From 9e4a36ece652908276bc4abb4324ec56292453e1 Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Wed, 16 Nov 2011 23:37:59 -0800 Subject: [PATCH] userns: Fail exec for suid and sgid binaries with ids outside our user namespace. Acked-by: Serge Hallyn Signed-off-by: Eric W. Biederman --- fs/exec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index 00ae2ef100d..e001bdfac53 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1291,8 +1291,11 @@ int prepare_binprm(struct linux_binprm *bprm) if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) { /* Set-uid? */ if (mode & S_ISUID) { + if (!kuid_has_mapping(bprm->cred->user_ns, inode->i_uid)) + return -EPERM; bprm->per_clear |= PER_CLEAR_ON_SETID; bprm->cred->euid = inode->i_uid; + } /* Set-gid? */ @@ -1302,6 +1305,8 @@ int prepare_binprm(struct linux_binprm *bprm) * executable. */ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { + if (!kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) + return -EPERM; bprm->per_clear |= PER_CLEAR_ON_SETID; bprm->cred->egid = inode->i_gid; }