Eric W. Biederman a2b426267c
userns,pidns: Verify the userns for new pid namespaces ...
It is pointless and confusing to allow a pid namespace hierarchy and
the user namespace hierarchy to get out of sync. The owner of a child
pid namespace should be the owner of the parent pid namespace or
a descendant of the owner of the parent pid namespace.
Otherwise it is possible to construct scenarios where a process has a
capability over a parent pid namespace but does not have the
capability over a child pid namespace. Which confusingly makes
permission checks non-transitive.
It requires use of setns into a pid namespace (but not into a user
namespace) to create such a scenario.
Add the function in_userns to help in making this determination.
v2: Optimized in_userns by using level as suggested
by: Kirill Tkhai <ktkhai@virtuozzo.com >
Ref: 49f4d8b93cebiederm@xmission.com >
2017-07-20 07:43:58 -05:00
2017-07-09 18:48:37 -07:00
2017-07-07 17:26:24 +02:00
2017-07-07 17:25:19 +02:00
2017-07-07 12:40:27 -07:00
2017-07-12 10:04:56 -07:00
2017-07-13 15:58:02 -04:00
2017-07-11 09:55:47 -07:00
2017-07-13 12:07:44 -07:00
2017-07-12 16:26:05 -07:00
2017-07-10 16:32:31 -07:00
2017-07-06 11:38:59 -07:00
2017-07-13 13:56:24 -07:00
2017-07-05 12:31:59 -07:00
2017-07-10 15:23:45 -07:00
2017-07-04 22:35:16 +01:00
2017-07-12 16:26:05 -07:00
2017-07-10 16:32:34 -07:00
2017-07-06 16:24:33 -07:00
2017-07-10 10:51:53 -07:00
2017-07-10 16:32:34 -07:00
2017-07-10 16:32:34 -07:00
2017-07-14 12:37:41 -07:00
2017-07-06 20:57:13 -07:00
2017-07-06 16:24:29 -07:00
2017-07-06 16:24:29 -07:00
2017-07-05 11:46:59 -07:00
2017-07-14 13:12:32 -07:00
2017-07-12 16:26:00 -07:00
2017-07-10 16:32:31 -07:00
2017-07-15 12:00:42 -07:00
2017-07-07 09:44:06 -07:00
2017-07-07 09:49:24 +10:00
2017-07-06 07:02:24 -04:00
2017-07-12 16:26:01 -07:00
2017-07-10 16:32:35 -07:00
2017-07-06 16:24:30 -07:00
2017-07-15 12:00:42 -07:00
2017-07-09 09:31:22 -07:00
2017-07-07 20:09:10 -04:00
2017-07-12 13:32:46 +02:00
2017-07-12 16:26:03 -07:00
2017-07-10 11:11:25 +02:00
2017-07-10 16:32:31 -07:00
2017-07-15 12:00:42 -07:00
2017-07-08 21:51:43 +02:00
2017-07-05 09:54:15 +02:00
2017-07-10 16:32:34 -07:00
2017-07-09 10:24:46 -07:00
2017-07-10 10:51:53 -07:00
2017-07-12 16:26:01 -07:00
2017-07-04 12:46:16 +02:00
2017-07-12 16:25:59 -07:00
2017-07-12 16:26:00 -07:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:34 -07:00
2017-07-08 11:05:34 +02:00
2017-07-10 12:28:46 +02:00
2017-07-10 16:32:33 -07:00
2017-07-05 11:26:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:34 -07:00
2017-07-12 16:26:04 -07:00
2017-07-07 18:39:15 -07:00
2017-07-10 16:32:33 -07:00
2017-07-08 11:23:29 +01:00
2017-07-13 16:00:15 -04:00
2017-07-13 16:00:12 -04:00
2017-07-13 16:00:15 -04:00
2017-07-13 17:12:07 -04:00
2017-07-13 16:00:15 -04:00
2017-07-12 16:26:02 -07:00
2017-07-06 16:24:32 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 11:30:07 -04:00
2017-07-10 09:09:57 +03:00
2017-07-10 14:27:39 +02:00
2017-07-10 15:23:45 -07:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:31 -07:00
2017-07-07 19:38:17 -07:00
2017-07-07 13:41:28 -05:00
2017-07-08 15:51:57 -07:00
2017-07-05 12:31:59 -07:00
2017-07-15 12:44:02 -07:00
2017-07-12 23:11:23 +02:00
2017-07-14 15:05:13 -07:00
2017-07-12 16:26:01 -07:00
2017-07-06 16:24:30 -07:00
2017-07-06 20:57:13 -07:00
2017-07-05 12:31:59 -07:00
2017-07-12 16:26:03 -07:00
2017-07-06 16:24:30 -07:00
2017-07-15 12:00:42 -07:00
2017-07-06 16:24:31 -07:00
2017-07-10 16:32:33 -07:00
2017-07-10 16:32:30 -07:00
2017-07-13 12:38:49 -07:00
2017-07-06 20:57:13 -07:00
2017-07-08 10:15:02 -07:00
2017-07-10 07:40:49 -04:00
2017-07-20 07:43:58 -05:00
2017-07-05 17:09:27 -07:00
2017-07-13 12:23:54 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-05 09:54:14 +02:00
a2b426267c