Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

userns: Allow unprivileged use of setns.

Browse source 
- Push the permission check from the core setns syscall into
  the setns install methods where the user namespace of the
  target namespace can be determined, and used in a ns_capable
  call.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2012-07-26 01:13:20 -07:00
parent b33c77ef23
commit 142e1d1d5f
4 changed files with 17 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ipc/namespace.c
View file

@ -161,8 +161,12 @@ static void ipcns_put(void *ns)
return put_ipc_ns(ns);
}
static int ipcns_install(struct nsproxy *nsproxy, void *ns)
static int ipcns_install(struct nsproxy *nsproxy, void *new)
{
struct ipc_namespace *ns = new;
if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
return -EPERM;
/* Ditch state from the old ipc namespace */
exit_sem(current);
put_ipc_ns(nsproxy->ipc_ns);

3
kernel/nsproxy.c
View file

@ -242,9 +242,6 @@ SYSCALL_DEFINE2(setns, int, fd, int, nstype)
struct file *file;
int err;
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
file = proc_ns_fget(fd);
if (IS_ERR(file))
return PTR_ERR(file);

7
kernel/utsname.c
View file

@ -102,8 +102,13 @@ static void utsns_put(void *ns)
put_uts_ns(ns);
}
static int utsns_install(struct nsproxy *nsproxy, void *ns)
static int utsns_install(struct nsproxy *nsproxy, void *new)
{
struct uts_namespace *ns = new;
if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
return -EPERM;
get_uts_ns(ns);
put_uts_ns(nsproxy->uts_ns);
nsproxy->uts_ns = ns;

7
net/core/net_namespace.c
View file

@ -630,8 +630,13 @@ static void netns_put(void *ns)
static int netns_install(struct nsproxy *nsproxy, void *ns)
{
struct net *net = ns;
if (!ns_capable(net->user_ns, CAP_SYS_ADMIN))
return -EPERM;
put_net(nsproxy->net_ns);
nsproxy->net_ns = get_net(ns);
nsproxy->net_ns = get_net(net);
return 0;
}