From: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
To: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Cc: linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
Linux Containers
<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
James Morris
<james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
Subject: Re: [PATCH review 08/16] userns: Kill task_user_ns
Date: Mon, 19 Nov 2012 14:34:50 -0800 [thread overview]
Message-ID: <CAGXu5jK+qacMmvoMJ924DLY9GCFXM55wQtqUUDTo08db-LxQ8A@mail.gmail.com> (raw)
In-Reply-To: <1353337961-12962-8-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
On Mon, Nov 19, 2012 at 7:12 AM, Eric W. Biederman
<ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> wrote:
> From: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
>
> The task_user_ns function hides the fact that it is getting the user
> namespace from struct cred on the task. struct cred may go away as
> soon as the rcu lock is released. This leads to a race where we
> can dereference a stale user namespace pointer.
>
> To make it obvious a struct cred is involved kill task_user_ns.
>
> To kill the race modify the users of task_user_ns to only
> reference the user namespace while the rcu lock is held.
>
> Cc: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
> Cc: James Morris <james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
> Acked-by: Serge Hallyn <serge.hallyn-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
> Signed-off-by: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Nice catch! This is disappointingly messy looking, but I do not see
any sensible way to clean it up better than you've already done.
Acked-by: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
-Kees
--
Kees Cook
Chrome OS Security
next prev parent reply other threads:[~2012-11-19 22:34 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-19 15:08 [PATCH review 0/16] user namespace and namespace infrastructure completion Eric W. Biederman
[not found] ` <87lidx8wbo.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 15:12 ` [PATCH review 01/16] userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 08/16] userns: Kill task_user_ns Eric W. Biederman
[not found] ` <1353337961-12962-8-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 22:34 ` Kees Cook [this message]
2012-11-19 15:12 ` [PATCH review 10/16] userns: Implement unshare of the user namespace Eric W. Biederman
[not found] ` <1353337961-12962-1-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 15:12 ` [PATCH review 02/16] userns: Allow unprivileged users to create user namespaces Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 03/16] userns: Allow chown and setgid preservation Eric W. Biederman
[not found] ` <1353337961-12962-3-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 17:49 ` Serge Hallyn
2012-11-19 15:12 ` [PATCH review 04/16] userns: Allow setting a userns mapping to your current uid Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 05/16] userns: Allow unprivileged users to create new namespaces Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 06/16] userns: Allow unprivileged use of setns Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 07/16] userns: Make create_new_namespaces take a user_ns parameter Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 09/16] userns: Implent proc namespace operations Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 11/16] procfs: Print task uids and gids in the userns that opened the proc file Eric W. Biederman
[not found] ` <1353337961-12962-11-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 17:58 ` Serge Hallyn
2012-11-19 15:12 ` [PATCH review 12/16] userns: For /proc/self/{uid, gid}_map derive the lower userns from the struct file Eric W. Biederman
[not found] ` <1353337961-12962-12-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 18:03 ` Serge Hallyn
2012-11-19 18:29 ` Eric W. Biederman
[not found] ` <87fw451m5i.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 21:01 ` Serge Hallyn
2012-11-19 21:09 ` Eric W. Biederman
[not found] ` <877gphz4d9.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 21:19 ` Serge Hallyn
2012-11-19 21:27 ` Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 13/16] userns: Allow unprivilged mounts of proc and sysfs Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 14/16] proc: Generalize proc inode allocation Eric W. Biederman
[not found] ` <1353337961-12962-14-git-send-email-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-11-19 18:04 ` Serge Hallyn
2012-11-19 15:12 ` [PATCH review 15/16] proc: Fix the namespace inode permission checks Eric W. Biederman
2012-11-19 15:12 ` [PATCH review 16/16] proc: Usable inode numbers for the namespace file descriptors Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGXu5jK+qacMmvoMJ924DLY9GCFXM55wQtqUUDTo08db-LxQ8A@mail.gmail.com \
--to=keescook-f7+t8e8rja9g9huczpvpmw@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
--cc=james.l.morris-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org \
--cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).