This is a note to let you know that I've just added the patch titled
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fs-require-cap_sys_admin-in-target-namespace-for-idm.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit ded2989c0c35503df1b976c03ecc2ff7e9ec2eae
Author: Seth Forshee <sforshee@xxxxxxxxxxxxxxxx>
Date: Tue Aug 16 11:47:52 2022 -0500
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
[ Upstream commit bf1ac16edf6770a92bc75cf2373f1f9feea398a4 ]
Idmapped mounts should not allow a user to map file ownsership into a
range of ids which is not under the control of that user. However, we
currently don't check whether the mounter is privileged wrt to the
target user namespace.
Currently no FS_USERNS_MOUNT filesystems support idmapped mounts, thus
this is not a problem as only CAP_SYS_ADMIN in init_user_ns is allowed
to set up idmapped mounts. But this could change in the future, so add a
check to refuse to create idmapped mounts when the mounter does not have
CAP_SYS_ADMIN in the target user namespace.
Fixes: bd303368b776 ("fs: support mapped mounts of mapped filesystems")
Signed-off-by: Seth Forshee <sforshee@xxxxxxxxxxxxxxxx>
Reviewed-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20220816164752.2595240-1-sforshee@xxxxxxxxxxxxxxxx
Signed-off-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/fs/namespace.c b/fs/namespace.c
index dc31ad6b370f3..d946298691ed4 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4168,6 +4168,13 @@ static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
err = -EPERM;
goto out_fput;
}
+
+ /* We're not controlling the target namespace. */
+ if (!ns_capable(mnt_userns, CAP_SYS_ADMIN)) {
+ err = -EPERM;
+ goto out_fput;
+ }
+
kattr->mnt_userns = get_user_ns(mnt_userns);
out_fput:
