5.6.14-2 (clr 5.6.14-955) Add sysctl and CONFIG to disallow unprivileged CLONE_NEWUSER
This commit is contained in:
Josip Ponjavic
parent
0c0fe1e933
commit
38158a2f50
3 changed files with 143 additions and 3 deletions
4
.SRCINFO
4
.SRCINFO
|
|
@ -1,7 +1,7 @@
|
|||
pkgbase = linux-clear
|
||||
pkgdesc = Clear Linux
|
||||
pkgver = 5.6.14
|
||||
pkgrel = 1
|
||||
pkgrel = 2
|
||||
url = https://github.com/clearlinux-pkgs/linux
|
||||
arch = x86_64
|
||||
license = GPL2
|
||||
|
|
@ -18,6 +18,7 @@ pkgbase = linux-clear
|
|||
source = clearlinux::git+https://github.com/clearlinux-pkgs/linux.git#tag=5.6.14-955
|
||||
source = enable_additional_cpu_optimizations_for_gcc_v10.1+_kernel_v5.4-5.6_v1.patch
|
||||
source = pci-enable-overrides-for-missing-acs-capabilities.patch
|
||||
source = 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
|
||||
validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
|
||||
validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
|
||||
sha256sums = e342b04a2aa63808ea0ef1baab28fc520bd031ef8cf93d9ee4a31d4058fcb622
|
||||
|
|
@ -26,6 +27,7 @@ pkgbase = linux-clear
|
|||
sha256sums = SKIP
|
||||
sha256sums = c650fc6ff773e99dbc1fda9411b10b06513c5161791106c44d5a11dbcf6420f9
|
||||
sha256sums = 2c98de0814366b041aeee4cbf82b82620c7834bc33752d50f089e8bd7ea5cf5e
|
||||
sha256sums = bdd05caf94135898bceac0a9d14ec6b1b458dba162d00efd46a292fe97f2679b
|
||||
|
||||
pkgname = linux-clear
|
||||
pkgdesc = The Clear Linux kernel and modules
|
||||
|
|
|
|||
132
0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
Normal file
132
0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
From f4b254de5d2b75143dd7c225e58afb3f5ee3bae6 Mon Sep 17 00:00:00 2001
|
||||
From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
|
||||
Date: Mon, 16 Sep 2019 04:53:20 +0200
|
||||
Subject: [PATCH] ZEN: Add sysctl and CONFIG to disallow unprivileged
|
||||
CLONE_NEWUSER
|
||||
|
||||
Our default behavior continues to match the vanilla kernel.
|
||||
---
|
||||
init/Kconfig | 16 ++++++++++++++++
|
||||
kernel/fork.c | 15 +++++++++++++++
|
||||
kernel/sysctl.c | 12 ++++++++++++
|
||||
kernel/user_namespace.c | 7 +++++++
|
||||
4 files changed, 50 insertions(+)
|
||||
|
||||
diff --git a/init/Kconfig b/init/Kconfig
|
||||
index 6db3e310a5e4..2dd7dd1b6b0d 100644
|
||||
--- a/init/Kconfig
|
||||
+++ b/init/Kconfig
|
||||
@@ -1083,6 +1083,22 @@ config USER_NS
|
||||
|
||||
If unsure, say N.
|
||||
|
||||
+config USER_NS_UNPRIVILEGED
|
||||
+ bool "Allow unprivileged users to create namespaces"
|
||||
+ default y
|
||||
+ depends on USER_NS
|
||||
+ help
|
||||
+ When disabled, unprivileged users will not be able to create
|
||||
+ new namespaces. Allowing users to create their own namespaces
|
||||
+ has been part of several recent local privilege escalation
|
||||
+ exploits, so if you need user namespaces but are
|
||||
+ paranoid^Wsecurity-conscious you want to disable this.
|
||||
+
|
||||
+ This setting can be overridden at runtime via the
|
||||
+ kernel.unprivileged_userns_clone sysctl.
|
||||
+
|
||||
+ If unsure, say Y.
|
||||
+
|
||||
config PID_NS
|
||||
bool "PID Namespaces"
|
||||
default y
|
||||
diff --git a/kernel/fork.c b/kernel/fork.c
|
||||
index 9180f4416dba..a02f83b1d9b4 100644
|
||||
--- a/kernel/fork.c
|
||||
+++ b/kernel/fork.c
|
||||
@@ -106,6 +106,11 @@
|
||||
|
||||
#define CREATE_TRACE_POINTS
|
||||
#include <trace/events/task.h>
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+extern int unprivileged_userns_clone;
|
||||
+#else
|
||||
+#define unprivileged_userns_clone 0
|
||||
+#endif
|
||||
|
||||
/*
|
||||
* Minimum number of threads to boot the kernel
|
||||
@@ -1779,6 +1784,10 @@ static __latent_entropy struct task_struct *copy_process(
|
||||
if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
|
||||
+ if (!capable(CAP_SYS_ADMIN))
|
||||
+ return ERR_PTR(-EPERM);
|
||||
+
|
||||
/*
|
||||
* Thread groups must share signals as well, and detached threads
|
||||
* can only be started up within the thread group.
|
||||
@@ -2837,6 +2846,12 @@ int ksys_unshare(unsigned long unshare_flags)
|
||||
if (unshare_flags & CLONE_NEWNS)
|
||||
unshare_flags |= CLONE_FS;
|
||||
|
||||
+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
|
||||
+ err = -EPERM;
|
||||
+ if (!capable(CAP_SYS_ADMIN))
|
||||
+ goto bad_unshare_out;
|
||||
+ }
|
||||
+
|
||||
err = check_unshare_flags(unshare_flags);
|
||||
if (err)
|
||||
goto bad_unshare_out;
|
||||
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
|
||||
index 70665934d53e..9797869ed829 100644
|
||||
--- a/kernel/sysctl.c
|
||||
+++ b/kernel/sysctl.c
|
||||
@@ -110,6 +110,9 @@ extern int core_uses_pid;
|
||||
extern char core_pattern[];
|
||||
extern unsigned int core_pipe_limit;
|
||||
#endif
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+extern int unprivileged_userns_clone;
|
||||
+#endif
|
||||
extern int pid_max;
|
||||
extern int pid_max_min, pid_max_max;
|
||||
extern int percpu_pagelist_fraction;
|
||||
@@ -546,6 +549,15 @@ static struct ctl_table kern_table[] = {
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
#endif
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+ {
|
||||
+ .procname = "unprivileged_userns_clone",
|
||||
+ .data = &unprivileged_userns_clone,
|
||||
+ .maxlen = sizeof(int),
|
||||
+ .mode = 0644,
|
||||
+ .proc_handler = proc_dointvec,
|
||||
+ },
|
||||
+#endif
|
||||
#ifdef CONFIG_PROC_SYSCTL
|
||||
{
|
||||
.procname = "tainted",
|
||||
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
|
||||
index 8eadadc478f9..c36ecd19562c 100644
|
||||
--- a/kernel/user_namespace.c
|
||||
+++ b/kernel/user_namespace.c
|
||||
@@ -21,6 +21,13 @@
|
||||
#include <linux/bsearch.h>
|
||||
#include <linux/sort.h>
|
||||
|
||||
+/* sysctl */
|
||||
+#ifdef CONFIG_USER_NS_UNPRIVILEGED
|
||||
+int unprivileged_userns_clone = 1;
|
||||
+#else
|
||||
+int unprivileged_userns_clone;
|
||||
+#endif
|
||||
+
|
||||
static struct kmem_cache *user_ns_cachep __read_mostly;
|
||||
static DEFINE_MUTEX(userns_state_mutex);
|
||||
|
||||
--
|
||||
2.26.2
|
||||
|
||||
10
PKGBUILD
10
PKGBUILD
|
|
@ -71,7 +71,7 @@ _srcname=linux-${_major}
|
|||
_clr=${_major}.14-955
|
||||
pkgbase=linux-clear
|
||||
pkgver=${_major}.${_minor}
|
||||
pkgrel=1
|
||||
pkgrel=2
|
||||
pkgdesc='Clear Linux'
|
||||
arch=('x86_64')
|
||||
url="https://github.com/clearlinux-pkgs/linux"
|
||||
|
|
@ -85,6 +85,7 @@ source=(
|
|||
"clearlinux::git+https://github.com/clearlinux-pkgs/linux.git#tag=${_clr}"
|
||||
'enable_additional_cpu_optimizations_for_gcc_v10.1+_kernel_v5.4-5.6_v1.patch'
|
||||
'pci-enable-overrides-for-missing-acs-capabilities.patch'
|
||||
'0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch'
|
||||
)
|
||||
|
||||
export KBUILD_BUILD_HOST=archlinux
|
||||
|
|
@ -115,6 +116,10 @@ prepare() {
|
|||
echo "Applying pci-enable-overrides-for-missing-acs-capabilities.patch ..."
|
||||
patch -Np1 -i "$srcdir/pci-enable-overrides-for-missing-acs-capabilities.patch"
|
||||
|
||||
### disable USER_NS for non-root users by default
|
||||
echo "Applying 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch ..."
|
||||
patch -Np1 -i "$srcdir/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch"
|
||||
|
||||
### Setting config
|
||||
echo "Setting config..."
|
||||
cp -Tf $srcdir/clearlinux/config ./.config
|
||||
|
|
@ -345,7 +350,8 @@ sha256sums=('e342b04a2aa63808ea0ef1baab28fc520bd031ef8cf93d9ee4a31d4058fcb622'
|
|||
'07e737cfdc79382dc259c4844a150d8d72ebbcdc9d7e03a9503f8f8e19f1aea4'
|
||||
'SKIP'
|
||||
'c650fc6ff773e99dbc1fda9411b10b06513c5161791106c44d5a11dbcf6420f9'
|
||||
'2c98de0814366b041aeee4cbf82b82620c7834bc33752d50f089e8bd7ea5cf5e')
|
||||
'2c98de0814366b041aeee4cbf82b82620c7834bc33752d50f089e8bd7ea5cf5e'
|
||||
'bdd05caf94135898bceac0a9d14ec6b1b458dba162d00efd46a292fe97f2679b')
|
||||
|
||||
validpgpkeys=(
|
||||
'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds
|
||||
|
|
|
|||
Reference in a new issue