From: Christian Brauner <christian.brauner@ubuntu.com>
To: "Stéphane Graber" <stgraber@ubuntu.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"Aleksa Sarai" <cyphar@cyphar.com>,
"Jann Horn" <jannh@google.com>
Cc: smbarber@chromium.org, Seth Forshee <seth.forshee@canonical.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Alexey Dobriyan <adobriyan@gmail.com>,
Serge Hallyn <serge@hallyn.com>, James Morris <jmorris@namei.org>,
Kees Cook <keescook@chromium.org>,
Jonathan Corbet <corbet@lwn.net>, Phil Estes <estesp@gmail.com>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
containers@lists.linux-foundation.org,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
Christian Brauner <christian.brauner@ubuntu.com>
Subject: [PATCH v3 23/25] keys: handle fsid mappings
Date: Tue, 18 Feb 2020 15:34:09 +0100 [thread overview]
Message-ID: <20200218143411.2389182-24-christian.brauner@ubuntu.com> (raw)
In-Reply-To: <20200218143411.2389182-1-christian.brauner@ubuntu.com>
Similar to proc and sysfs let keys use kfsids which are always mapped according
to id mappings.
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
/* v2 */
patch not present
/* v3 */
patch added
- Jann Horn <jannh@google.com>:
- Add patch to handle the keyrings.
---
security/keys/key.c | 2 +-
security/keys/permission.c | 4 ++--
security/keys/process_keys.c | 6 ++++--
security/keys/request_key.c | 10 +++++-----
security/keys/request_key_auth.c | 2 +-
5 files changed, 13 insertions(+), 11 deletions(-)
diff --git a/security/keys/key.c b/security/keys/key.c
index 718bf7217420..bfb17e8210d7 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -923,7 +923,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
/* allocate a new key */
key = key_alloc(index_key.type, index_key.description,
- cred->fsuid, cred->fsgid, cred, perm, flags, NULL);
+ cred->kfsuid, cred->kfsgid, cred, perm, flags, NULL);
if (IS_ERR(key)) {
key_ref = ERR_CAST(key);
goto error_link_end;
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 085f907b64ac..847187ca6b41 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -33,7 +33,7 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
key = key_ref_to_ptr(key_ref);
/* use the second 8-bits of permissions for keys the caller owns */
- if (uid_eq(key->uid, cred->fsuid)) {
+ if (uid_eq(key->uid, cred->kfsuid)) {
kperm = key->perm >> 16;
goto use_these_perms;
}
@@ -41,7 +41,7 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
/* use the third 8-bits of permissions for keys the caller has a group
* membership in common with */
if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) {
- if (gid_eq(key->gid, cred->fsgid)) {
+ if (gid_eq(key->gid, cred->kfsgid)) {
kperm = key->perm >> 8;
goto use_these_perms;
}
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 09541de31f2f..32376f0fbb42 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -379,7 +379,7 @@ void key_fsuid_changed(struct cred *new_cred)
/* update the ownership of the thread keyring */
if (new_cred->thread_keyring) {
down_write(&new_cred->thread_keyring->sem);
- new_cred->thread_keyring->uid = new_cred->fsuid;
+ new_cred->thread_keyring->uid = new_cred->kfsuid;
up_write(&new_cred->thread_keyring->sem);
}
}
@@ -392,7 +392,7 @@ void key_fsgid_changed(struct cred *new_cred)
/* update the ownership of the thread keyring */
if (new_cred->thread_keyring) {
down_write(&new_cred->thread_keyring->sem);
- new_cred->thread_keyring->gid = new_cred->fsgid;
+ new_cred->thread_keyring->gid = new_cred->kfsgid;
up_write(&new_cred->thread_keyring->sem);
}
}
@@ -923,10 +923,12 @@ void key_change_session_keyring(struct callback_head *twork)
new-> euid = old-> euid;
new-> suid = old-> suid;
new->fsuid = old->fsuid;
+ new->kfsuid = old->kfsuid;
new-> gid = old-> gid;
new-> egid = old-> egid;
new-> sgid = old-> sgid;
new->fsgid = old->fsgid;
+ new->kfsgid = old->kfsgid;
new->user = get_uid(old->user);
new->user_ns = get_user_ns(old->user_ns);
new->group_info = get_group_info(old->group_info);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 957b9e3e1492..254a7c2f3fde 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -134,7 +134,7 @@ static int call_sbin_request_key(struct key *authkey, void *aux)
sprintf(desc, "_req.%u", key->serial);
cred = get_current_cred();
- keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
+ keyring = keyring_alloc(desc, cred->kfsuid, cred->kfsgid, cred,
KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL);
put_cred(cred);
@@ -149,8 +149,8 @@ static int call_sbin_request_key(struct key *authkey, void *aux)
goto error_link;
/* record the UID and GID */
- sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->fsuid));
- sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->fsgid));
+ sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->kfsuid));
+ sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->kfsgid));
/* we say which key is under construction */
sprintf(key_str, "%d", key->serial);
@@ -390,7 +390,7 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
perm |= KEY_POS_WRITE;
key = key_alloc(ctx->index_key.type, ctx->index_key.description,
- ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,
+ ctx->cred->kfsuid, ctx->cred->kfsgid, ctx->cred,
perm, flags, NULL);
if (IS_ERR(key))
goto alloc_failed;
@@ -490,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
if (ret)
goto error;
- user = key_user_lookup(current_fsuid());
+ user = key_user_lookup(current_kfsuid());
if (!user) {
ret = -ENOMEM;
goto error_put_dest_keyring;
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index ecba39c93fd9..26808146897c 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -215,7 +215,7 @@ struct key *request_key_auth_new(struct key *target, const char *op,
sprintf(desc, "%x", target->serial);
authkey = key_alloc(&key_type_request_key_auth, desc,
- cred->fsuid, cred->fsgid, cred,
+ cred->kfsuid, cred->kfsgid, cred,
KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_LINK |
KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
if (IS_ERR(authkey)) {
--
2.25.0
next prev parent reply other threads:[~2020-02-18 14:36 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-18 14:33 [PATCH v3 00/25] user_namespace: introduce fsid mappings Christian Brauner
2020-02-18 14:33 ` [PATCH v3 01/25] user_namespace: introduce fsid mappings infrastructure Christian Brauner
2020-02-19 2:33 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 02/25] proc: add /proc/<pid>/fsuid_map Christian Brauner
2020-02-19 2:33 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 03/25] proc: add /proc/<pid>/fsgid_map Christian Brauner
2020-02-19 2:33 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 04/25] fsuidgid: add fsid mapping helpers Christian Brauner
2020-02-18 14:33 ` [PATCH v3 05/25] user_namespace: refactor map_write() Christian Brauner
2020-02-19 2:35 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 06/25] user_namespace: make map_write() support fsid mappings Christian Brauner
2020-02-19 16:18 ` Jann Horn
2020-02-18 14:33 ` [PATCH v3 07/25] proc: task_state(): use from_kfs{g,u}id_munged Christian Brauner
2020-02-19 2:36 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 08/25] cred: add kfs{g,u}id Christian Brauner
2020-02-18 14:33 ` [PATCH v3 09/25] fs: add is_userns_visible() helper Christian Brauner
2020-02-19 2:42 ` Serge E. Hallyn
2020-02-19 12:06 ` Christian Brauner
2020-02-19 17:18 ` Andy Lutomirski
2020-02-20 14:26 ` Serge E. Hallyn
2020-02-18 14:33 ` [PATCH v3 10/25] namei: may_{o_}create(): handle fsid mappings Christian Brauner
2020-02-18 14:33 ` [PATCH v3 11/25] inode: inode_owner_or_capable(): " Christian Brauner
2020-02-18 22:25 ` Christoph Hellwig
2020-02-19 12:29 ` Christian Brauner
2020-02-18 14:33 ` [PATCH v3 12/25] capability: privileged_wrt_inode_uidgid(): " Christian Brauner
2020-02-18 14:33 ` [PATCH v3 13/25] stat: " Christian Brauner
2020-02-18 14:34 ` [PATCH v3 14/25] open: " Christian Brauner
2020-02-18 14:34 ` [PATCH v3 15/25] posix_acl: " Christian Brauner
2020-02-18 22:26 ` Christoph Hellwig
2020-02-19 12:56 ` Christian Brauner
2020-02-18 14:34 ` [PATCH v3 16/25] attr: notify_change(): " Christian Brauner
2020-02-18 14:34 ` [PATCH v3 17/25] commoncap: cap_bprm_set_creds(): " Christian Brauner
2020-02-18 14:34 ` [PATCH v3 18/25] commoncap: cap_task_fix_setuid(): " Christian Brauner
2020-02-18 14:34 ` [PATCH v3 19/25] commoncap: handle fsid mappings with vfs caps Christian Brauner
2020-02-19 15:53 ` Jann Horn
2020-02-18 14:34 ` [PATCH v3 20/25] exec: bprm_fill_uid(): handle fsid mappings Christian Brauner
2020-02-18 14:34 ` [PATCH v3 21/25] ptrace: adapt ptrace_may_access() to always uses unmapped fsids Christian Brauner
2020-02-18 14:34 ` [PATCH v3 22/25] devpts: handle fsid mappings Christian Brauner
2020-02-18 14:34 ` Christian Brauner [this message]
2020-02-18 14:34 ` [PATCH v3 24/25] sys: handle fsid mappings in set*id() calls Christian Brauner
2020-02-19 15:42 ` Jann Horn
2020-02-18 14:34 ` [PATCH v3 25/25] selftests: add simple fsid mapping selftests Christian Brauner
2020-02-18 23:50 ` [PATCH v3 00/25] user_namespace: introduce fsid mappings James Bottomley
2020-02-19 12:27 ` Christian Brauner
2020-02-19 15:36 ` James Bottomley
2020-02-19 15:33 ` Jann Horn
2020-02-19 19:35 ` Serge E. Hallyn
2020-02-19 21:48 ` Serge E. Hallyn
2020-02-19 21:56 ` Tycho Andersen
2020-02-27 19:33 ` Josef Bacik
2020-03-02 14:34 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200218143411.2389182-24-christian.brauner@ubuntu.com \
--to=christian.brauner@ubuntu.com \
--cc=adobriyan@gmail.com \
--cc=containers@lists.linux-foundation.org \
--cc=corbet@lwn.net \
--cc=cyphar@cyphar.com \
--cc=ebiederm@xmission.com \
--cc=estesp@gmail.com \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=seth.forshee@canonical.com \
--cc=smbarber@chromium.org \
--cc=stgraber@ubuntu.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).