Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1232772

Re: [PATCH v4 4/7] fs: Limit file caps to the user namespace of the super block

Show all headers | View raw

On Thu, Sep 24, 2015 at 04:59:35PM -0500, Eric W. Biederman wrote:
> Seth Forshee <seth.forshee@canonical.com> writes:
> 
> > Capability sets attached to files must be ignored except in the
> > user namespaces where the mounter is privileged, i.e. s_user_ns
> > and its descendants. Otherwise a vector exists for gaining
> > privileges in namespaces where a user is not already privileged.
> >
> > Add a new helper function, in_user_ns(), to test whether a user
> > namespace is the same as or a descendant of another namespace.
> > Use this helper to determine whether a file's capability set
> > should be applied to the caps constructed during exec.
> 
> No issues with this but given that we always pass current_user_ns()
> we may want to simplify the users of in_user_ns by renaming it
> current_in_user_ns() and hard codeing current_user_ns().

Sure, if that's what you prefer then I'll change it.

Seth
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v4 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
  [PATCH v4 4/7] fs: Limit file caps to the user namespace of the super block Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
    Re: [PATCH v4 4/7] fs: Limit file caps to the user namespace of the super block ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 00:10 +0200
      Re: [PATCH v4 4/7] fs: Limit file caps to the user namespace of the  super block Seth Forshee <seth.forshee@canonical.com> - 2015-09-25 14:50 +0200
        Re: [PATCH v4 4/7] fs: Limit file caps to the user namespace of the super block ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 20:10 +0200
  [PATCH v4 5/7] fs: Treat foreign mounts as nosuid Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
  [PATCH v4 3/7] fs: Verify access of user towards block device file when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
    Re: [PATCH v4 3/7] fs: Verify access of user towards block device file when mounting ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 00:10 +0200
      Re: [PATCH v4 3/7] fs: Verify access of user towards block device  file when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-09-25 14:50 +0200
        Re: [PATCH v4 3/7] fs: Verify access of user towards block device file when mounting ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 19:30 +0200
          Re: [PATCH v4 3/7] fs: Verify access of user towards block device  file when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-09-25 19:40 +0200
            Re: [PATCH v4 3/7] fs: Verify access of user towards block device file when mounting ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 20:00 +0200
  [PATCH v4 7/7] selinux: Add support for unprivileged mounts from user namespaces Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
  [PATCH v4 1/7] fs: Add user namesapace member to struct super_block Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
    Re: [PATCH v4 1/7] fs: Add user namesapace member to struct super_block ebiederm@xmission.com (Eric W. Biederman) - 2015-09-24 23:30 +0200
      Re: [PATCH v4 1/7] fs: Add user namesapace member to struct  super_block Seth Forshee <seth.forshee@canonical.com> - 2015-09-25 15:00 +0200
        Re: [PATCH v4 1/7] fs: Add user namesapace member to struct super_block ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 19:40 +0200
  [PATCH v4 6/7] Smack: Add support for unprivileged mounts from user namespaces Seth Forshee <seth.forshee@canonical.com> - 2015-09-23 22:20 +0200
    Re: [PATCH v4 6/7] Smack: Add support for unprivileged mounts from user namespaces ebiederm@xmission.com (Eric W. Biederman) - 2015-09-25 00:30 +0200
    Re: [PATCH v4 6/7] Smack: Add support for unprivileged mounts from  user namespaces Casey Schaufler <casey@schaufler-ca.com> - 2015-09-25 00:40 +0200
    Re: [PATCH v4 6/7] Smack: Add support for unprivileged mounts from user namespaces ebiederm@xmission.com (Eric W. Biederman) - 2015-09-27 21:40 +0200
      Re: [PATCH v4 6/7] Smack: Add support for unprivileged mounts from  user namespaces Seth Forshee <seth.forshee@canonical.com> - 2015-09-28 21:50 +0200

csiph-web