| From d661684cf6820331feae71146c35da83d794467e Mon Sep 17 00:00:00 2001 |
| From: Andy Lutomirski <luto@amacapital.net> |
| Date: Thu, 22 Aug 2013 11:39:15 -0700 |
| Subject: net: Check the correct namespace when spoofing pid over SCM_RIGHTS |
| |
| From: Andy Lutomirski <luto@amacapital.net> |
| |
| commit d661684cf6820331feae71146c35da83d794467e upstream. |
| |
| This is a security bug. |
| |
| The follow-up will fix nsproxy to discourage this type of issue from |
| happening again. |
| |
| Signed-off-by: Andy Lutomirski <luto@amacapital.net> |
| Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/core/scm.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/core/scm.c |
| +++ b/net/core/scm.c |
| @@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(st |
| return -EINVAL; |
| |
| if ((creds->pid == task_tgid_vnr(current) || |
| - ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) && |
| + ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && |
| ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) || |
| uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) && |
| ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) || |
