override_cred->user_ns, 0);

		if (!uid_eq(override_cred->uid, root_uid))

			cap_clear(override_cred->cap_effective);

		else

			override_cred->cap_effective =

security/commoncap.c

+26 −15
Original line number Diff line number Diff line
@@ -472,19 +472,22 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
	struct cred *new = bprm->cred;

	bool effective, has_cap = false;

	int ret;

	kuid_t root_uid;



	effective = false;

	ret = get_file_caps(bprm, &effective, &has_cap);

	if (ret < 0)

		return ret;



	root_uid = make_kuid(new->user_ns, 0);



	if (!issecure(SECURE_NOROOT)) {

		/*

		 * If the legacy file capability is set, then don't set privs

		 * for a setuid root binary run by a non-root user.  Do set it

		 * for a root user just to cause least surprise to an admin.

		 */

		if (has_cap && new->uid != 0 && new->euid == 0) {

		if (has_cap && !uid_eq(new->uid, root_uid) && uid_eq(new->euid, root_uid)) {

			warn_setuid_and_fcaps_mixed(bprm->filename);

			goto skip;

		}
@@ -495,12 +498,12 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
		 *

		 * If only the real uid is 0, we do not set the effective bit.

		 */

		if (new->euid == 0 || new->uid == 0) {

		if (uid_eq(new->euid, root_uid) || uid_eq(new->uid, root_uid)) {

			/* pP' = (cap_bset & ~0) | (pI & ~0) */

			new->cap_permitted = cap_combine(old->cap_bset,

							 old->cap_inheritable);

		}

		if (new->euid == 0)

		if (uid_eq(new->euid, root_uid))

			effective = true;

	}

skip:
@@ -508,8 +511,8 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
	/* Don't let someone trace a set[ug]id/setpcap binary with the revised

	 * credentials unless they have the appropriate permit

	 */

	if ((new->euid != old->uid ||

	     new->egid != old->gid ||

	if ((!uid_eq(new->euid, old->uid) ||

	     !gid_eq(new->egid, old->gid) ||

	     !cap_issubset(new->cap_permitted, old->cap_permitted)) &&

	    bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {

		/* downgrade; they get no more than they had, and maybe less */
@@ -544,7 +547,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
	 */

	if (!cap_isclear(new->cap_effective)) {

		if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||

		    new->euid != 0 || new->uid != 0 ||

		    !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||

		    issecure(SECURE_NOROOT)) {

			ret = audit_log_bprm_fcaps(bprm, new, old);

			if (ret < 0)
@@ -569,16 +572,17 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
int cap_bprm_secureexec(struct linux_binprm *bprm)

{

	const struct cred *cred = current_cred();

	kuid_t root_uid = make_kuid(cred->user_ns, 0);



	if (cred->uid != 0) {

	if (!uid_eq(cred->uid, root_uid)) {

		if (bprm->cap_effective)

			return 1;

		if (!cap_isclear(cred->cap_permitted))

			return 1;

	}



	return (cred->euid != cred->uid ||

		cred->egid != cred->gid);

	return (!uid_eq(cred->euid, cred->uid) ||

		!gid_eq(cred->egid, cred->gid));

}



/**
@@ -668,15 +672,21 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name) 
 */

static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)

{

	if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&

	    (new->uid != 0 && new->euid != 0 && new->suid != 0) &&

	kuid_t root_uid = make_kuid(old->user_ns, 0);



	if ((uid_eq(old->uid, root_uid) ||

	     uid_eq(old->euid, root_uid) ||

	     uid_eq(old->suid, root_uid)) &&

	    (!uid_eq(new->uid, root_uid) &&

	     !uid_eq(new->euid, root_uid) &&

	     !uid_eq(new->suid, root_uid)) &&

	    !issecure(SECURE_KEEP_CAPS)) {

		cap_clear(new->cap_permitted);

		cap_clear(new->cap_effective);

	}

	if (old->euid == 0 && new->euid != 0)

	if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))

		cap_clear(new->cap_effective);

	if (old->euid != 0 && new->euid == 0)

	if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))

		new->cap_effective = new->cap_permitted;

}
@@ -709,11 +719,12 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) 
		 *          if not, we might be a bit too harsh here.

		 */

		if (!issecure(SECURE_NO_SETUID_FIXUP)) {

			if (old->fsuid == 0 && new->fsuid != 0)

			kuid_t root_uid = make_kuid(old->user_ns, 0);

			if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))

				new->cap_effective =

					cap_drop_fs_set(new->cap_effective);



			if (old->fsuid != 0 && new->fsuid == 0)

			if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))

				new->cap_effective =

					cap_raise_fs_set(new->cap_effective,

							 new->cap_permitted);