3151527ee0
Guarantee that the policy of which files may be access that is established by setting the root directory will not be violated by user namespaces by verifying that the root directory points to the root of the mount namespace at the time of user namespace creation. Changing the root is a privileged operation, and as a matter of policy it serves to limit unprivileged processes to files below the current root directory. For reasons of simplicity and comprehensibility the privilege to change the root directory is gated solely on the CAP_SYS_CHROOT capability in the user namespace. Therefore when creating a user namespace we must ensure that the policy of which files may be access can not be violated by changing the root directory. Anyone who runs a processes in a chroot and would like to use user namespace can setup the same view of filesystems with a mount namespace instead. With this result that this is not a practical limitation for using user namespaces. Cc: stable@vger.kernel.org Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Reported-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
56 lines
1.2 KiB
C
56 lines
1.2 KiB
C
#ifndef _LINUX_FS_STRUCT_H
|
|
#define _LINUX_FS_STRUCT_H
|
|
|
|
#include <linux/path.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/seqlock.h>
|
|
|
|
struct fs_struct {
|
|
int users;
|
|
spinlock_t lock;
|
|
seqcount_t seq;
|
|
int umask;
|
|
int in_exec;
|
|
struct path root, pwd;
|
|
};
|
|
|
|
extern struct kmem_cache *fs_cachep;
|
|
|
|
extern void exit_fs(struct task_struct *);
|
|
extern void set_fs_root(struct fs_struct *, const struct path *);
|
|
extern void set_fs_pwd(struct fs_struct *, const struct path *);
|
|
extern struct fs_struct *copy_fs_struct(struct fs_struct *);
|
|
extern void free_fs_struct(struct fs_struct *);
|
|
extern int unshare_fs_struct(void);
|
|
|
|
static inline void get_fs_root(struct fs_struct *fs, struct path *root)
|
|
{
|
|
spin_lock(&fs->lock);
|
|
*root = fs->root;
|
|
path_get(root);
|
|
spin_unlock(&fs->lock);
|
|
}
|
|
|
|
static inline void get_fs_pwd(struct fs_struct *fs, struct path *pwd)
|
|
{
|
|
spin_lock(&fs->lock);
|
|
*pwd = fs->pwd;
|
|
path_get(pwd);
|
|
spin_unlock(&fs->lock);
|
|
}
|
|
|
|
static inline void get_fs_root_and_pwd(struct fs_struct *fs, struct path *root,
|
|
struct path *pwd)
|
|
{
|
|
spin_lock(&fs->lock);
|
|
*root = fs->root;
|
|
path_get(root);
|
|
*pwd = fs->pwd;
|
|
path_get(pwd);
|
|
spin_unlock(&fs->lock);
|
|
}
|
|
|
|
extern bool current_chrooted(void);
|
|
|
|
#endif /* _LINUX_FS_STRUCT_H */
|