Re: Requirements for CAP_SYS_ADMIN on setns() ?

[ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)]

"Serge E. Hallyn" <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org> writes:

> Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
>> Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org> writes:
>> 
>> > Quoting Daniel P. Berrange (berrange-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org):
>> >> Is it not sufficient to rely on the permissions on the /proc/$PID/ns/XXX
>> >> file to control access to a namespace, and thus allow setns() without
>> >> a CAP_SYS_ADMIN check ?

The permissions on /proc/$PID/ns/XXX are sufficient to control access
but they are not ok to allow use.

>> >> ie setns() is basically useless unless you
>> >> already have sufficient privileges to get a file descriptor for the
>> >> namespace, so why does setns need an additional privilege check beyond
>> >> that done at time of open() on the proc file.

To be very clear.

setns requires CAP_SYS_ADMIN because changing the namespaces for your
children can result in tricking a suid root application and thus lead
to privilege escalation.

If you run setns inside a user namespace that you control the privilege
escalation is not possible and so setns is allowed.

Eric