From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from h2.hallyn.com ([78.46.35.8]:54494 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757161AbdLWDus (ORCPT ); Fri, 22 Dec 2017 22:50:48 -0500 Date: Fri, 22 Dec 2017 21:50:47 -0600 From: "Serge E. Hallyn" To: Dongsu Park Cc: linux-kernel@vger.kernel.org, containers@lists.linux-foundation.org, Alban Crequy , "Eric W . Biederman" , Miklos Szeredi , Seth Forshee , Sargun Dhillon , linux-fsdevel@vger.kernel.org, Serge Hallyn Subject: Re: [PATCH 09/11] fuse: Restrict allow_other to the superblock's namespace or a descendant Message-ID: <20171223035046.GI6837@mail.hallyn.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Fri, Dec 22, 2017 at 03:32:33PM +0100, Dongsu Park wrote: > From: Seth Forshee > > Unprivileged users are normally restricted from mounting with the > allow_other option by system policy, but this could be bypassed > for a mount done with user namespace root permissions. In such > cases allow_other should not allow users outside the userns > to access the mount as doing so would give the unprivileged user > the ability to manipulate processes it would otherwise be unable > to manipulate. Restrict allow_other to apply to users in the same > userns used at mount or a descendant of that namespace. Also > export current_in_userns() for use by fuse when built as a > module. > > Patch v4 is available: https://patchwork.kernel.org/patch/8944671/ > > Cc: linux-fsdevel@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: "Eric W. Biederman" > Cc: Serge Hallyn > Cc: Miklos Szeredi > Signed-off-by: Seth Forshee > Signed-off-by: Dongsu Park Reviewed-by: Serge Hallyn > --- > fs/fuse/dir.c | 2 +- > kernel/user_namespace.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c > index ad1cfac1..d41559a0 100644 > --- a/fs/fuse/dir.c > +++ b/fs/fuse/dir.c > @@ -1030,7 +1030,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) > const struct cred *cred; > > if (fc->allow_other) > - return 1; > + return current_in_userns(fc->user_ns); > > cred = current_cred(); > if (uid_eq(cred->euid, fc->user_id) && > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 246d4d4c..492c255e 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -1235,6 +1235,7 @@ bool current_in_userns(const struct user_namespace *target_ns) > { > return in_userns(target_ns, current_user_ns()); > } > +EXPORT_SYMBOL(current_in_userns); I have to say I'm not happy with this name. I wish it had been called current_under_userns or something to indicate it may also be in a child. > > static inline struct user_namespace *to_user_ns(struct ns_common *ns) > { > -- > 2.13.6