Seth Forshee d07b846f62 fs: Limit file caps to the user namespace of the super block ...

Capability sets attached to files must be ignored except in the
user namespaces where the mounter is privileged, i.e. s_user_ns
and its descendants. Otherwise a vector exists for gaining
privileges in namespaces where a user is not already privileged.

Add a new helper function, current_in_user_ns(), to test whether a user
namespace is the same as or a descendant of another namespace.
Use this helper to determine whether a file's capability set
should be applied to the caps constructed during exec.

--EWB Replaced in_userns with the simpler current_in_userns.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

2016-06-24 10:40:31 -05:00

..

bpf

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-05-31 22:28:28 -07:00

configs

kconfig: add xenconfig defconfig helper

2015-06-16 11:04:29 +01:00

debug

mm/init: Add 'rodata=off' boot cmdline parameter to disable read-only kernel mappings

2016-02-22 08:51:37 +01:00

events

Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2016-05-25 17:05:40 -07:00

gcov

gcov: disable for COMPILE_TEST

2016-05-10 17:12:49 +02:00

irq

Merge tag 'irqchip-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent

2016-06-03 15:05:51 +02:00

livepatch

Merge branches 'for-4.7/core', 'for-4.7/livepatching-doc' and 'for-4.7/livepatching-ppc64' into for-linus

2016-05-17 12:06:35 +02:00

locking

add down_write_killable_nested()

2016-05-26 00:04:58 -04:00

power

PM / Hibernate: Call flush_icache_range() on pages restored in-place

2016-04-28 13:35:48 +01:00

printk

printk/nmi: flush NMI messages on the system panic

2016-05-20 17:58:30 -07:00

rcu

debugobjects: insulate non-fixup logic related to static obj from fixup callbacks

2016-05-19 19:12:14 -07:00

sched

Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2016-05-25 17:11:43 -07:00

time

timer: Export destroy_hrtimer_on_stack()

2016-05-31 11:44:08 -07:00

trace

Merge tag 'trace-v4.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

2016-05-22 19:40:39 -07:00

.gitignore

certs: add .gitignore to stop git nagging about x509_certificate_list

2015-10-21 15:18:35 +01:00

acct.c

acct: check FMODE_CAN_WRITE

2015-04-11 22:27:55 -04:00

async.c

async: export current_is_async()

2015-11-19 17:51:48 +01:00

audit_fsnotify.c

wrappers for ->i_mutex access

2016-01-22 18:04:28 -05:00

audit_tree.c

audit: cleanup prune_tree_thread

2016-04-04 09:46:47 -04:00

audit_watch.c

don't bother with ->d_inode->i_sb - it's always equal to ->d_sb

2016-04-10 17:11:51 -04:00

audit.c

Merge branch 'stable-4.7' of git://git.infradead.org/users/pcmoore/audit

2016-05-18 18:46:55 -07:00

audit.h

security: Make inode argument of inode_getsecid non-const

2015-12-24 11:09:39 -05:00

auditfilter.c

audit: Fix typo in comment

2016-02-08 11:25:39 -05:00

auditsc.c

Merge branch 'stable-4.7' of git://git.infradead.org/users/pcmoore/audit

2016-05-18 18:46:55 -07:00

backtracetest.c

…

bounds.c

page-cgroup: get rid of NR_PCG_FLAGS

2014-08-08 15:57:18 -07:00

capability.c

kernel: conditionally support non-root users, groups and capabilities

2015-04-15 16:35:22 -07:00

cgroup_freezer.c

cgroup: kill cgrp_ss_priv[CGROUP_CANFORK_COUNT] and friends

2015-12-03 10:24:08 -05:00

cgroup_pids.c

cgroup_pids: fix a typo.

2015-12-14 14:54:37 -05:00

cgroup.c

cgroup: fix compile warning

2016-05-12 11:05:27 -04:00

compat.c

compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap()

2015-06-04 23:57:18 +02:00

configs.c

…

context_tracking.c

context_tracking: Switch to new static_branch API

2015-11-24 09:56:43 +01:00

cpu_pm.c

kernel/cpu_pm: fix cpu_cluster_pm_exit comment

2015-09-03 02:42:20 +02:00

cpu.c

sched/hotplug: Make activate() the last hotplug step

2016-05-06 14:58:25 +02:00

cpuset.c

cpuset: use static key better and convert to new API

2016-05-19 19:12:14 -07:00

crash_dump.c

crash_dump: Make is_kdump_kernel() accessible from modules

2014-08-25 15:42:19 -07:00

cred.c

kmemcg: account certain kmem allocations to memcg

2016-01-14 16:00:49 -08:00

delayacct.c

kmemcg: account certain kmem allocations to memcg

2016-01-14 16:00:49 -08:00

dma.c

…

elfcore.c

…

exec_domain.c

Remove rest of exec domains.

2015-04-12 21:03:31 +02:00

exit.c

wait: allow sys_waitid() to accept __WNOTHREAD/__WCLONE/__WALL

2016-05-23 17:04:14 -07:00

extable.c

kernel/extable.c: remove duplicated include

2015-09-10 13:29:01 -07:00

fork.c

mm: oom_reaper: remove some bloat

2016-05-26 15:35:44 -07:00

freezer.c

freezer: remove obsolete comments in __thaw_task()

2014-10-21 23:44:20 +02:00

futex_compat.c

ptrace: use fsuid, fsgid, effective creds for fs access checks

2016-01-20 17:09:18 -08:00

futex.c

x86: remove more uaccess_32.h complexity

2016-05-22 17:21:27 -07:00

groups.c

kernel: conditionally support non-root users, groups and capabilities

2015-04-15 16:35:22 -07:00

hung_task.c

kernel/hung_task.c: use timeout diff when timeout is updated

2016-03-22 15:36:02 -07:00

irq_work.c

treewide: Remove old email address

2015-11-23 09:44:58 +01:00

jump_label.c

treewide: Remove old email address

2015-11-23 09:44:58 +01:00

kallsyms.c

kallsyms: add support for relative offsets in kallsyms address table

2016-03-15 16:55:16 -07:00

kcmp.c

ptrace: use fsuid, fsgid, effective creds for fs access checks

2016-01-20 17:09:18 -08:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

locking/qrwlock: Rename QUEUE_RWLOCK to QUEUED_RWLOCKS

2015-05-12 09:46:00 +02:00

Kconfig.preempt

…

kcov.c

kcov: don't profile branches in kcov

2016-04-28 19:34:04 -07:00

kexec_core.c

s390/kexec: consolidate crash_map/unmap_reserved_pages() and arch_kexec_protect(unprotect)_crashkres()

2016-05-23 17:04:14 -07:00

kexec_file.c

kexec: introduce a protection mechanism for the crashkernel reserved memory

2016-05-23 17:04:14 -07:00

kexec_internal.h

kexec: move some memembers and definitions within the scope of CONFIG_KEXEC_FILE

2016-01-20 17:09:18 -08:00

kexec.c

s390/kexec: consolidate crash_map/unmap_reserved_pages() and arch_kexec_protect(unprotect)_crashkres()

2016-05-23 17:04:14 -07:00

kmod.c

kmod: don't run async usermode helper as a child of kworker thread

2015-10-23 17:55:10 +09:00

kprobes.c

perf/x86/hw_breakpoints: Disallow kernel breakpoints unless kprobe-safe

2015-08-04 10:16:54 +02:00

ksysfs.c

rcu: Remove TINY_RCU bloat from pointless boot parameters

2015-12-07 16:59:37 -08:00

kthread.c

kernel/kthread.c:kthread_create_on_node(): clarify documentation

2015-09-04 16:54:41 -07:00

latencytop.c

sched/debug: Make schedstats a runtime tunable that is disabled by default

2016-02-09 11:54:23 +01:00

Makefile

ELF/MIPS build fix

2016-05-23 17:04:14 -07:00

membarrier.c

sys_membarrier(): system-wide memory barrier (generic, x86)

2015-09-11 15:21:34 -07:00

memremap.c

memremap: add arch specific hook for MEMREMAP_WB mappings

2016-04-04 10:26:41 +02:00

module_signing.c

KEYS: Move the point of trust determination to __key_link()

2016-04-11 22:43:43 +01:00

module-internal.h

…

module.c

module: preserve Elf information for livepatch modules

2016-04-01 15:00:10 +02:00

notifier.c

Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-09-01 08:40:25 -07:00

nsproxy.c

cgroup: introduce cgroup namespaces

2016-02-16 13:04:58 -05:00

padata.c

kernel/padata.c: hide unused functions

2016-05-19 19:12:14 -07:00

panic.c

printk/nmi: flush NMI messages on the system panic

2016-05-20 17:58:30 -07:00

params.c

Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2015-11-09 15:53:39 -08:00

pid_namespace.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-12-16 15:53:03 -08:00

pid.c

remove lots of IS_ERR_VALUE abuses

2016-05-27 15:26:11 -07:00

profile.c

profile: hide unused functions when !CONFIG_PROC_FS

2016-03-22 15:36:02 -07:00

ptrace.c

ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock

2016-03-22 15:36:02 -07:00

range.c

kernel: avoid overflow in cmp_range

2015-01-17 10:02:23 +13:00

reboot.c

kexec: split kexec_load syscall from kexec core code

2015-09-10 13:29:01 -07:00

relay.c

wrappers for ->i_mutex access

2016-01-22 18:04:28 -05:00

resource.c

/proc/iomem: only expose physical resource addresses to privileged users

2016-04-14 12:56:09 -07:00

seccomp.c

Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus

2016-05-19 10:02:26 -07:00

signal.c

kernel/signal.c: convert printk(KERN_<LEVEL> ...) to pr_<level>(...)

2016-05-23 17:04:14 -07:00

smp.c

Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2016-03-15 13:50:29 -07:00

smpboot.c

cpu/hotplug: Unpark smpboot threads from the state machine

2016-03-01 20:36:56 +01:00

smpboot.h

cpu/hotplug: Create hotplug threads

2016-03-01 20:36:56 +01:00

softirq.c

arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections

2016-03-25 16:37:42 -07:00

stacktrace.c

stacktrace: introduce snprint_stack_trace for buffer output

2014-12-13 12:42:48 -08:00

stop_machine.c

kernel/stop_machine.c: remove CONFIG_SMP dependencies

2016-01-16 11:17:24 -08:00

sys_ni.c

vfs: add copy_file_range syscall and vfs helper

2015-12-01 14:00:53 -05:00

sys.c

prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable

2016-05-23 17:04:14 -07:00

sysctl_binary.c

kernel/sysctl_binary.c: use generic UUID library

2016-05-20 17:58:30 -07:00

sysctl.c

Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2016-05-25 17:05:40 -07:00

task_work.c

task_work: remove fifo ordering guarantee

2015-09-05 13:46:58 -07:00

taskstats.c

taskstats: use the libnl API to align nlattr on 64-bit

2016-04-23 20:13:25 -04:00

test_kprobes.c

kernel/test_kprobes.c: use current logging functions

2014-08-08 15:57:18 -07:00

torture.c

rcutorture: Dump trace buffer upon shutdown

2016-04-21 13:47:04 -07:00

tracepoint.c

kernel/...: convert pr_warning to pr_warn

2016-03-22 15:36:02 -07:00

tsacct.c

time, acct: Drop irq save & restore from __acct_update_integrals()

2016-02-29 09:53:09 +01:00

uid16.c

groups: Consolidate the setgroups permission checks

2014-12-05 17:19:27 -06:00

up.c

…

user_namespace.c

fs: Limit file caps to the user namespace of the super block

2016-06-24 10:40:31 -05:00

user-return-notifier.c

scheduler: Replace __get_cpu_var with this_cpu_ptr

2014-08-26 13:45:45 -04:00

user.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2014-12-17 12:31:40 -08:00

utsname_sysctl.c

…

utsname.c

copy address of proc_ns_ops into ns_common

2014-12-04 14:34:47 -05:00

watchdog.c

watchdog: don't run proc_watchdog_update if new value is same as old

2016-03-17 15:09:34 -07:00

workqueue_internal.h

sched/core: Get rid of 'cpu' argument in wq_worker_sleeping()

2016-03-02 10:28:47 -05:00

workqueue.c

debugobjects: insulate non-fixup logic related to static obj from fixup callbacks

2016-05-19 19:12:14 -07:00