• Eric W. Biederman's avatar
    Revert "mqueue: switch to on-demand creation of internal mount" · cfb2f6f6
    Eric W. Biederman authored
    This reverts commit 36735a6a.
    
    Aleksa Sarai <asarai@suse.de> writes:
    > [REGRESSION v4.16-rc6] [PATCH] mqueue: forbid unprivileged user access to internal mount
    >
    > Felix reported weird behaviour on 4.16.0-rc6 with regards to mqueue[1],
    > which was introduced by 36735a6a ("mqueue: switch to on-demand
    > creation of internal mount").
    >
    > Basically, the reproducer boils down to being able to mount mqueue if
    > you create a new user namespace, even if you don't unshare the IPC
    > namespace.
    >
    > Previously this was not possible, and you would get an -EPERM. The mount
    > is the *host* mqueue mount, which is being cached and just returned from
    > mqueue_mount(). To be honest, I'm not sure if this is safe or not (or if
    > it was intentional -- since I'm not familiar with mqueue).
    >
    > To me it looks like there is a missing permission check. I've included a
    > patch below that I've compile-tested, and should block the above case.
    > Can someone please tell me if I'm missing something? Is this actually
    > safe?
    >
    > [1]: https://github.com/docker/docker/issues/36674
    
    The issue is a lot deeper than a missing permission check.  sb->s_user_ns
    was is improperly set as well.  So in addition to the filesystem being
    mounted when it should not be mounted, so things are not allow that should
    be.
    
    We are practically to the release of 4.16 and there is no agreement between
    Al Viro and myself on what the code should looks like to fix things properly.
    So revert the code to what it was before so that we can take our time
    and discuss this properly.
    
    Fixes: 36735a6a ("mqueue: switch to on-demand creation of internal mount")
    Reported-by: default avatarFelix Abecassis <fabecassis@nvidia.com>
    Reported-by: default avatarAleksa Sarai <asarai@suse.de>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    cfb2f6f6
mqueue.c 39 KB