1 files changed, 41 insertions, 27 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index 71a166a05975..e771cb1b2d79 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -77,12 +77,12 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
                 int cap, int audit)
 {
         for (;;) {
-                /* The creator of the user namespace has all caps. */
-                if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)
+                /* The owner of the user namespace has all caps. */
+                if (targ_ns != &init_user_ns && uid_eq(targ_ns->owner, cred->euid))
                         return 0;
 
                 /* Do we have the necessary capabilities? */
-                if (targ_ns == cred->user->user_ns)
+                if (targ_ns == cred->user_ns)
                         return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
 
                 /* Have we tried all of the parent namespaces? */
@@ -93,7 +93,7 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
                  *If you have a capability in a parent user ns, then you have
                  * it over all children user namespaces as well.
                  */
-                targ_ns = targ_ns->creator->user_ns;
+                targ_ns = targ_ns->parent;
         }
 
         /* We never get here */
@@ -137,10 +137,10 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
         rcu_read_lock();
         cred = current_cred();
         child_cred = __task_cred(child);
-        if (cred->user->user_ns == child_cred->user->user_ns &&
+        if (cred->user_ns == child_cred->user_ns &&
             cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
                 goto out;
-        if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
+        if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
                 goto out;
         ret = -EPERM;
 out:
@@ -169,10 +169,10 @@ int cap_ptrace_traceme(struct task_struct *parent)
         rcu_read_lock();
         cred = __task_cred(parent);
         child_cred = current_cred();
-        if (cred->user->user_ns == child_cred->user->user_ns &&
+        if (cred->user_ns == child_cred->user_ns &&
             cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
                 goto out;
-        if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
+        if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
                 goto out;
         ret = -EPERM;
 out:
@@ -215,7 +215,7 @@ static inline int cap_inh_is_capped(void)
         /* they are so limited unless the current task has the CAP_SETPCAP
          * capability
          */
-        if (cap_capable(current_cred(), current_cred()->user->user_ns,
+        if (cap_capable(current_cred(), current_cred()->user_ns,
                         CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
                 return 0;
         return 1;
@@ -473,19 +473,22 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
         struct cred *new = bprm->cred;
         bool effective, has_cap = false;
         int ret;
+        kuid_t root_uid;
 
         effective = false;
         ret = get_file_caps(bprm, &effective, &has_cap);
         if (ret < 0)
                 return ret;
 
+        root_uid = make_kuid(new->user_ns, 0);
+
         if (!issecure(SECURE_NOROOT)) {
                 /*
                  * If the legacy file capability is set, then don't set privs
                  * for a setuid root binary run by a non-root user.  Do set it
                  * for a root user just to cause least surprise to an admin.
                  */
-                if (has_cap && new->uid != 0 && new->euid == 0) {
+                if (has_cap && !uid_eq(new->uid, root_uid) && uid_eq(new->euid, root_uid)) {
                         warn_setuid_and_fcaps_mixed(bprm->filename);
                         goto skip;
                 }
@@ -496,12 +499,12 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
                  *
                  * If only the real uid is 0, we do not set the effective bit.
                  */
-                if (new->euid == 0 || new->uid == 0) {
+                if (uid_eq(new->euid, root_uid) || uid_eq(new->uid, root_uid)) {
                         /* pP' = (cap_bset & ~0) | (pI & ~0) */
                         new->cap_permitted = cap_combine(old->cap_bset,
                                                          old->cap_inheritable);
                 }
-                if (new->euid == 0)
+                if (uid_eq(new->euid, root_uid))
                         effective = true;
         }
 skip:
@@ -512,14 +515,17 @@ skip:
 
 
         /* Don't let someone trace a set[ug]id/setpcap binary with the revised
-         * credentials unless they have the appropriate permit
+         * credentials unless they have the appropriate permit.
+         *
+         * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
          */
-        if ((new->euid != old->uid ||
-             new->egid != old->gid ||
+        if ((!uid_eq(new->euid, old->uid) ||
+             !gid_eq(new->egid, old->gid) ||
              !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
             bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                 /* downgrade; they get no more than they had, and maybe less */
-                if (!capable(CAP_SETUID)) {
+                if (!capable(CAP_SETUID) ||
+                    (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
                         new->euid = new->uid;
                         new->egid = new->gid;
                 }
@@ -550,7 +556,7 @@ skip:
          */
         if (!cap_isclear(new->cap_effective)) {
                 if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
-                    new->euid != 0 || new->uid != 0 ||
+                    !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
                     issecure(SECURE_NOROOT)) {
                         ret = audit_log_bprm_fcaps(bprm, new, old);
                         if (ret < 0)
@@ -575,16 +581,17 @@ skip:
 int cap_bprm_secureexec(struct linux_binprm *bprm)
 {
         const struct cred *cred = current_cred();
+        kuid_t root_uid = make_kuid(cred->user_ns, 0);
 
-        if (cred->uid != 0) {
+        if (!uid_eq(cred->uid, root_uid)) {
                 if (bprm->cap_effective)
                         return 1;
                 if (!cap_isclear(cred->cap_permitted))
                         return 1;
         }
 
-        return (cred->euid != cred->uid ||
-                cred->egid != cred->gid);
+        return (!uid_eq(cred->euid, cred->uid) ||
+                !gid_eq(cred->egid, cred->gid));
 }
 
 /**
@@ -674,15 +681,21 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
  */
 static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
 {
-        if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&
-            (new->uid != 0 && new->euid != 0 && new->suid != 0) &&
+        kuid_t root_uid = make_kuid(old->user_ns, 0);
+
+        if ((uid_eq(old->uid, root_uid) ||
+             uid_eq(old->euid, root_uid) ||
+             uid_eq(old->suid, root_uid)) &&
+            (!uid_eq(new->uid, root_uid) &&
+             !uid_eq(new->euid, root_uid) &&
+             !uid_eq(new->suid, root_uid)) &&
             !issecure(SECURE_KEEP_CAPS)) {
                 cap_clear(new->cap_permitted);
                 cap_clear(new->cap_effective);
         }
-        if (old->euid == 0 && new->euid != 0)
+        if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
                 cap_clear(new->cap_effective);
-        if (old->euid != 0 && new->euid == 0)
+        if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
                 new->cap_effective = new->cap_permitted;
 }
 
@@ -715,11 +728,12 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
                  *          if not, we might be a bit too harsh here.
                  */
                 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
-                        if (old->fsuid == 0 && new->fsuid != 0)
+                        kuid_t root_uid = make_kuid(old->user_ns, 0);
+                        if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
                                 new->cap_effective =
                                         cap_drop_fs_set(new->cap_effective);
 
-                        if (old->fsuid != 0 && new->fsuid == 0)
+                        if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
                                 new->cap_effective =
                                         cap_raise_fs_set(new->cap_effective,
                                                          new->cap_permitted);
@@ -872,7 +886,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                     || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                     || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
                     || (cap_capable(current_cred(),
-                                    current_cred()->user->user_ns, CAP_SETPCAP,
+                                    current_cred()->user_ns, CAP_SETPCAP,
                                     SECURITY_CAP_AUDIT) != 0)           /*[4]*/
                         /*
                          * [1] no changing of bits that are locked