Don't allowing sharing the root directory with processes in a different user namespace. There doesn't seem to be any point, and to allow it would require the overhead of putting a user namespace reference in fs_struct (for permission checks) and incrementing that reference count on practically every call to fork. So just perform the inexpensive test of forbidding sharing fs_struct acrosss processes in different user namespaces. We already disallow other forms of threading when unsharing a user namespace so this should be no real burden in practice. This updates setns, clone, and unshare to disallow multiple user namespaces sharing an fs_struct.
Showing the changes to kernel (2 of 2 files). Show all
Unified · Split
| @@ -1141,6 +1141,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, · 1140 unmodified lines | |||
| 1141 | if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) | 1141 | if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) |
| 1142 | return ERR_PTR(-EINVAL); | 1142 | return ERR_PTR(-EINVAL); |
| 1143 | 1143 | ||
| 1144 | if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) | ||
| 1145 | return ERR_PTR(-EINVAL); | ||
| 1146 | |||
| 1144 | /* | 1147 | /* |
| 1145 | * Thread groups must share signals as well, and detached threads | 1148 | * Thread groups must share signals as well, and detached threads |
| 1146 | * can only be started up within the thread group. | 1149 | * can only be started up within the thread group. |
| @@ -1807,7 +1810,7 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) · 660 unmodified lines | |||
| 1807 | * If unsharing a user namespace must also unshare the thread. | 1810 | * If unsharing a user namespace must also unshare the thread. |
| 1808 | */ | 1811 | */ |
| 1809 | if (unshare_flags & CLONE_NEWUSER) | 1812 | if (unshare_flags & CLONE_NEWUSER) |
| 1810 | unshare_flags |= CLONE_THREAD; | 1813 | unshare_flags |= CLONE_THREAD | CLONE_FS; |
| 1811 | /* | 1814 | /* |
| 1812 | * If unsharing a pid namespace must also unshare the thread. | 1815 | * If unsharing a pid namespace must also unshare the thread. |
| 1813 | */ | 1816 | */ |
| @@ -21,6 +21,7 @@ · 20 unmodified lines | |||
| 21 | #include <linux/uaccess.h> | 21 | #include <linux/uaccess.h> |
| 22 | #include <linux/ctype.h> | 22 | #include <linux/ctype.h> |
| 23 | #include <linux/projid.h> | 23 | #include <linux/projid.h> |
| 24 | #include <linux/fs_struct.h> | ||
| 24 | 25 | ||
| 25 | static struct kmem_cache *user_ns_cachep __read_mostly; | 26 | static struct kmem_cache *user_ns_cachep __read_mostly; |
| 26 | 27 | ||
| @@ -837,6 +838,9 @@ static int userns_install(struct nsproxy *nsproxy, void *ns) · 810 unmodified lines | |||
| 837 | if (atomic_read(¤t->mm->mm_users) > 1) | 838 | if (atomic_read(¤t->mm->mm_users) > 1) |
| 838 | return -EINVAL; | 839 | return -EINVAL; |
| 839 | 840 | ||
| 841 | if (current->fs->users != 1) | ||
| 842 | return -EINVAL; | ||
| 843 | |||
| 840 | if (!ns_capable(user_ns, CAP_SYS_ADMIN)) | 844 | if (!ns_capable(user_ns, CAP_SYS_ADMIN)) |
| 841 | return -EPERM; | 845 | return -EPERM; |
| 842 | 846 | ||