From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4720BC3B1BD for ; Fri, 14 Feb 2020 18:42:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 21A8C222C2 for ; Fri, 14 Feb 2020 18:42:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389934AbgBNSmO (ORCPT ); Fri, 14 Feb 2020 13:42:14 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:33920 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388592AbgBNSmO (ORCPT ); Fri, 14 Feb 2020 13:42:14 -0500 Received: from ip5f5bf7ec.dynamic.kabel-deutschland.de ([95.91.247.236] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1j2fqn-0000uO-SV; Fri, 14 Feb 2020 18:38:05 +0000 From: Christian Brauner To: =?UTF-8?q?St=C3=A9phane=20Graber?= , "Eric W. Biederman" , Aleksa Sarai , Jann Horn Cc: smbarber@chromium.org, Seth Forshee , Alexander Viro , Alexey Dobriyan , Serge Hallyn , James Morris , Kees Cook , Jonathan Corbet , Phil Estes , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, containers@lists.linux-foundation.org, linux-security-module@vger.kernel.org, linux-api@vger.kernel.org, Christian Brauner Subject: [PATCH v2 26/28] exec: bprm_fill_uid(): handle fsid mappings Date: Fri, 14 Feb 2020 19:35:52 +0100 Message-Id: <20200214183554.1133805-27-christian.brauner@ubuntu.com> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200214183554.1133805-1-christian.brauner@ubuntu.com> References: <20200214183554.1133805-1-christian.brauner@ubuntu.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: Make sure that during suid/sgid binary execution we lookup the fsids in the fsid mappings. If the kernel is compiled without fsid mappings or now fsid mappings are setup the behavior is unchanged. Assuming we have a binary in a given user namespace that is owned by 0:0 in the given user namespace which appears as 300000:300000 on-disk in the initial user namespace. Now assume we write an id mapping of 0 100000 100000 and an fsid mapping for 0 300000 300000 in the user namespace. When we hit bprm_fill_uid() during setid execution we will retrieve inode kuid=100000 and kgid=1000000. We first check whether there's an fsid mapping for these kids. In our scenario we find that they map to fsuid=0 and fsgid=0 in the user namespace. Now we translate them into kids in the id mapping. In our example they translate to kuid=100000 and kgid=100000 which means the file will ultimately run as uid=0 and gid=0 in the user namespace and as uid=100000, gid=100000 in the initial user namespace. Let's alter the example and assume that there is an fsid mapping of 0 300000 300000 set up but no id mapping has been setup for the user namespace. In this the last step of translating into a valid kid pair in the id mappings will fail and we will behave as before and ignore the sid bits. Cc: Jann Horn Signed-off-by: Christian Brauner --- /* v2 */ patch added - Christian Brauner : - Make sure that bprm_fill_uid() handles fsid mappings. --- fs/exec.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index db17be51b112..9e4a7e757cef 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -62,6 +62,7 @@ #include #include #include +#include #include #include @@ -1518,8 +1519,8 @@ static void bprm_fill_uid(struct linux_binprm *bprm) { struct inode *inode; unsigned int mode; - kuid_t uid; - kgid_t gid; + kuid_t uid, euid; + kgid_t gid, egid; /* * Since this can be called multiple times (via prepare_binprm), @@ -1551,18 +1552,30 @@ static void bprm_fill_uid(struct linux_binprm *bprm) inode_unlock(inode); /* We ignore suid/sgid if there are no mappings for them in the ns */ - if (!kuid_has_mapping(bprm->cred->user_ns, uid) || - !kgid_has_mapping(bprm->cred->user_ns, gid)) + if (!kfsuid_has_mapping(bprm->cred->user_ns, uid) || + !kfsgid_has_mapping(bprm->cred->user_ns, gid)) return; + if (mode & S_ISUID) { + euid = kfsuid_to_kuid(bprm->cred->user_ns, uid); + if (!uid_valid(euid)) + return; + } + + if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { + egid = kfsgid_to_kgid(bprm->cred->user_ns, gid); + if (!gid_valid(egid)) + return; + } + if (mode & S_ISUID) { bprm->per_clear |= PER_CLEAR_ON_SETID; - bprm->cred->euid = uid; + bprm->cred->euid = euid; } if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { bprm->per_clear |= PER_CLEAR_ON_SETID; - bprm->cred->egid = gid; + bprm->cred->egid = egid; } } -- 2.25.0