From: ebiederm@xmission.com (Eric W. Biederman)
To: Andy Lutomirski <luto@amacapital.net>
Cc: security@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH 1/2] net: Check the correct namespace when spoofing pid over SCM_RIGHTS
Date: Mon, 26 Aug 2013 18:02:09 -0700 [thread overview]
Message-ID: <8738pwndym.fsf@xmission.com> (raw)
In-Reply-To: <ff9dd301d8c91ec02362d52494b4a640f370bc68.1377196394.git.luto@amacapital.net> (Andy Lutomirski's message of "Thu, 22 Aug 2013 11:39:15 -0700")
Andy Lutomirski <luto@amacapital.net> writes:
> This is a security bug.
>
> The follow-up will fix nsproxy to discourage this type of issue from
> happening again.
Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
> ---
> net/core/scm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/core/scm.c b/net/core/scm.c
> index 03795d0..b4da80b 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
> return -EINVAL;
>
> if ((creds->pid == task_tgid_vnr(current) ||
> - ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
> + ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
> ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
> uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
> ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
prev parent reply other threads:[~2013-08-27 1:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1377196394.git.luto@amacapital.net>
2013-08-22 18:39 ` [PATCH 1/2] net: Check the correct namespace when spoofing pid over SCM_RIGHTS Andy Lutomirski
2013-08-27 1:02 ` Eric W. Biederman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8738pwndym.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=netdev@vger.kernel.org \
--cc=security@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).