Tejun Heo 43fa0b3639 cgroup: Use open-time cgroup namespace for process migration perm checks ... commit e574576416 upstream. cgroup process migration permission checks are performed at write time as whether a given operation is allowed or not is dependent on the content of the write - the PID. This currently uses current's cgroup namespace which is a potential security weakness as it may allow scenarios where a less privileged process tricks a more privileged one into writing into a fd that it created. This patch makes cgroup remember the cgroup namespace at the time of open and uses it for migration permission checks instad of current's. Note that this only applies to cgroup2 as cgroup1 doesn't have namespace support. This also fixes a use-after-free bug on cgroupns reported in https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Note that backporting this fix also requires the preceding patch. Reported-by: "Eric W. Biederman" <ebiederm@xmission.com> Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> Cc: Michal Koutný <mkoutny@suse.com> Cc: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Michal Koutný <mkoutny@suse.com> Reported-by: syzbot+50f5cf33a284ce738b62@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Fixes: 5136f6365c ("cgroup: implement "nsdelegate" mount option") Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-11 15:35:15 +01:00
..
bpf	bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg	2021-12-22 09:32:35 +01:00
cgroup	cgroup: Use open-time cgroup namespace for process migration perm checks	2022-01-11 15:35:15 +01:00
configs	drivers/char: remove /dev/kmem for good	2021-05-07 00:26:34 -07:00
debug	kdb: Adopt scheduler's task classification	2021-11-18 19:17:06 +01:00
dma	dma-mapping fixes for Linux 5.15	2021-10-20 10:16:51 -10:00
entry	signal: Replace force_fatal_sig with force_exit_sig when in doubt	2021-11-25 09:49:07 +01:00
events	perf: Ignore sigtrap for tracepoints destined for other tasks	2021-12-01 09:04:54 +01:00
gcov	Kconfig: Introduce ARCH_WANTS_NO_INSTR and CC_HAS_NO_PROFILE_FN_ATTR	2021-06-22 11:07:18 -07:00
irq	PCI/MSI: Move non-mask check back into low level accessors	2021-11-18 19:17:14 +01:00
kcsan	LKMM updates:	2021-09-02 13:00:15 -07:00
livepatch	livepatch: Replace deprecated CPU-hotplug functions.	2021-08-19 12:00:24 +02:00
locking	locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()	2021-12-22 09:32:48 +01:00
power	PM: hibernate: use correct mode for swsusp_close()	2021-12-01 09:04:51 +01:00
printk	printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces	2021-11-25 09:48:45 +01:00
rcu	rcu: Mark accesses to rcu_state.n_force_qs	2021-12-22 09:32:51 +01:00
sched	wait: add wake_up_pollfree()	2021-12-14 10:57:15 +01:00
time	timekeeping: Really make sure wall_to_monotonic isn't positive	2021-12-22 09:32:48 +01:00
trace	tracing: Tag trace_percpu_buffer as a percpu pointer	2022-01-11 15:35:12 +01:00
.gitignore	.gitignore: prefix local generated files with a slash	2021-05-02 00:43:35 +09:00
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	locking/rwlock: Provide RT variant	2021-08-17 17:50:51 +02:00
Kconfig.preempt	sched/core: Disable CONFIG_SCHED_CORE by default	2021-06-28 22:43:05 +02:00
Makefile	kbuild: update config_data.gz only when the content of .config is changed	2021-05-02 00:43:35 +09:00
acct.c	kernel/acct.c: use dedicated helper to access rlimit values	2021-09-08 11:50:26 -07:00
async.c	kernel/async.c: remove async_unregister_domain()	2021-05-07 00:26:33 -07:00
audit.c	audit: improve robustness of the audit queue handling	2021-12-22 09:32:36 +01:00
audit.h	audit: add header protection to kernel/audit.h	2021-07-19 22:38:24 -04:00
audit_fsnotify.c	audit_alloc_mark(): don't open-code ERR_CAST()	2021-02-23 10:25:27 -05:00
audit_tree.c	audit: move put_tree() to avoid trim_trees refcount underflow and UAF	2021-08-24 18:52:36 -04:00
audit_watch.c	fsnotify: generalize handle_inode_event()	2020-12-03 14:58:35 +01:00
auditfilter.c	lsm: separate security_task_getsecid() into subjective and objective variants	2021-03-22 15:23:32 -04:00
auditsc.c	audit: fix possible null-pointer dereference in audit_filter_rules	2021-10-18 18:27:47 -04:00
backtracetest.c	…
bounds.c	…
capability.c	capability: handle idmapped mounts	2021-01-24 14:27:16 +01:00
cfi.c	cfi: Use rcu_read_{un}lock_sched_notrace	2021-08-11 13:11:12 -07:00
compat.c	arch: remove compat_alloc_user_space	2021-09-08 15:32:35 -07:00
configs.c	…
context_tracking.c	…
cpu.c	sched/scs: Reset task stack state in bringup_cpu()	2021-12-01 09:04:54 +01:00
cpu_pm.c	PM: cpu: Make notifier chain use a raw_spinlock_t	2021-08-16 18:55:32 +02:00
crash_core.c	kernel/crash_core: suppress unknown crashkernel parameter warning	2021-12-29 12:28:49 +01:00
crash_dump.c	…
cred.c	ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring	2021-10-20 10:34:20 -05:00
delayacct.c	delayacct: Add sysctl to enable at runtime	2021-05-12 11:43:25 +02:00
dma.c	…
exec_domain.c	…
exit.c	io_uring: remove files pointer in cancellation functions	2021-08-23 13:10:37 -06:00
extable.c	…
fail_function.c	fault-injection: handle EI_ETYPE_TRUE	2020-12-15 22:46:19 -08:00
fork.c	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()	2021-11-18 19:17:14 +01:00
freezer.c	sched: Add get_current_state()	2021-06-18 11:43:08 +02:00
futex.c	futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic()	2021-09-03 23:00:22 +02:00
gen_kheaders.sh	kbuild: clean up ${quiet} checks in shell scripts	2021-05-27 04:01:50 +09:00
groups.c	groups: simplify struct group_info allocation	2021-02-26 09:41:03 -08:00
hung_task.c	Merge branch 'akpm' (patches from Andrew)	2021-07-02 12:08:10 -07:00
iomem.c	…
irq_work.c	irq_work: Make irq_work_queue() NMI-safe again	2021-06-10 10:00:08 +02:00
jump_label.c	jump_label: Fix jump_label_text_reserved() vs __init	2021-07-05 10:46:20 +02:00
kallsyms.c	module: add printk formats to add module build ID to stacktraces	2021-07-08 11:48:22 -07:00
kcmp.c	Merge branch 'exec-update-lock-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-12-15 19:36:48 -08:00
kcov.c	…
kexec.c	kexec: avoid compat_alloc_user_space	2021-09-08 15:32:34 -07:00
kexec_core.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
kexec_elf.c	…
kexec_file.c	kernel: kexec_file: fix error return code of kexec_calculate_store_digests()	2021-05-07 00:26:32 -07:00
kexec_internal.h	kexec: move machine_kexec_post_load() to public interface	2021-02-22 12:33:26 +00:00
kheaders.c	…
kmod.c	modules: add CONFIG_MODPROBE_PATH	2021-05-07 00:26:33 -07:00
kprobes.c	kprobes: Limit max data_size of the kretprobe instances	2021-12-08 09:04:41 +01:00
ksysfs.c	…
kthread.c	Merge branch 'akpm' (patches from Andrew)	2021-06-29 17:29:11 -07:00
latencytop.c	…
module-internal.h	…
module.c	module: fix clang CFI with MODULE_UNLOAD=n	2021-09-28 12:56:26 +02:00
module_signature.c	module: harden ELF info handling	2021-01-19 10:24:45 +01:00
module_signing.c	module: harden ELF info handling	2021-01-19 10:24:45 +01:00
notifier.c	notifier: Remove atomic_notifier_call_chain_robust()	2021-08-16 18:55:32 +02:00
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	padata: Remove repeated verbose license text	2021-08-27 16:30:18 +08:00
panic.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
params.c	params: lift param_set_uint_minmax to common code	2021-08-16 14:42:22 +02:00
pid.c	kernel/pid.c: implement additional checks upon pidfd_create() parameters	2021-08-10 12:53:07 +02:00
pid_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
profile.c	profiling: fix shift-out-of-bounds bugs	2021-09-08 11:50:26 -07:00
ptrace.c	sched: Change task_struct::state	2021-06-18 11:43:09 +02:00
range.c	…
reboot.c	reboot: Add hardware protection power-off	2021-06-21 13:08:36 +01:00
regset.c	…
relay.c	relay: allow the use of const callback structs	2020-12-15 22:46:18 -08:00
resource.c	kernel/resource: fix return code check in __request_free_mem_region	2021-05-14 19:41:32 -07:00
resource_kunit.c	resource: provide meaningful MODULE_LICENSE() in test suite	2020-11-25 18:52:35 +01:00
rseq.c	KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest	2021-09-22 10:24:01 -04:00
scftorture.c	scftorture: Avoid NULL pointer exception on early exit	2021-07-27 11:39:30 -07:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-11-18 19:16:29 +01:00
seccomp.c	Merge branch 'exit-cleanups-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-09-01 14:52:05 -07:00
signal.c	signal: Replace force_fatal_sig with force_exit_sig when in doubt	2021-11-25 09:49:07 +01:00
smp.c	smp: Fix all kernel-doc warnings	2021-08-11 14:47:16 +02:00
smpboot.c	smpboot: Replace deprecated CPU-hotplug functions.	2021-08-10 14:57:42 +02:00
smpboot.h	…
softirq.c	genirq: Change force_irqthreads to a static key	2021-08-10 22:50:07 +02:00
stackleak.c	…
stacktrace.c	…
static_call.c	static_call: Fix static_call_text_reserved() vs __init	2021-07-05 10:46:33 +02:00
stop_machine.c	stop_machine: Add caller debug info to queue_stop_cpus_work	2021-03-23 16:01:58 +01:00
sys.c	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
sys_ni.c	compat: remove some compat entry points	2021-09-08 15:32:35 -07:00
sysctl-test.c	kernel/sysctl-test: Remove some casts which are no-longer required	2021-06-23 16:41:24 -06:00
sysctl.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
task_work.c	kasan: record task_work_add() call stack	2021-04-30 11:20:42 -07:00
taskstats.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
test_kprobes.c	…
torture.c	torture: Replace deprecated CPU-hotplug functions.	2021-08-10 10:48:07 -07:00
tracepoint.c	tracepoint: Fix kerneldoc comments	2021-08-16 11:39:51 -04:00
tsacct.c	…
ucount.c	ucounts: Fix rlimit max values check	2021-12-29 12:28:39 +01:00
uid16.c	…
uid16.h	…
umh.c	kernel/umh.c: fix some spelling mistakes	2021-05-07 00:26:34 -07:00
up.c	A set of locking related fixes and updates:	2021-05-09 13:07:03 -07:00
user-return-notifier.c	…
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
user_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
usermode_driver.c	Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2021-07-03 11:41:14 -07:00
utsname.c	…
utsname_sysctl.c	…
watch_queue.c	watch_queue: rectify kernel-doc for init_watch()	2021-01-26 11:16:34 +00:00
watchdog.c	kernel: watchdog: modify the explanation related to watchdog thread	2021-06-29 10:53:46 -07:00
watchdog_hld.c	…
workqueue.c	workqueue: make sysfs of unbound kworker cpumask more clever	2021-11-18 19:16:17 +01:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00