Radoslaw Burny 5ec27ec735 fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. ... Normally, the inode's i_uid/i_gid are translated relative to s_user_ns, but this is not a correct behavior for proc. Since sysctl permission check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense to use these values in u_[ug]id of proc inodes. In other words: although uid/gid in the inode is not read during test_perm, the inode logically belongs to the root of the namespace. I have confirmed this with Eric Biederman at LPC and in this thread: https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com Consequences ============ Since the i_[ug]id values of proc nodes are not used for permissions checks, this change usually makes no functional difference. However, it causes an issue in a setup where: * a namespace container is created without root user in container - hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID * container creator tries to configure it by writing /proc/sys files, e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit Kernel does not allow to open an inode for writing if its i_[ug]id are invalid, making it impossible to write shmmax and thus - configure the container. Using a container with no root mapping is apparently rare, but we do use this configuration at Google. Also, we use a generic tool to configure the container limits, and the inability to write any of them causes a failure. History ======= The invalid uids/gids in inodes first appeared due to 8175435777 (fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns). However, AFAIK, this did not immediately cause any issues. The inability to write to these "invalid" inodes was only caused by a later commit 0bd23d09b8 (vfs: Don't modify inodes with a uid or gid unknown to the vfs). Tested: Used a repro program that creates a user namespace without any mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside. Before the change, it shows the overflow uid, with the change it's 0. The overflow uid indicates that the uid in the inode is not correct and thus it is not possible to open the file for writing. Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com Fixes: 0bd23d09b8 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs") Signed-off-by: Radoslaw Burny <rburny@google.com> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: "Eric W . Biederman" <ebiederm@xmission.com> Cc: Seth Forshee <seth.forshee@canonical.com> Cc: John Sperbeck <jsperbeck@google.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: <stable@vger.kernel.org> [4.8+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2019-07-16 19:23:21 -07:00
..
array.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-07-08 16:39:53 -07:00
base.c	oom: decouple mems_allowed from oom_unkillable_task	2019-07-12 11:05:47 -07:00
cmdline.c
consoles.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 191	2019-05-30 11:29:21 -07:00
cpuinfo.c
devices.c
fd.c
fd.h
generic.c
inode.c	fs/proc/inode.c: use typeof_member() macro	2019-07-16 19:23:21 -07:00
internal.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
interrupts.c
Kconfig	vmcore: add a kernel parameter novmcoredd	2019-07-16 19:23:21 -07:00
kcore.c
kmsg.c
loadavg.c
Makefile
meminfo.c	mm: vmalloc: show number of vmalloc pages in /proc/meminfo	2019-07-12 11:05:47 -07:00
namespaces.c
nommu.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
page.c
proc_net.c
proc_sysctl.c	fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.	2019-07-16 19:23:21 -07:00
proc_tty.c
root.c	fanotify: Disallow permission events for proc filesystem	2019-05-28 18:10:07 +02:00
self.c
softirqs.c
stat.c
task_mmu.c	HMM patches for 5.3	2019-07-14 19:42:11 -07:00
task_nommu.c	proc: use down_read_killable mmap_sem for /proc/pid/maps	2019-07-12 11:05:46 -07:00
thread_self.c
uptime.c
util.c
version.c
vmcore.c	vmcore: add a kernel parameter novmcoredd	2019-07-16 19:23:21 -07:00