Eric W. Biederman 12c641ab82 unshare: Unsharing a thread does not require unsharing a vm ... In the logic in the initial commit of unshare made creating a new thread group for a process, contingent upon creating a new memory address space for that process. That is wrong. Two separate processes in different thread groups can share a memory address space and clone allows creation of such proceses. This is significant because it was observed that mm_users > 1 does not mean that a process is multi-threaded, as reading /proc/PID/maps temporarily increments mm_users, which allows other processes to (accidentally) interfere with unshare() calls. Correct the check in check_unshare_flags() to test for !thread_group_empty() for CLONE_THREAD, CLONE_SIGHAND, and CLONE_VM. For sighand->count > 1 for CLONE_SIGHAND and CLONE_VM. For !current_is_single_threaded instead of mm_users > 1 for CLONE_VM. By using the correct checks in unshare this removes the possibility of an accidental denial of service attack. Additionally using the correct checks in unshare ensures that only an explicit unshare(CLONE_VM) can possibly trigger the slow path of current_is_single_threaded(). As an explict unshare(CLONE_VM) is pointless it is not expected there are many applications that make that call. Cc: stable@vger.kernel.org Fixes: b2e0d98705 userns: Implement unshare of the user namespace Reported-by: Ricky Zhou <rickyz@chromium.org> Reported-by: Kees Cook <keescook@chromium.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2015-08-12 14:54:26 -05:00
..
bpf	bpf: allow networking programs to use bpf_trace_printk() for debugging	2015-06-15 15:53:50 -07:00
configs	kconfig: add xenconfig defconfig helper	2015-06-16 11:04:29 +01:00
debug	…
events	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-07-04 19:36:06 -07:00
gcov	gcov: add support for GCC 5.1	2015-06-30 19:44:57 -07:00
irq	Merge branch 'irq/for-x86' into irq/core	2015-06-20 19:14:31 +02:00
livepatch	Merge branches 'for-4.1/upstream-fixes', 'for-4.2/kaslr' and 'for-4.2/upstream' into for-linus	2015-06-22 16:26:56 +02:00
locking	Merge branch 'sched-hrtimers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-06-24 15:09:40 -07:00
power	Power management and ACPI fixes for v4.2-rc1	2015-07-01 14:17:44 -07:00
printk	printk: improve the description of /dev/kmsg line format	2015-06-30 19:44:59 -07:00
rcu	This patch series contains several clean ups and even a new trace clock	2015-06-26 14:02:43 -07:00
sched	Except for the preempt notifiers fix, these are all small bugfixes	2015-07-04 11:29:59 -07:00
time	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-07-01 15:44:18 -07:00
trace	This patch series contains several clean ups and even a new trace clock	2015-06-26 14:02:43 -07:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	locking/qrwlock: Rename QUEUE_RWLOCK to QUEUED_RWLOCKS	2015-05-12 09:46:00 +02:00
Kconfig.preempt	…
Makefile	make certificate list change message more useful	2015-07-02 16:42:13 -07:00
acct.c	acct: check FMODE_CAN_WRITE	2015-04-11 22:27:55 -04:00
async.c	…
audit.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-06-27 13:53:16 -07:00
audit.h	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
audit_tree.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-04-26 17:22:07 -07:00
audit_watch.c	VFS: audit: d_backing_inode() annotations	2015-04-15 15:06:55 -04:00
auditfilter.c	…
auditsc.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-06-27 13:53:16 -07:00
backtracetest.c	…
bounds.c	…
capability.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
cgroup.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2015-07-03 15:20:57 -07:00
cgroup_freezer.c	…
compat.c	compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap()	2015-06-04 23:57:18 +02:00
configs.c	…
context_tracking.c	context_tracking: Inherit TIF_NOHZ through forks instead of context switches	2015-05-07 12:02:51 +02:00
cpu.c	cpu: Remove new instance of __cpuinit that crept back in	2015-05-27 12:58:39 -07:00
cpu_pm.c	…
cpuset.c	kernel, cpuset: remove exception for __GFP_THISNODE	2015-04-14 16:49:03 -07:00
crash_dump.c	…
cred.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
delayacct.c	…
dma.c	…
elfcore.c	…
exec_domain.c	Remove rest of exec domains.	2015-04-12 21:03:31 +02:00
exit.c	exit,stats: /* obey this comment */	2015-06-25 17:00:43 -07:00
extable.c	…
fork.c	unshare: Unsharing a thread does not require unsharing a vm	2015-08-12 14:54:26 -05:00
freezer.c	…
futex.c	Merge branch 'sched-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-06-24 14:46:01 -07:00
futex_compat.c	…
groups.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
hung_task.c	kernel/hung_task.c: change hung_task.c to use for_each_process_thread()	2015-04-15 16:35:22 -07:00
irq_work.c	…
jump_label.c	module, jump_label: Fix module locking	2015-05-27 11:09:50 +09:30
kallsyms.c	…
kcmp.c	…
kexec.c	kernel/panic/kexec: fix "crash_kexec_post_notifiers" option issue in oops path	2015-06-30 19:44:57 -07:00
kmod.c	…
kprobes.c	…
ksysfs.c	…
kthread.c	…
latencytop.c	…
module-internal.h	…
module.c	Minor merge needed, due to function move.	2015-07-01 10:49:25 -07:00
module_signing.c	…
notifier.c	…
nsproxy.c	…
padata.c	…
panic.c	kernel/panic/kexec: fix "crash_kexec_post_notifiers" option issue in oops path	2015-06-30 19:44:57 -07:00
params.c	Minor merge needed, due to function move.	2015-07-01 10:49:25 -07:00
pid.c	fork: report pid reservation failure properly	2015-04-17 09:04:06 -04:00
pid_namespace.c	…
profile.c	…
ptrace.c	ptrace: ptrace_detach() can no longer race with SIGKILL	2015-04-17 09:04:06 -04:00
range.c	…
reboot.c	kernel/reboot.c: add orderly_reboot for graceful reboot	2015-04-15 16:35:23 -07:00
relay.c	kernel/relay.c: use kvfree() in relay_free_page_array()	2015-06-30 19:44:59 -07:00
resource.c	kernel/resource.c: remove deprecated __check_region() and friends	2015-04-15 16:35:22 -07:00
seccomp.c	seccomp, filter: add and use bpf_prog_create_from_user from seccomp	2015-05-09 17:35:05 -04:00
signal.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2015-06-27 13:26:03 -07:00
smp.c	smp: Fix error case handling in smp_call_function_*()	2015-04-19 13:19:23 -07:00
smpboot.c	watchdog: add watchdog_cpumask sysctl to assist nohz	2015-06-24 17:49:40 -07:00
smpboot.h	…
softirq.c	…
stacktrace.c	…
stop_machine.c	sched/stop_machine: Fix deadlock between multiple stop_two_cpus()	2015-06-19 10:03:12 +02:00
sys.c	vfs: Commit to never having exectuables on proc and sysfs.	2015-07-10 10:39:25 -05:00
sys_ni.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
sysctl.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2015-07-03 15:20:57 -07:00
sysctl_binary.c	…
system_certificates.S	…
system_keyring.c	…
task_work.c	…
taskstats.c	…
test_kprobes.c	…
torture.c	rcu: Convert ACCESS_ONCE() to READ_ONCE() and WRITE_ONCE()	2015-05-27 12:56:15 -07:00
tracepoint.c	…
tsacct.c	…
uid16.c	…
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	…
utsname.c	…
utsname_sysctl.c	…
watchdog.c	watchdog: add watchdog_cpumask sysctl to assist nohz	2015-06-24 17:49:40 -07:00
workqueue.c	Minor merge needed, due to function move.	2015-07-01 10:49:25 -07:00
workqueue_internal.h	…