[PATCH 06/10] LSM: SafeSetID: fix userns handling in securityfs

[Micah Morton]

Ready for merge.

On Wed, Apr 10, 2019 at 10:16 AM Kees Cook <keescook at chromium.org> wrote:
>
> On Wed, Apr 10, 2019 at 9:56 AM Micah Morton <mortonm at chromium.org> wrote:
> >
> > From: Jann Horn <jannh at google.com>
> >
> > Looking at current_cred() in write handlers is bad form, stop doing that.
> >
> > Also, let's just require that the write is coming from the initial user
> > namespace. Especially SAFESETID_WHITELIST_FLUSH requires privilege over all
> > namespaces, and SAFESETID_WHITELIST_ADD should probably require it as well.
> >
> > Signed-off-by: Jann Horn <jannh at google.com>
> > Signed-off-by: Micah Morton <mortonm at chromium.org>
>
> Reviewed-by: Kees Cook <keescook at chromium.org>
>
> -Kees
>
> > ---
> >  security/safesetid/securityfs.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c
> > index 87e42b7f3e33..76c1e8a6ab93 100644
> > --- a/security/safesetid/securityfs.c
> > +++ b/security/safesetid/securityfs.c
> > @@ -59,8 +59,8 @@ static int parse_policy_line(
> >         if (ret)
> >                 return ret;
> >
> > -       *parent = make_kuid(current_user_ns(), parsed_parent);
> > -       *child = make_kuid(current_user_ns(), parsed_child);
> > +       *parent = make_kuid(file->f_cred->user_ns, parsed_parent);
> > +       *child = make_kuid(file->f_cred->user_ns, parsed_child);
> >         if (!uid_valid(*parent) || !uid_valid(*child))
> >                 return -EINVAL;
> >
> > @@ -92,7 +92,7 @@ static ssize_t safesetid_file_write(struct file *file,
> >         kuid_t child;
> >         int ret;
> >
> > -       if (!ns_capable(current_user_ns(), CAP_MAC_ADMIN))
> > +       if (!file_ns_capable(file, &init_user_ns, CAP_MAC_ADMIN))
> >                 return -EPERM;
> >
> >         if (*ppos != 0)
> > --
> > 2.21.0.392.gf8f6787159e-goog
> >
>
>
> --
> Kees Cook