From 0bf159413bdb9e324864a422b7aecb081e739119 Mon Sep 17 00:00:00 2001 From: Eric W. Biederman Date: Wed, 17 Dec 2014 17:06:03 -0600 Subject: unshare: Fix --map-root-user to work on new kernels In rare cases droping groups with setgroups(0, NULL) is an operation that can grant a user additional privileges. User namespaces were allwoing that operation to unprivileged users and that had to be fixed. Update unshare --map-root-user to disable the setgroups operation before setting the gid_map. This is needed as after the security fix gid_map is restricted to privileged users unless setgroups has been disabled. Signed-off-by: "Eric W. Biederman" --- sys-utils/unshare.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'sys-utils/unshare.c') diff --git a/sys-utils/unshare.c b/sys-utils/unshare.c index fccdba2f6..9fdce931f 100644 --- a/sys-utils/unshare.c +++ b/sys-utils/unshare.c @@ -39,6 +39,24 @@ #include "pathnames.h" #include "all-io.h" +static void disable_setgroups(void) +{ + const char *file = _PATH_PROC_SETGROUPS; + const char *deny = "deny"; + int fd; + + fd = open(file, O_WRONLY); + if (fd < 0) { + if (errno == ENOENT) + return; + err(EXIT_FAILURE, _("cannot open %s"), file); + } + + if (write_all(fd, deny, strlen(deny))) + err(EXIT_FAILURE, _("write failed %s"), file); + close(fd); +} + static void map_id(const char *file, uint32_t from, uint32_t to) { char *buf; @@ -181,6 +199,7 @@ int main(int argc, char *argv[]) } if (maproot) { + disable_setgroups(); map_id(_PATH_PROC_UIDMAP, 0, real_euid); map_id(_PATH_PROC_GIDMAP, 0, real_egid); } -- cgit v1.2.3-55-g7522