userns: Convert capabilities related permsion checks

- Use uid_eq when comparing kuids
  Use gid_eq when comparing kgids
- Use make_kuid(user_ns, 0) to talk about the user_namespace root uid

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

diff --git a/fs/open.c b/fs/open.c
index 5720854156dbd61e28598da83a529294401eb119..92335f6635452ed7f8b0b21252d88762771fb33b 100644 (file)
--- a/fs/open.c
+++ b/fs/open.c
@@ -316,7 +316,8 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
 
        if (!issecure(SECURE_NO_SETUID_FIXUP)) {
                /* Clear the capabilities if we switch to a non-root user */
-               if (override_cred->uid)
+               kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
+               if (!uid_eq(override_cred->uid, root_uid))
                        cap_clear(override_cred->cap_effective);
                else
                        override_cred->cap_effective =

diff --git a/security/commoncap.c b/security/commoncap.c
index dbd465a5928676636bed47fa6ed2beb011b168ba..ff9b113bb07cdb9a32328aa6f4cd9c3f4a2d792e 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -472,19 +472,22 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
        struct cred *new = bprm->cred;
        bool effective, has_cap = false;
        int ret;
+       kuid_t root_uid;
 
        effective = false;
        ret = get_file_caps(bprm, &effective, &has_cap);
        if (ret < 0)
                return ret;
 
+       root_uid = make_kuid(new->user_ns, 0);
+
        if (!issecure(SECURE_NOROOT)) {
                /*
                 * If the legacy file capability is set, then don't set privs
                 * for a setuid root binary run by a non-root user.  Do set it
                 * for a root user just to cause least surprise to an admin.
                 */
-               if (has_cap && new->uid != 0 && new->euid == 0) {
+               if (has_cap && !uid_eq(new->uid, root_uid) && uid_eq(new->euid, root_uid)) {
                        warn_setuid_and_fcaps_mixed(bprm->filename);
                        goto skip;
                }
@@ -495,12 +498,12 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
                 *
                 * If only the real uid is 0, we do not set the effective bit.
                 */
-               if (new->euid == 0 || new->uid == 0) {
+               if (uid_eq(new->euid, root_uid) || uid_eq(new->uid, root_uid)) {
                        /* pP' = (cap_bset & ~0) | (pI & ~0) */
                        new->cap_permitted = cap_combine(old->cap_bset,
                                                         old->cap_inheritable);
                }
-               if (new->euid == 0)
+               if (uid_eq(new->euid, root_uid))
                        effective = true;
        }
 skip:
@@ -508,8 +511,8 @@ skip:
        /* Don't let someone trace a set[ug]id/setpcap binary with the revised
         * credentials unless they have the appropriate permit
         */
-       if ((new->euid != old->uid ||
-            new->egid != old->gid ||
+       if ((!uid_eq(new->euid, old->uid) ||
+            !gid_eq(new->egid, old->gid) ||
             !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
            bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                /* downgrade; they get no more than they had, and maybe less */
@@ -544,7 +547,7 @@ skip:
         */
        if (!cap_isclear(new->cap_effective)) {
                if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
-                   new->euid != 0 || new->uid != 0 ||
+                   !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
                    issecure(SECURE_NOROOT)) {
                        ret = audit_log_bprm_fcaps(bprm, new, old);
                        if (ret < 0)
@@ -569,16 +572,17 @@ skip:
 int cap_bprm_secureexec(struct linux_binprm *bprm)
 {
        const struct cred *cred = current_cred();
+       kuid_t root_uid = make_kuid(cred->user_ns, 0);
 
-       if (cred->uid != 0) {
+       if (!uid_eq(cred->uid, root_uid)) {
                if (bprm->cap_effective)
                        return 1;
                if (!cap_isclear(cred->cap_permitted))
                        return 1;
        }
 
-       return (cred->euid != cred->uid ||
-               cred->egid != cred->gid);
+       return (!uid_eq(cred->euid, cred->uid) ||
+               !gid_eq(cred->egid, cred->gid));
 }
 
 /**
@@ -668,15 +672,21 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
  */
 static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
 {
-       if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&
-           (new->uid != 0 && new->euid != 0 && new->suid != 0) &&
+       kuid_t root_uid = make_kuid(old->user_ns, 0);
+
+       if ((uid_eq(old->uid, root_uid) ||
+            uid_eq(old->euid, root_uid) ||
+            uid_eq(old->suid, root_uid)) &&
+           (!uid_eq(new->uid, root_uid) &&
+            !uid_eq(new->euid, root_uid) &&
+            !uid_eq(new->suid, root_uid)) &&
            !issecure(SECURE_KEEP_CAPS)) {
                cap_clear(new->cap_permitted);
                cap_clear(new->cap_effective);
        }
-       if (old->euid == 0 && new->euid != 0)
+       if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
                cap_clear(new->cap_effective);
-       if (old->euid != 0 && new->euid == 0)
+       if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
                new->cap_effective = new->cap_permitted;
 }
 
@@ -709,11 +719,12 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
                 *          if not, we might be a bit too harsh here.
                 */
                if (!issecure(SECURE_NO_SETUID_FIXUP)) {
-                       if (old->fsuid == 0 && new->fsuid != 0)
+                       kuid_t root_uid = make_kuid(old->user_ns, 0);
+                       if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
                                new->cap_effective =
                                        cap_drop_fs_set(new->cap_effective);
 
-                       if (old->fsuid != 0 && new->fsuid == 0)
+                       if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
                                new->cap_effective =
                                        cap_raise_fs_set(new->cap_effective,
                                                         new->cap_permitted);