linux-security-module.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/9] libcap: add user namespace fscaps support
@ 2018-08-10 16:13 Christian Brauner
  2018-08-10 16:13 ` [PATCH 1/9] cap_file: use v3 xattr macros Christian Brauner
                   ` (8 more replies)
  0 siblings, 9 replies; 11+ messages in thread
From: Christian Brauner @ 2018-08-10 16:13 UTC (permalink / raw)
  To: linux-security-module

Hey everyone,

Starting with kernel 4.14 fcaps support in user namespaces was added.
libcap currently does not support fcaps in user namespaces. This series
adds support for fcaps in user namespaces. To this end two new functions
are introduced:

1. cap_get_nsowner()
   Get the uid associated with the capability sets as seen in the
   current user namespace.
   For example, assume that uid 0 in a non-initial userns is mapped to
   uid 1000000 on the host/initial user namespace. Further assume one of
   the following:
   a. A VFS_CAP_REVISION_2 capability has been set from within the
      non-initial user namespace.
   b. A VFS_CAP_REVISION_3 capability with nsowner 0 has been set from
      within said non-initial user namespace.
   c. A VFS_CAP_REVISION_3 capability with nsowner 100000 has been set
      from the initial user namespace.
   In any of these cases, cap_get_nsowner() will return 0 from within
   said non-initial user namespace, and will return 1000000 from the
   parent user namespace that wrote this mapping.

2. cap_set_nsowner()
   Set the owning uid associated with the capability sets.
   For example, assume that uid 0 in a non-initial userns is mapped to
   uid 1000000 on the host. Now, cap_set_nsowner() sets the uid for the
   capabilitiy sets to 1000000 in the parent (host) user namespace of
   the non-initial user namespace. This will cause a capability to be
   set that is useless on the host but interpreted in every user
   namespace that has established the same mapping.

More details on how to handle cases where libcap is compiled on a
VFS_CAP_REVISION_3 kernel but used on a VFS_CAP_REVISION_2 kernel can be
found in the individual commits.

Thanks!
Christian

Christian Brauner (9):
  cap_file: use v3 xattr macros
  capability: update to new uapi header
  cap_file: use struct vfs_ns_cap_data if possible
  cap_file: add new rootid argument
  cap_file: initialize rootid in _fcaps_load()
  capability: add cap_get_nsowner()
  cap_file: save rootid in _fcaps_save()
  cap_file: handle run- vs buildtime vfs cap support
  capability: add cap_set_nsowner()

 libcap/cap_file.c                      | 107 ++++++++++++++++++++++++-
 libcap/include/sys/capability.h        |   2 +
 libcap/include/uapi/linux/capability.h |  39 ++++++---
 libcap/libcap.h                        |   1 +
 4 files changed, 134 insertions(+), 15 deletions(-)

-- 
2.17.1

^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2018-08-13 16:11 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-08-10 16:13 [PATCH 0/9] libcap: add user namespace fscaps support Christian Brauner
2018-08-10 16:13 ` [PATCH 1/9] cap_file: use v3 xattr macros Christian Brauner
2018-08-13 16:11   ` Serge E. Hallyn
2018-08-10 16:13 ` [PATCH 2/9] capability: update to new uapi header Christian Brauner
2018-08-10 16:13 ` [PATCH 3/9] cap_file: use struct vfs_ns_cap_data if possible Christian Brauner
2018-08-10 16:13 ` [PATCH 4/9] cap_file: add new rootid argument Christian Brauner
2018-08-10 16:13 ` [PATCH 5/9] cap_file: initialize rootid in _fcaps_load() Christian Brauner
2018-08-10 16:13 ` [PATCH 6/9] capability: add cap_get_nsowner() Christian Brauner
2018-08-10 16:13 ` [PATCH 7/9] cap_file: save rootid in _fcaps_save() Christian Brauner
2018-08-10 16:13 ` [PATCH 8/9] cap_file: handle run- vs buildtime vfs cap support Christian Brauner
2018-08-10 16:13 ` [PATCH 9/9] capability: add cap_set_nsowner() Christian Brauner

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).