• Serge E. Hallyn's avatar
    userns: security: make capabilities relative to the user namespace · 3486740a
    Serge E. Hallyn authored
    - Introduce ns_capable to test for a capability in a non-default
      user namespace.
    - Teach cap_capable to handle capabilities in a non-default
      user namespace.
    The motivation is to get to the unprivileged creation of new
    namespaces.  It looks like this gets us 90% of the way there, with
    only potential uid confusion issues left.
    I still need to handle getting all caps after creation but otherwise I
    think I have a good starter patch that achieves all of your goals.
    	11/05/2010: [serge] add apparmor
    	12/14/2010: [serge] fix capabilities to created user namespaces
    	Without this, if user serge creates a user_ns, he won't have
    	capabilities to the user_ns he created.  THis is because we
    	were first checking whether his effective caps had the caps
    	he needed and returning -EPERM if not, and THEN checking whether
    	he was the creator.  Reverse those checks.
    	12/16/2010: [serge] security_real_capable needs ns argument in !security case
    	01/11/2011: [serge] add task_ns_capable helper
    	01/11/2011: [serge] add nsown_capable() helper per Bastian Blank suggestion
    	02/16/2011: [serge] fix a logic bug: the root user is always creator of
    		    init_user_ns, but should not always have capabilities to
    		    it!  Fix the check in cap_capable().
    	02/21/2011: Add the required user_ns parameter to security_capable,
    		    fixing a compile failure.
    	02/23/2011: Convert some macros to functions as per akpm comments.  Some
    		    couldn't be converted because we can't easily forward-declare
    		    them (they are inline if !SECURITY, extern if SECURITY).  Add
    		    a current_user_ns function so we can use it in capability.h
    		    without #including cred.h.  Move all forward declarations
    		    together to the top of the #ifdef __KERNEL__ section, and use
    		    kernel-doc format.
    	02/23/2011: Per dhowells, clean up comment in cap_capable().
    	02/23/2011: Per akpm, remove unreachable 'return -EPERM' in cap_capable.
    (Original written and signed off by Eric;  latest, modified version
    acked by him)
    [akpm@linux-foundation.org: fix build]
    [akpm@linux-foundation.org: export current_user_ns() for ecryptfs]
    [serge.hallyn@canonical.com: remove unneeded extra argument in selinux's task_has_capability]
    Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
    Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Acked-by: default avatarDaniel Lezcano <daniel.lezcano@free.fr>
    Acked-by: default avatarDavid Howells <dhowells@redhat.com>
    Cc: James Morris <jmorris@namei.org>
    Signed-off-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
security.c 32.5 KB