[PATCH] Set cred->user_ns in key_replace_session_keyring

[PATCH] Set cred->user_ns in key_replace_session_keyring

[Serge E. Hallyn]

Since this cred was not created with copy_creds(), it needs to get
initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
can lead to a NULL deref.  Thanks to Robert for finding this.

Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Reported-by: Robert Święcki <robert@swiecki.net>
Cc: David Howells <dhowells@redhat.com>
---
 security/keys/process_keys.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 6c0480d..92a3a5d 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
 	new-> sgid	= old-> sgid;
 	new->fsgid	= old->fsgid;
 	new->user	= get_uid(old->user);
+	new->user_ns	= new->user->user_ns;
 	new->group_info	= get_group_info(old->group_info);
 
 	new->securebits	= old->securebits;
-- 
1.7.0.4

Re: [PATCH] Set cred->user_ns in key_replace_session_keyring

[Linus Torvalds]

Shouldn't this also be "Cc: stable" for 2.6.39?

Bug introduced by commit 47a150edc2a, no?

                Linus

On Thu, May 26, 2011 at 1:25 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
> Since this cred was not created with copy_creds(), it needs to get
> initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
> can lead to a NULL deref.  Thanks to Robert for finding this.
>
> Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
> Reported-by: Robert Święcki <robert@swiecki.net>
> Cc: David Howells <dhowells@redhat.com>
> ---
>  security/keys/process_keys.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
> index 6c0480d..92a3a5d 100644
> --- a/security/keys/process_keys.c
> +++ b/security/keys/process_keys.c
> @@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
>        new-> sgid      = old-> sgid;
>        new->fsgid      = old->fsgid;
>        new->user       = get_uid(old->user);
> +       new->user_ns    = new->user->user_ns;
>        new->group_info = get_group_info(old->group_info);
>
>        new->securebits = old->securebits;
> --
> 1.7.0.4
>
>

Re: [PATCH] Set cred->user_ns in key_replace_session_keyring

[Serge E. Hallyn]

Quoting Linus Torvalds (torvalds@linux-foundation.org):
> Shouldn't this also be "Cc: stable" for 2.6.39?
> 
> Bug introduced by commit 47a150edc2a, no?

Yup, introduced there.

Stable/whoever, should I re-send this patch separately, or does this suffice?

thanks,
-serge

>                 Linus
> 
> On Thu, May 26, 2011 at 1:25 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
> > Since this cred was not created with copy_creds(), it needs to get
> > initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
> > can lead to a NULL deref.  Thanks to Robert for finding this.
> >
> > Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
> > Reported-by: Robert Święcki <robert@swiecki.net>
> > Cc: David Howells <dhowells@redhat.com>
> > ---
> >  security/keys/process_keys.c |    1 +
> >  1 files changed, 1 insertions(+), 0 deletions(-)
> >
> > diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
> > index 6c0480d..92a3a5d 100644
> > --- a/security/keys/process_keys.c
> > +++ b/security/keys/process_keys.c
> > @@ -847,6 +847,7 @@ void key_replace_session_keyring(void)
> >        new-> sgid      = old-> sgid;
> >        new->fsgid      = old->fsgid;
> >        new->user       = get_uid(old->user);
> > +       new->user_ns    = new->user->user_ns;
> >        new->group_info = get_group_info(old->group_info);
> >
> >        new->securebits = old->securebits;
> > --
> > 1.7.0.4
> >
> >

Re: [PATCH] Set cred->user_ns in key_replace_session_keyring

[Linus Torvalds]

On Thu, May 26, 2011 at 1:38 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
>
> Stable/whoever, should I re-send this patch separately, or does this suffice?

I'll add the Cc and update the description to point to the commit it
was introduced in, and it will all be fine. Then the stable team will
get it automatically when I push out.

                          Linus

Re: [PATCH] Set cred->user_ns in key_replace_session_keyring

[Serge E. Hallyn]

Quoting Linus Torvalds (torvalds@linux-foundation.org):
> On Thu, May 26, 2011 at 1:38 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
> >
> > Stable/whoever, should I re-send this patch separately, or does this suffice?
> 
> I'll add the Cc and update the description to point to the commit it
> was introduced in, and it will all be fine. Then the stable team will
> get it automatically when I push out.
> 
>                           Linus

Thanks very much.  (I see now)

-serge