This is a note to let you know that I've just added the patch titled
scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.
to the 3.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scm-require-cap_sys_admin-over-the-current-pidns-to-spoof-pids.patch
and it can be found in the queue-3.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 92f28d973cce45ef5823209aab3138eb45d8b349 Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Date: Fri, 15 Mar 2013 01:03:33 -0700
Subject: scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.
From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
commit 92f28d973cce45ef5823209aab3138eb45d8b349 upstream.
Don't allow spoofing pids over unix domain sockets in the corner
cases where a user has created a user namespace but has not yet
created a pid namespace.
Reported-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/scm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -24,6 +24,7 @@
#include <linux/interrupt.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/pid_namespace.h>
#include <linux/pid.h>
#include <linux/nsproxy.h>
#include <linux/slab.h>
@@ -52,7 +53,8 @@ static __inline__ int scm_check_creds(st
if (!uid_valid(uid) || !gid_valid(gid))
return -EINVAL;
- if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) &&
+ if ((creds->pid == task_tgid_vnr(current) ||
+ ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
Patches currently in stable-queue which might be from ebiederm@xxxxxxxxxxxx are
queue-3.8/vfs-carefully-propogate-mounts-across-user-namespaces.patch
queue-3.8/vfs-add-a-mount-flag-to-lock-read-only-bind-mounts.patch
queue-3.8/userns-don-t-allow-creation-if-the-user-is-chrooted.patch
queue-3.8/pid-handle-the-exit-of-a-multi-threaded-init.patch
queue-3.8/ipc-restrict-mounting-the-mqueue-filesystem.patch
queue-3.8/scm-require-cap_sys_admin-over-the-current-pidns-to-spoof-pids.patch
queue-3.8/userns-restrict-when-proc-and-sysfs-can-be-mounted.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html