lkml.org 
[lkml]   [2014]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] tty: Allow stealing of controlling ttys within user namespaces
    Date
    root is allowed to steal ttys from other sessions, but it
    requires system-wide CAP_SYS_ADMIN and therefore is not possible
    for root within a user namespace. This should be allowed so long
    as the process doing the stealing is privileged towards the
    session leader which currently owns the tty.

    Update the tty code to only require CAP_SYS_ADMIN in the
    namespace of the target session leader when stealing a tty. Fall
    back to using init_user_ns to preserve the existing behavior for
    system-wide root.

    Cc: stable@vger.kernel.org # 3.8+
    Cc: Serge Hallyn <serge.hallyn@canonical.com>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    ---
    drivers/tty/tty_io.c | 14 +++++++++++++-
    1 file changed, 13 insertions(+), 1 deletion(-)

    diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
    index c74a00a..1c47f16 100644
    --- a/drivers/tty/tty_io.c
    +++ b/drivers/tty/tty_io.c
    @@ -2410,7 +2410,19 @@ static int tiocsctty(struct tty_struct *tty, int arg)
    * This tty is already the controlling
    * tty for another session group!
    */
    - if (arg == 1 && capable(CAP_SYS_ADMIN)) {
    + struct user_namespace *ns = &init_user_ns;
    + struct task_struct *p;
    +
    + read_lock(&tasklist_lock);
    + do_each_pid_task(tty->session, PIDTYPE_SID, p) {
    + if (p->signal->leader) {
    + ns = task_cred_xxx(p, user_ns);
    + break;
    + }
    + } while_each_pid_task(tty->session, PIDTYPE_SID, p);
    + read_unlock(&tasklist_lock);
    +
    + if (arg == 1 && ns_capable(ns, CAP_SYS_ADMIN)) {
    /*
    * Steal it away
    */
    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-21 22:01    [W:6.399 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site