userns: Check euid no fsuid when establishing an unprivileged uid mapping
authorEric W. Biederman <ebiederm@xmission.com>
Sat, 6 Dec 2014 00:26:30 +0000 (18:26 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Jan 2015 17:58:16 +0000 (09:58 -0800)
commitf028f2d73293b65a5e58ee7468a8683b39fd912c
tree15bd82f7fcdca663b9611b429a4be8a0e93d21c5
parentba0922adbd2ccffe444608298ae0506401eac4c3
userns: Check euid no fsuid when establishing an unprivileged uid mapping

commit 80dd00a23784b384ccea049bfb3f259d3f973b9d upstream.

setresuid allows the euid to be set to any of uid, euid, suid, and
fsuid.  Therefor it is safe to allow an unprivileged user to map
their euid and use CAP_SETUID privileged with exactly that uid,
as no new credentials can be obtained.

I can not find a combination of existing system calls that allows setting
uid, euid, suid, and fsuid from the fsuid making the previous use
of fsuid for allowing unprivileged mappings a bug.

This is part of a fix for CVE-2014-8989.

Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/user_namespace.c