Commit 57f855235800de777677c73378dee1342b7f2b46
Committed by
Greg Kroah-Hartman
1 parent
4a7215f134
userns: Allow setting gid_maps without privilege when setgroups is disabled
commit 66d2f338ee4c449396b6f99f5e75cd18eb6df272 upstream. Now that setgroups can be disabled and not reenabled, setting gid_map without privielge can now be enabled when setgroups is disabled. This restores most of the functionality that was lost when unprivileged setting of gid_map was removed. Applications that use this functionality will need to check to see if they use setgroups or init_groups, and if they don't they can be fixed by simply disabling setgroups before writing to gid_map. Reviewed-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 5 additions and 0 deletions Side-by-side Diff
kernel/user_namespace.c
... | ... | @@ -826,6 +826,11 @@ |
826 | 826 | kuid_t uid = make_kuid(ns->parent, id); |
827 | 827 | if (uid_eq(uid, cred->euid)) |
828 | 828 | return true; |
829 | + } else if (cap_setid == CAP_SETGID) { | |
830 | + kgid_t gid = make_kgid(ns->parent, id); | |
831 | + if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) && | |
832 | + gid_eq(gid, cred->egid)) | |
833 | + return true; | |
829 | 834 | } |
830 | 835 | } |
831 | 836 |