8 files changed, 103 insertions, 45 deletions

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index d21a427a35ae..ae3a698415e6 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -22,6 +22,7 @@
 #include <linux/ctype.h>
 #include <linux/sysctl.h>
 #include <linux/audit.h>
+#include <linux/user_namespace.h>
 #include <net/sock.h>
 
 #include "include/apparmor.h"
@@ -136,11 +137,11 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
 }
 
 static int apparmor_capable(struct task_struct *task, const struct cred *cred,
-                            int cap, int audit)
+                            struct user_namespace *ns, int cap, int audit)
 {
         struct aa_profile *profile;
         /* cap_capable returns 0 on success, else -EPERM */
-        int error = cap_capable(task, cred, cap, audit);
+        int error = cap_capable(task, cred, ns, cap, audit);
         if (!error) {
                 profile = aa_cred_profile(cred);
                 if (!unconfined(profile))
diff --git a/security/capability.c b/security/capability.c
index ab3d807accc3..2984ea4f776f 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -761,7 +761,7 @@ static int cap_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 sk_sid, u8 dir)
 
 static int cap_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                          struct xfrm_policy *xp,
-                                         struct flowi *fl)
+                                         const struct flowi *fl)
 {
         return 1;
 }
diff --git a/security/commoncap.c b/security/commoncap.c
index 64c2ed9c9015..f20e984ccfb4 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/user_namespace.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -52,13 +53,12 @@ static void warn_setuid_and_fcaps_mixed(const char *fname)
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-        NETLINK_CB(skb).eff_cap = current_cap();
         return 0;
 }
 
 int cap_netlink_recv(struct sk_buff *skb, int cap)
 {
-        if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
+        if (!cap_raised(current_cap(), cap))
                 return -EPERM;
         return 0;
 }
@@ -68,6 +68,7 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_capable - Determine whether a task has a particular effective capability
  * @tsk: The task to query
  * @cred: The credentials to use
+ * @ns:  The user namespace in which we need the capability
  * @cap: The capability to check for
  * @audit: Whether to write an audit message or not
  *
@@ -79,10 +80,30 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_has_capability() returns 0 when a task has a capability, but the
  * kernel's capable() and has_capability() returns 1 for this case.
  */
-int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
-                int audit)
+int cap_capable(struct task_struct *tsk, const struct cred *cred,
+                struct user_namespace *targ_ns, int cap, int audit)
 {
-        return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+        for (;;) {
+                /* The creator of the user namespace has all caps. */
+                if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)
+                        return 0;
+
+                /* Do we have the necessary capabilities? */
+                if (targ_ns == cred->user->user_ns)
+                        return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+
+                /* Have we tried all of the parent namespaces? */
+                if (targ_ns == &init_user_ns)
+                        return -EPERM;
+
+                /*
+                 *If you have a capability in a parent user ns, then you have
+                 * it over all children user namespaces as well.
+                 */
+                targ_ns = targ_ns->creator->user_ns;
+        }
+
+        /* We never get here */
 }
 
 /**
@@ -93,7 +114,7 @@ int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
  * Determine whether the current process may set the system clock and timezone
  * information, returning 0 if permission granted, -ve if denied.
  */
-int cap_settime(struct timespec *ts, struct timezone *tz)
+int cap_settime(const struct timespec *ts, const struct timezone *tz)
 {
         if (!capable(CAP_SYS_TIME))
                 return -EPERM;
@@ -106,18 +127,30 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
  * @child: The process to be accessed
  * @mode: The mode of attachment.
  *
+ * If we are in the same or an ancestor user_ns and have all the target
+ * task's capabilities, then ptrace access is allowed.
+ * If we have the ptrace capability to the target user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether a process may access another, returning 0 if permission
  * granted, -ve if denied.
  */
 int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
 {
         int ret = 0;
+        const struct cred *cred, *child_cred;
 
         rcu_read_lock();
-        if (!cap_issubset(__task_cred(child)->cap_permitted,
-                          current_cred()->cap_permitted) &&
-            !capable(CAP_SYS_PTRACE))
-                ret = -EPERM;
+        cred = current_cred();
+        child_cred = __task_cred(child);
+        if (cred->user->user_ns == child_cred->user->user_ns &&
+            cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+                goto out;
+        if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
+                goto out;
+        ret = -EPERM;
+out:
         rcu_read_unlock();
         return ret;
 }
@@ -126,18 +159,30 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
  * cap_ptrace_traceme - Determine whether another process may trace the current
  * @parent: The task proposed to be the tracer
  *
+ * If parent is in the same or an ancestor user_ns and has all current's
+ * capabilities, then ptrace access is allowed.
+ * If parent has the ptrace capability to current's user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether the nominated task is permitted to trace the current
  * process, returning 0 if permission is granted, -ve if denied.
  */
 int cap_ptrace_traceme(struct task_struct *parent)
 {
         int ret = 0;
+        const struct cred *cred, *child_cred;
 
         rcu_read_lock();
-        if (!cap_issubset(current_cred()->cap_permitted,
-                          __task_cred(parent)->cap_permitted) &&
-            !has_capability(parent, CAP_SYS_PTRACE))
-                ret = -EPERM;
+        cred = __task_cred(parent);
+        child_cred = current_cred();
+        if (cred->user->user_ns == child_cred->user->user_ns &&
+            cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+                goto out;
+        if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
+                goto out;
+        ret = -EPERM;
+out:
         rcu_read_unlock();
         return ret;
 }
@@ -177,7 +222,8 @@ static inline int cap_inh_is_capped(void)
         /* they are so limited unless the current task has the CAP_SETPCAP
          * capability
          */
-        if (cap_capable(current, current_cred(), CAP_SETPCAP,
+        if (cap_capable(current, current_cred(),
+                        current_cred()->user->user_ns, CAP_SETPCAP,
                         SECURITY_CAP_AUDIT) == 0)
                 return 0;
         return 1;
@@ -829,7 +875,8 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                      & (new->securebits ^ arg2))                        /*[1]*/
                     || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                     || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
-                    || (cap_capable(current, current_cred(), CAP_SETPCAP,
+                    || (cap_capable(current, current_cred(),
+                                    current_cred()->user->user_ns, CAP_SETPCAP,
                                     SECURITY_CAP_AUDIT) != 0)           /*[4]*/
                         /*
                          * [1] no changing of bits that are locked
@@ -894,7 +941,7 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int cap_sys_admin = 0;
 
-        if (cap_capable(current, current_cred(), CAP_SYS_ADMIN,
+        if (cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_ADMIN,
                         SECURITY_CAP_NOAUDIT) == 0)
                 cap_sys_admin = 1;
         return __vm_enough_memory(mm, pages, cap_sys_admin);
@@ -921,7 +968,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
         int ret = 0;
 
         if (addr < dac_mmap_min_addr) {
-                ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+                ret = cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_RAWIO,
                                   SECURITY_CAP_AUDIT);
                 /* set PF_SUPERPRIV if it turns out we allow the low mmap */
                 if (ret == 0)
diff --git a/security/security.c b/security/security.c
index 47b8a447118f..101142369db4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -154,29 +154,33 @@ int security_capset(struct cred *new, const struct cred *old,
                                     effective, inheritable, permitted);
 }
 
-int security_capable(const struct cred *cred, int cap)
+int security_capable(struct user_namespace *ns, const struct cred *cred,
+                     int cap)
 {
-        return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
+        return security_ops->capable(current, cred, ns, cap,
+                                     SECURITY_CAP_AUDIT);
 }
 
-int security_real_capable(struct task_struct *tsk, int cap)
+int security_real_capable(struct task_struct *tsk, struct user_namespace *ns,
+                          int cap)
 {
         const struct cred *cred;
         int ret;
 
         cred = get_task_cred(tsk);
-        ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_AUDIT);
+        ret = security_ops->capable(tsk, cred, ns, cap, SECURITY_CAP_AUDIT);
         put_cred(cred);
         return ret;
 }
 
-int security_real_capable_noaudit(struct task_struct *tsk, int cap)
+int security_real_capable_noaudit(struct task_struct *tsk,
+                                  struct user_namespace *ns, int cap)
 {
         const struct cred *cred;
         int ret;
 
         cred = get_task_cred(tsk);
-        ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_NOAUDIT);
+        ret = security_ops->capable(tsk, cred, ns, cap, SECURITY_CAP_NOAUDIT);
         put_cred(cred);
         return ret;
 }
@@ -196,7 +200,7 @@ int security_syslog(int type)
         return security_ops->syslog(type);
 }
 
-int security_settime(struct timespec *ts, struct timezone *tz)
+int security_settime(const struct timespec *ts, const struct timezone *tz)
 {
         return security_ops->settime(ts, tz);
 }
@@ -1105,7 +1109,7 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
 
 void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
-        security_ops->sk_getsecid(sk, &fl->secid);
+        security_ops->sk_getsecid(sk, &fl->flowi_secid);
 }
 EXPORT_SYMBOL(security_sk_classify_flow);
 
@@ -1238,7 +1242,8 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 }
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                                       struct xfrm_policy *xp, struct flowi *fl)
+                                       struct xfrm_policy *xp,
+                                       const struct flowi *fl)
 {
         return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
 }
@@ -1250,7 +1255,7 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 
 void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
 {
-        int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
+        int rc = security_ops->xfrm_decode_session(skb, &fl->flowi_secid, 0);
 
         BUG_ON(rc);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d52a92507412..f9c3764e4859 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -79,6 +79,7 @@
 #include <linux/mutex.h>
 #include <linux/posix-timers.h>
 #include <linux/syslog.h>
+#include <linux/user_namespace.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -1846,11 +1847,11 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
-                           int cap, int audit)
+                           struct user_namespace *ns, int cap, int audit)
 {
         int rc;
 
-        rc = cap_capable(tsk, cred, cap, audit);
+        rc = cap_capable(tsk, cred, ns, cap, audit);
         if (rc)
                 return rc;
 
@@ -1931,7 +1932,8 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int rc, cap_sys_admin = 0;
 
-        rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
+        rc = selinux_capable(current, current_cred(),
+                             &init_user_ns, CAP_SYS_ADMIN,
                              SECURITY_CAP_NOAUDIT);
         if (rc == 0)
                 cap_sys_admin = 1;
@@ -2723,7 +2725,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         if (!(sbsec->flags & SE_SBLABELSUPP))
                 return -EOPNOTSUPP;
 
-        if (!is_owner_or_cap(inode))
+        if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
         COMMON_AUDIT_DATA_INIT(&ad, FS);
@@ -2834,7 +2836,8 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
          * and lack of permission just means that we fall back to the
          * in-core context value, not a denial.
          */
-        error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
+        error = selinux_capable(current, current_cred(),
+                                &init_user_ns, CAP_MAC_ADMIN,
                                 SECURITY_CAP_NOAUDIT);
         if (!error)
                 error = security_sid_to_context_force(isec->sid, &context,
@@ -2968,7 +2971,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
         case KDSKBENT:
         case KDSKBSENT:
                 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
-                                            SECURITY_CAP_AUDIT);
+                                        SECURITY_CAP_AUDIT);
                 break;
 
         /* default case assumes that the command will go
@@ -4346,7 +4349,7 @@ static void selinux_secmark_refcount_dec(void)
 static void selinux_req_classify_flow(const struct request_sock *req,
                                       struct flowi *fl)
 {
-        fl->secid = req->secid;
+        fl->flowi_secid = req->secid;
 }
 
 static int selinux_tun_dev_create(void)
@@ -4695,6 +4698,7 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
 {
         int err;
         struct common_audit_data ad;
+        u32 sid;
 
         err = cap_netlink_recv(skb, capability);
         if (err)
@@ -4703,8 +4707,9 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
         COMMON_AUDIT_DATA_INIT(&ad, CAP);
         ad.u.cap = capability;
 
-        return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
-                            SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
+        security_task_getsecid(current, &sid);
+        return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
+                            CAP_TO_MASK(capability), &ad);
 }
 
 static int ipc_alloc_security(struct task_struct *task,
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 13128f9a3e5a..b43813c9e049 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -19,7 +19,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x);
 int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                        struct xfrm_policy *xp, struct flowi *fl);
+                        struct xfrm_policy *xp, const struct flowi *fl);
 
 /*
  * Extract the security blob from the sock (it's actually on the socket)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 3e7544d2a07b..ea7c01f4a2bf 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -213,7 +213,7 @@ static u16 map_class(u16 pol_value)
                         return i;
         }
 
-        return pol_value;
+        return SECCLASS_NULL;
 }
 
 static void map_decision(u16 tclass, struct av_decision *avd,
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 728c57e3d65d..68178b76a2b3 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -112,7 +112,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  */
 
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
-                        struct flowi *fl)
+                        const struct flowi *fl)
 {
         u32 state_sid;
         int rc;
@@ -135,10 +135,10 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
 
         state_sid = x->security->ctx_sid;
 
-        if (fl->secid != state_sid)
+        if (fl->flowi_secid != state_sid)
                 return 0;
 
-        rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
+        rc = avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__SENDTO,
                           NULL)? 0:1;