Commit 5af66203 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

userns: Convert ptrace, kill, set_priority permission checks to work with kuids and kgids 



Update the permission checks to use the new uid_eq and gid_eq helpers
and remove the now unnecessary user_ns equality comparison.

Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent a29c33f4

kernel/ptrace.c

+6 −7
Original line number Diff line number Diff line
@@ -198,13 +198,12 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode) 
		return 0;

	rcu_read_lock();

	tcred = __task_cred(task);

	if (cred->user_ns == tcred->user_ns &&

	    (cred->uid == tcred->euid &&

	     cred->uid == tcred->suid &&

	     cred->uid == tcred->uid  &&

	     cred->gid == tcred->egid &&

	     cred->gid == tcred->sgid &&

	     cred->gid == tcred->gid))

	if (uid_eq(cred->uid, tcred->euid) &&

	    uid_eq(cred->uid, tcred->suid) &&

	    uid_eq(cred->uid, tcred->uid)  &&

	    gid_eq(cred->gid, tcred->egid) &&

	    gid_eq(cred->gid, tcred->sgid) &&

	    gid_eq(cred->gid, tcred->gid))

		goto ok;

	if (ptrace_has_cap(tcred->user_ns, mode))

		goto ok;

kernel/signal.c

+6 −9
Original line number Diff line number Diff line
@@ -767,11 +767,10 @@ static int kill_ok_by_cred(struct task_struct *t) 
	const struct cred *cred = current_cred();

	const struct cred *tcred = __task_cred(t);



	if (cred->user_ns == tcred->user_ns &&

	    (cred->euid == tcred->suid ||

	     cred->euid == tcred->uid ||

	     cred->uid  == tcred->suid ||

	     cred->uid  == tcred->uid))

	if (uid_eq(cred->euid, tcred->suid) ||

	    uid_eq(cred->euid, tcred->uid)  ||

	    uid_eq(cred->uid,  tcred->suid) ||

	    uid_eq(cred->uid,  tcred->uid))

		return 1;



	if (ns_capable(tcred->user_ns, CAP_KILL))
@@ -1389,10 +1388,8 @@ static int kill_as_cred_perm(const struct cred *cred, 
			     struct task_struct *target)

{

	const struct cred *pcred = __task_cred(target);

	if (cred->user_ns != pcred->user_ns)

		return 0;

	if (cred->euid != pcred->suid && cred->euid != pcred->uid &&

	    cred->uid  != pcred->suid && cred->uid  != pcred->uid)

	if (!uid_eq(cred->euid, pcred->suid) && !uid_eq(cred->euid, pcred->uid) &&

	    !uid_eq(cred->uid,  pcred->suid) && !uid_eq(cred->uid,  pcred->uid))

		return 0;

	return 1;

}

kernel/sys.c

+8 −10
Original line number Diff line number Diff line
@@ -131,9 +131,8 @@ static bool set_one_prio_perm(struct task_struct *p) 
{

	const struct cred *cred = current_cred(), *pcred = __task_cred(p);



	if (pcred->user_ns == cred->user_ns &&

	    (pcred->uid  == cred->euid ||

	     pcred->euid == cred->euid))

	if (uid_eq(pcred->uid,  cred->euid) ||

	    uid_eq(pcred->euid, cred->euid))

		return true;

	if (ns_capable(pcred->user_ns, CAP_SYS_NICE))

		return true;
@@ -1582,13 +1581,12 @@ static int check_prlimit_permission(struct task_struct *task) 
		return 0;



	tcred = __task_cred(task);

	if (cred->user_ns == tcred->user_ns &&

	    (cred->uid == tcred->euid &&

	     cred->uid == tcred->suid &&

	     cred->uid == tcred->uid &&

	     cred->gid == tcred->egid &&

	     cred->gid == tcred->sgid &&

		    cred->gid == tcred->gid))

	if (uid_eq(cred->uid, tcred->euid) &&

	    uid_eq(cred->uid, tcred->suid) &&

	    uid_eq(cred->uid, tcred->uid)  &&

	    gid_eq(cred->gid, tcred->egid) &&

	    gid_eq(cred->gid, tcred->sgid) &&

	    gid_eq(cred->gid, tcred->gid))

		return 0;

	if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))

		return 0;