This is a note to let you know that I've just added the patch titled
ipc: Restrict mounting the mqueue filesystem
to the 3.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipc-restrict-mounting-the-mqueue-filesystem.patch
and it can be found in the queue-3.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From a636b702ed1805e988ad3d8ff8b52c060f8b341c Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Date: Thu, 21 Mar 2013 18:13:15 -0700
Subject: ipc: Restrict mounting the mqueue filesystem
From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
commit a636b702ed1805e988ad3d8ff8b52c060f8b341c upstream.
Only allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN
rights over the ipc namespace. The principle here is if you create
or have capabilities over it you can mount it, otherwise you get to live
with what other people have mounted.
This information is not particularly sensitive and mqueue essentially
only reports which posix messages queues exist. Still when creating a
restricted environment for an application to live any extra
information may be of use to someone with sufficient creativity. The
historical if imperfect way this information has been restricted has
been not to allow mounts and restricting this to ipc namespace
creators maintains the spirit of the historical restriction.
Acked-by: Serge Hallyn <serge.hallyn@xxxxxxxxxxxxx>
Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
ipc/mqueue.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -330,8 +330,16 @@ static struct dentry *mqueue_mount(struc
int flags, const char *dev_name,
void *data)
{
- if (!(flags & MS_KERNMOUNT))
- data = current->nsproxy->ipc_ns;
+ if (!(flags & MS_KERNMOUNT)) {
+ struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+ /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+ * over the ipc namespace.
+ */
+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+
+ data = ns;
+ }
return mount_ns(fs_type, flags, data, mqueue_fill_super);
}
Patches currently in stable-queue which might be from ebiederm@xxxxxxxxxxxx are
queue-3.8/vfs-carefully-propogate-mounts-across-user-namespaces.patch
queue-3.8/vfs-add-a-mount-flag-to-lock-read-only-bind-mounts.patch
queue-3.8/userns-don-t-allow-creation-if-the-user-is-chrooted.patch
queue-3.8/pid-handle-the-exit-of-a-multi-threaded-init.patch
queue-3.8/ipc-restrict-mounting-the-mqueue-filesystem.patch
queue-3.8/scm-require-cap_sys_admin-over-the-current-pidns-to-spoof-pids.patch
queue-3.8/userns-restrict-when-proc-and-sysfs-can-be-mounted.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html