Commit 3cdf5b45 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped 



When performing an exec where the binary lives in one user namespace and
the execing process lives in another usre namespace there is the possibility
that the target uids can not be represented.

Instead of failing the exec simply ignore the suid/sgid bits and run
the binary with lower privileges.   We already do this in the case
of MNT_NOSUID so this should be a well tested code path.

As the user and group are not changed this should not introduce any
security issues.

Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent ae11e0f1

fs/exec.c

+3 −6
Original line number Original line Diff line number Diff line
@@ -1266,14 +1266,13 @@ int prepare_binprm(struct linux_binprm *bprm) 
	bprm->cred->egid = current_egid();

	bprm->cred->egid = current_egid();





	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&

	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&

	    !current->no_new_privs) {

	    !current->no_new_privs &&

	    kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) &&

	    kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) {

		/* Set-uid? */

		/* Set-uid? */

		if (mode & S_ISUID) {

		if (mode & S_ISUID) {

			if (!kuid_has_mapping(bprm->cred->user_ns, inode->i_uid))

				return -EPERM;

			bprm->per_clear |= PER_CLEAR_ON_SETID;

			bprm->per_clear |= PER_CLEAR_ON_SETID;

			bprm->cred->euid = inode->i_uid;

			bprm->cred->euid = inode->i_uid;



		}

		}





		/* Set-gid? */

		/* Set-gid? */
@@ -1283,8 +1282,6 @@ int prepare_binprm(struct linux_binprm *bprm) 
		 * executable.

		 * executable.

		 */

		 */

		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {

		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {

			if (!kgid_has_mapping(bprm->cred->user_ns, inode->i_gid))

				return -EPERM;

			bprm->per_clear |= PER_CLEAR_ON_SETID;

			bprm->per_clear |= PER_CLEAR_ON_SETID;

			bprm->cred->egid = inode->i_gid;

			bprm->cred->egid = inode->i_gid;

		}

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE