diff options
author | John Stultz <john.stultz@linaro.org> | 2013-04-08 10:45:54 -0700 |
---|---|---|
committer | John Stultz <john.stultz@linaro.org> | 2013-04-08 10:45:54 -0700 |
commit | 698cb5d58f5498273e71d4797c8b3353535c8de6 (patch) | |
tree | 20f459c3e673a04c82ba2d529fc14efd28c1dcb5 /kernel/user_namespace.c | |
parent | 97c64b5e2132e104a8c25026319b239fce7463f4 (diff) | |
parent | 31880c37c11e28cb81c70757e38392b42e695dc6 (diff) |
Merge remote-tracking branch 'linus/master' into linaro-android-3.9-experimentaltracking-linaro-android-3.9-llct-20130408.0
Update to 3.9-rc6
Conflicts:
arch/arm/mm/cache-l2x0.c
drivers/hid/hid-magicmouse.c
Diffstat (limited to 'kernel/user_namespace.c')
-rw-r--r-- | kernel/user_namespace.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 8b650837083e..a54f26f82eb2 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -21,6 +21,7 @@ #include <linux/uaccess.h> #include <linux/ctype.h> #include <linux/projid.h> +#include <linux/fs_struct.h> static struct kmem_cache *user_ns_cachep __read_mostly; @@ -60,6 +61,15 @@ int create_user_ns(struct cred *new) kgid_t group = new->egid; int ret; + /* + * Verify that we can not violate the policy of which files + * may be accessed that is specified by the root directory, + * by verifing that the root directory is at the root of the + * mount namespace which allows all files to be accessed. + */ + if (current_chrooted()) + return -EPERM; + /* The creator needs a mapping in the parent user namespace * or else we won't be able to reasonably tell userspace who * created a user_namespace. @@ -86,6 +96,8 @@ int create_user_ns(struct cred *new) set_cred_user_ns(new, ns); + update_mnt_policy(ns); + return 0; } @@ -837,6 +849,9 @@ static int userns_install(struct nsproxy *nsproxy, void *ns) if (atomic_read(¤t->mm->mm_users) > 1) return -EINVAL; + if (current->fs->users != 1) + return -EINVAL; + if (!ns_capable(user_ns, CAP_SYS_ADMIN)) return -EPERM; |