Eric W. Biederman fc9b65e3d7
userns: Don't allow setgroups until a gid mapping has been setablished ...
commit 273d2c67c3e179adb1e74f403d1e9a06e3f841b5 upstream.
setgroups is unique in not needing a valid mapping before it can be called,
in the case of setgroups(0, NULL) which drops all supplemental groups.
The design of the user namespace assumes that CAP_SETGID can not actually
be used until a gid mapping is established. Therefore add a helper function
to see if the user namespace gid mapping has been established and call
that function in the setgroups permission check.
This is part of the fix for CVE-2014-8989, being able to drop groups
without privilege using user namespaces.
Reviewed-by: Andy Lutomirski <luto@amacapital.net >
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2015-01-08 09:58:16 -08:00
2014-03-06 21:30:03 -08:00
2014-09-17 09:04:02 -07:00
2014-12-06 15:05:47 -08:00
2013-12-04 10:56:22 -08:00
2013-05-25 20:30:31 -07:00
2014-09-05 16:28:37 -07:00
2014-10-15 08:31:57 +02:00
2013-05-30 10:51:20 -07:00
2014-02-13 13:48:00 -08:00
2014-01-09 12:24:22 -08:00
2014-04-26 17:15:35 -07:00
2013-10-13 16:08:33 -07:00
2013-11-29 11:11:44 -08:00
2014-04-03 12:01:04 -07:00
2014-11-14 08:47:55 -08:00
2014-09-17 09:03:57 -07:00
2013-07-21 18:21:25 -07:00
2013-12-08 07:29:27 -08:00
2014-11-21 09:22:54 -08:00
2014-02-13 13:48:00 -08:00
2014-02-22 12:41:29 -08:00
2014-10-30 09:35:12 -07:00
2014-11-14 08:47:55 -08:00
2014-11-14 08:47:55 -08:00
2014-11-14 08:47:55 -08:00
2013-05-31 11:32:30 +02:00
2013-07-25 14:07:42 -07:00
2013-06-12 16:29:44 -07:00
2014-04-14 06:42:19 -07:00
2015-01-08 09:58:16 -08:00
2013-10-18 07:45:45 -07:00
2013-10-05 07:13:11 -07:00
2013-07-28 16:30:11 -07:00
2013-08-20 08:43:03 -07:00
2013-06-10 22:23:32 -07:00
2014-03-23 21:38:16 -07:00
2013-06-20 19:02:45 +04:00
2014-03-31 09:58:12 -07:00
2014-06-07 13:25:28 -07:00
2014-04-14 06:42:19 -07:00
2013-12-11 22:36:28 -08:00
2013-10-13 16:08:28 -07:00
2014-04-03 12:01:05 -07:00
2014-02-06 11:08:12 -08:00
2014-06-07 13:25:35 -07:00
2014-06-26 15:12:38 -04:00
2013-07-28 16:30:05 -07:00
2014-12-06 15:05:46 -08:00
2014-10-05 14:54:15 -07:00
2014-06-07 13:25:38 -07:00
2014-03-06 21:30:12 -08:00
2013-09-14 06:54:55 -07:00
2014-06-07 13:25:29 -07:00
2014-06-30 20:09:45 -07:00
2014-10-09 12:18:43 -07:00
2013-05-24 16:22:51 -07:00
2013-12-20 07:45:08 -08:00
2014-11-21 09:22:54 -08:00
2013-05-31 11:32:30 +02:00
2014-07-31 12:53:49 -07:00
2014-05-30 21:52:14 -07:00
2013-06-12 16:29:47 -07:00
2014-11-21 09:22:56 -08:00
2013-10-13 16:08:35 -07:00
2014-01-09 12:24:23 -08:00
2014-11-21 09:22:56 -08:00
2013-11-29 11:11:53 -08:00
2014-09-17 09:04:00 -07:00
2013-12-04 10:56:10 -08:00
2013-07-21 18:21:29 -07:00
2014-01-15 15:28:47 -08:00
2014-03-06 21:30:05 -08:00
2014-06-26 15:12:37 -04:00
2014-11-21 09:22:53 -08:00
2014-11-14 08:48:01 -08:00
2014-11-14 08:47:58 -08:00
2013-09-26 17:18:14 -07:00
2014-12-06 15:05:47 -08:00
2014-06-11 12:03:26 -07:00
2014-02-13 13:47:59 -08:00
2013-06-19 12:55:10 +02:00
2014-08-07 14:30:26 -07:00
2014-07-06 18:54:15 -07:00
2013-12-08 07:29:24 -08:00
2013-06-02 20:53:59 -07:00
2013-09-26 17:18:13 -07:00
2013-05-28 22:47:13 -04:00
2013-09-07 22:09:58 -07:00
2014-07-17 15:58:03 -07:00
2013-05-24 16:22:50 -07:00
2013-05-24 16:22:50 -07:00
2013-05-30 09:20:20 +02:00
2014-11-21 09:22:56 -08:00
2013-10-18 07:45:47 -07:00
2013-09-26 17:18:13 -07:00
2014-03-06 21:30:05 -08:00
2013-06-14 19:24:42 -10:00
2014-06-26 15:12:37 -04:00
2013-06-06 11:52:14 -07:00
2014-01-09 12:24:23 -08:00
2013-06-20 19:02:45 +04:00
2014-11-14 08:47:55 -08:00
2013-06-12 16:29:46 -07:00
2013-08-20 08:43:02 -07:00
2013-06-12 16:29:44 -07:00
2013-11-29 11:11:42 -08:00
2013-08-11 18:35:24 -07:00
2013-10-01 09:17:45 -07:00
2014-03-23 21:38:16 -07:00
2013-11-13 12:05:29 +09:00
2015-01-08 09:58:16 -08:00
2013-07-28 16:29:55 -07:00
2013-12-08 07:29:27 -08:00
2014-02-13 13:48:00 -08:00
2013-05-31 11:31:50 +02:00
2013-08-29 09:47:39 -07:00
2014-10-05 14:54:12 -07:00
Eric W. Biederman
fc9b65e3d7