Eric W. Biederman 6708075f10
userns: Don't let unprivileged users trick privileged users into setting the id_map ...
When we require privilege for setting /proc/<pid>/uid_map or
/proc/<pid>/gid_map no longer allow an unprivileged user to
open the file and pass it to a privileged program to write
to the file.
Instead when privilege is required require both the opener and the
writer to have the necessary capabilities.
I have tested this code and verified that setting /proc/<pid>/uid_map
fails when an unprivileged user opens the file and a privielged user
attempts to set the mapping, that unprivileged users can still map
their own id, and that a privileged users can still setup an arbitrary
mapping.
Reported-by: Andy Lutomirski <luto@amacapital.net >
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com >
Signed-off-by: Andy Lutomirski <luto@amacapital.net >
2013-04-14 18:11:14 -07:00
2013-03-02 08:31:39 -08:00
2013-04-12 06:33:56 +02:00
2013-01-11 11:39:33 -08:00
2013-02-26 20:16:07 -08:00
2013-02-21 12:05:51 -08:00
2013-04-14 11:12:17 -07:00
2013-03-07 17:16:11 +01:00
2013-04-14 11:10:44 -07:00
2013-02-26 20:16:07 -08:00
2013-02-19 22:01:33 -08:00
2013-01-11 14:54:55 -08:00
2013-01-11 14:54:55 -08:00
2013-01-11 14:54:56 -08:00
2012-10-12 00:32:02 -04:00
2013-01-10 14:35:23 -08:00
2013-01-11 14:54:55 -08:00
2013-04-14 10:06:31 -07:00
2012-11-19 08:13:38 -08:00
2013-02-27 19:10:24 -08:00
2013-02-23 18:50:11 -08:00
2013-02-19 18:19:48 -08:00
2013-02-19 19:04:55 -08:00
2013-02-20 09:18:31 -08:00
2012-12-18 10:55:28 -08:00
2013-01-27 19:23:31 +01:00
2013-03-31 11:38:33 -07:00
2013-03-13 15:00:20 -07:00
2012-10-26 14:27:49 -07:00
2013-02-23 18:50:11 -08:00
2013-03-12 20:42:10 -07:00
2013-02-19 19:05:45 -08:00
2013-02-05 00:48:46 +01:00
2012-12-20 17:40:19 -08:00
2013-02-27 19:10:12 -08:00
2013-01-23 09:31:01 -08:00
2013-02-27 19:10:24 -08:00
2012-12-11 18:10:49 -08:00
2012-12-12 17:38:33 -08:00
2012-10-24 12:39:09 +02:00
2013-03-31 11:38:33 -07:00
2013-02-27 20:58:09 -08:00
2012-12-14 13:06:44 +10:30
2012-12-20 17:40:21 -08:00
2012-12-05 11:27:24 +10:30
2012-10-19 17:30:40 -07:00
2013-02-26 20:16:07 -08:00
2013-02-07 20:51:08 +01:00
2013-02-26 20:16:07 -08:00
2012-12-06 17:16:23 +08:00
2013-01-21 17:17:57 +10:30
2013-03-26 03:41:23 -07:00
2013-02-27 19:10:24 -08:00
2013-02-19 19:05:45 -08:00
2013-02-27 19:10:19 -08:00
2013-03-22 16:41:20 -07:00
2013-01-24 15:37:26 +01:00
2013-02-08 17:47:13 +01:00
2013-01-28 22:06:21 -08:00
2013-01-28 22:25:21 -08:00
2013-01-28 22:06:21 -08:00
2013-01-28 22:25:21 -08:00
2013-02-04 12:18:20 -08:00
2013-01-08 14:12:19 -08:00
2012-11-16 10:05:57 -08:00
2013-01-28 22:25:21 -08:00
2013-01-28 22:25:21 -08:00
2013-02-22 23:31:31 -05:00
2012-12-18 15:02:12 -08:00
2012-10-06 03:05:31 +09:00
2013-02-07 20:51:08 +01:00
2013-02-07 20:51:08 +01:00
2013-02-07 20:51:08 +01:00
2013-01-11 14:54:55 -08:00
2013-03-13 15:21:45 -07:00
2013-02-21 17:22:20 -08:00
2013-03-08 15:05:34 -08:00
2013-03-05 18:10:04 -08:00
2013-02-07 15:19:36 -08:00
2013-02-26 22:25:17 +01:00
2012-12-14 13:05:22 +10:30
2013-04-08 22:10:40 +02:00
2013-02-27 19:10:21 -08:00
2013-03-02 07:58:56 -08:00
2012-10-06 03:05:31 +09:00
2013-02-21 17:22:19 -08:00
2013-02-16 23:17:25 +01:00
2013-02-19 18:19:48 -08:00
2013-02-27 19:10:24 -08:00
2013-01-27 19:23:31 +01:00
2013-04-14 18:11:14 -07:00
2013-02-27 19:10:24 -08:00
2013-03-27 07:50:08 -07:00
2013-02-27 19:10:22 -08:00
2013-02-27 19:10:22 -08:00
2012-12-06 10:39:54 +01:00
2013-02-22 19:25:09 -08:00
2013-02-13 19:29:12 -08:00
2013-03-18 18:47:07 -07:00
6708075f10