projects
/
GitHub
/
mt8127
/
android_kernel_alcatel_ttab.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
userns: limit the maximum depth of user_namespace->parent chain
[GitHub/mt8127/android_kernel_alcatel_ttab.git]
/
kernel
/
user_namespace.c
diff --git
a/kernel/user_namespace.c
b/kernel/user_namespace.c
index d8c30db06c5b75456098fe2f1a26785e9a9110ee..9064b919a4066fe9fca676581479e9162de56717 100644
(file)
--- a/
kernel/user_namespace.c
+++ b/
kernel/user_namespace.c
@@
-62,6
+62,9
@@
int create_user_ns(struct cred *new)
kgid_t group = new->egid;
int ret;
kgid_t group = new->egid;
int ret;
+ if (parent_ns->level > 32)
+ return -EUSERS;
+
/*
* Verify that we can not violate the policy of which files
* may be accessed that is specified by the root directory,
/*
* Verify that we can not violate the policy of which files
* may be accessed that is specified by the root directory,
@@
-92,6
+95,7
@@
int create_user_ns(struct cred *new)
atomic_set(&ns->count, 1);
/* Leave the new->user_ns reference with the new user namespace. */
ns->parent = parent_ns;
atomic_set(&ns->count, 1);
/* Leave the new->user_ns reference with the new user namespace. */
ns->parent = parent_ns;
+ ns->level = parent_ns->level + 1;
ns->owner = owner;
ns->group = group;
ns->owner = owner;
ns->group = group;
@@
-105,16
+109,21
@@
int create_user_ns(struct cred *new)
int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
{
struct cred *cred;
int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
{
struct cred *cred;
+ int err = -ENOMEM;
if (!(unshare_flags & CLONE_NEWUSER))
return 0;
cred = prepare_creds();
if (!(unshare_flags & CLONE_NEWUSER))
return 0;
cred = prepare_creds();
- if (!cred)
- return -ENOMEM;
+ if (cred) {
+ err = create_user_ns(cred);
+ if (err)
+ put_cred(cred);
+ else
+ *new_cred = cred;
+ }
- *new_cred = cred;
- return create_user_ns(cred);
+ return err;
}
void free_user_ns(struct user_namespace *ns)
}
void free_user_ns(struct user_namespace *ns)