This is a note to let you know that I've just added the patch titled userns: Document what the invariant required for safe unprivileged mappings. to the 3.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: userns-document-what-the-invariant-required-for-safe-unprivileged-mappings.patch and it can be found in the queue-3.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 0542f17bf2c1f2430d368f44c8fcf2f82ec9e53e Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> Date: Fri, 5 Dec 2014 17:51:47 -0600 Subject: userns: Document what the invariant required for safe unprivileged mappings. From: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> commit 0542f17bf2c1f2430d368f44c8fcf2f82ec9e53e upstream. The rule is simple. Don't allow anything that wouldn't be allowed without unprivileged mappings. It was previously overlooked that establishing gid mappings would allow dropping groups and potentially gaining permission to files and directories that had lesser permissions for a specific group than for all other users. This is the rule needed to fix CVE-2014-8989 and prevent any other security issues with new_idmap_permitted. The reason for this rule is that the unix permission model is old and there are programs out there somewhere that take advantage of every little corner of it. So allowing a uid or gid mapping to be established without privielge that would allow anything that would not be allowed without that mapping will result in expectations from some code somewhere being violated. Violated expectations about the behavior of the OS is a long way to say a security issue. Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/user_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -812,7 +812,9 @@ static bool new_idmap_permitted(const st struct user_namespace *ns, int cap_setid, struct uid_gid_map *new_map) { - /* Allow mapping to your own filesystem ids */ + /* Don't allow mappings that would allow anything that wouldn't + * be allowed without the establishment of unprivileged mappings. + */ if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) { u32 id = new_map->extent[0].lower_first; if (cap_setid == CAP_SETUID) { Patches currently in stable-queue which might be from ebiederm@xxxxxxxxxxxx are queue-3.17/mnt-update-unprivileged-remount-test.patch queue-3.17/mnt-fix-a-memory-stomp-in-umount.patch queue-3.17/userns-check-euid-no-fsuid-when-establishing-an-unprivileged-uid-mapping.patch queue-3.17/mnt-implicitly-add-mnt_nodev-on-remount-when-it-was-implicitly-added-by-mount.patch queue-3.17/userns-don-t-allow-unprivileged-creation-of-gid-mappings.patch queue-3.17/userns-rename-id_map_mutex-to-userns_state_mutex.patch queue-3.17/userns-add-a-knob-to-disable-setgroups-on-a-per-user-namespace-basis.patch queue-3.17/userns-allow-setting-gid_maps-without-privilege-when-setgroups-is-disabled.patch queue-3.17/userns-don-t-allow-setgroups-until-a-gid-mapping-has-been-setablished.patch queue-3.17/groups-consolidate-the-setgroups-permission-checks.patch queue-3.17/userns-only-allow-the-creator-of-the-userns-unprivileged-mappings.patch queue-3.17/userns-document-what-the-invariant-required-for-safe-unprivileged-mappings.patch queue-3.17/umount-disallow-unprivileged-mount-force.patch queue-3.17/userns-unbreak-the-unprivileged-remount-tests.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html