diff options
| -rw-r--r-- | .SRCINFO | 12 | ||||
| -rw-r--r-- | 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch | 102 | ||||
| -rw-r--r-- | PKGBUILD | 14 | ||||
| -rw-r--r-- | config | 2 |
4 files changed, 118 insertions, 12 deletions
@@ -1,5 +1,5 @@ pkgbase = linux-max98090 - pkgver = 4.14.5 + pkgver = 4.14.6 pkgrel = 1 url = https://www.kernel.org/ arch = x86_64 @@ -14,22 +14,24 @@ pkgbase = linux-max98090 options = !strip source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.xz source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.sign - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.5.xz - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.5.sign + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.6.xz + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.6.sign source = config source = 60-linux.hook source = 90-linux.hook source = linux.preset + source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886 validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E sha256sums = f81d59477e90a130857ce18dc02f4fbe5725854911db1e7ba770c7cd350f96a7 sha256sums = SKIP - sha256sums = d86eb2fd1c424fec9fbb12afacf7b783756651f5d7d0cf7ac71c3fbbbedddc9c + sha256sums = c75b40f450f147014a08987949aafb71d9fcd3e91e443f5c8e4edbf1bbc386c6 sha256sums = SKIP - sha256sums = aff960f717679d3fc6d6a197d31160f700bbf861b5060679b33065aff768b187 + sha256sums = 663d414be1974c371d7430c469ba5b1142bcbfa11bbe55b6066b0af8c06c0e30 sha256sums = ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21 sha256sums = 75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919 sha256sums = ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65 + sha256sums = 37b86ca3de148a34258e3176dbf41488d9dbd19e93adbd22a062b3c41332ce85 pkgname = linux-max98090 pkgdesc = The Archlinux kernel and modules with a fix for baytrail max98090 sound diff --git a/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch new file mode 100644 index 000000000000..29582c2bf608 --- /dev/null +++ b/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch @@ -0,0 +1,102 @@ +From 5ec2dd3a095442ec1a21d86042a4994f2ba24e63 Mon Sep 17 00:00:00 2001 +Message-Id: <5ec2dd3a095442ec1a21d86042a4994f2ba24e63.1512651251.git.jan.steffens@gmail.com> +From: Serge Hallyn <serge.hallyn@canonical.com> +Date: Fri, 31 May 2013 19:12:12 +0100 +Subject: [PATCH] add sysctl to disallow unprivileged CLONE_NEWUSER by default + +Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> +[bwh: Remove unneeded binary sysctl bits] +Signed-off-by: Daniel Micay <danielmicay@gmail.com> +--- + kernel/fork.c | 15 +++++++++++++++ + kernel/sysctl.c | 12 ++++++++++++ + kernel/user_namespace.c | 3 +++ + 3 files changed, 30 insertions(+) + +diff --git a/kernel/fork.c b/kernel/fork.c +index 07cc743698d3668e..4011d68a8ff9305c 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -102,6 +102,11 @@ + + #define CREATE_TRACE_POINTS + #include <trace/events/task.h> ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#else ++#define unprivileged_userns_clone 0 ++#endif + + /* + * Minimum number of threads to boot the kernel +@@ -1555,6 +1560,10 @@ static __latent_entropy struct task_struct *copy_process( + if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) + return ERR_PTR(-EINVAL); + ++ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) ++ if (!capable(CAP_SYS_ADMIN)) ++ return ERR_PTR(-EPERM); ++ + /* + * Thread groups must share signals as well, and detached threads + * can only be started up within the thread group. +@@ -2348,6 +2357,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) + if (unshare_flags & CLONE_NEWNS) + unshare_flags |= CLONE_FS; + ++ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { ++ err = -EPERM; ++ if (!capable(CAP_SYS_ADMIN)) ++ goto bad_unshare_out; ++ } ++ + err = check_unshare_flags(unshare_flags); + if (err) + goto bad_unshare_out; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index b86520ed3fb60fbf..f7dab3760839f1a1 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -105,6 +105,9 @@ extern int core_uses_pid; + extern char core_pattern[]; + extern unsigned int core_pipe_limit; + #endif ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#endif + extern int pid_max; + extern int pid_max_min, pid_max_max; + extern int percpu_pagelist_fraction; +@@ -513,6 +516,15 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif ++#ifdef CONFIG_USER_NS ++ { ++ .procname = "unprivileged_userns_clone", ++ .data = &unprivileged_userns_clone, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++#endif + #ifdef CONFIG_PROC_SYSCTL + { + .procname = "tainted", +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index c490f1e4313b998a..dd03bd39d7bf194d 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -24,6 +24,9 @@ + #include <linux/projid.h> + #include <linux/fs_struct.h> + ++/* sysctl */ ++int unprivileged_userns_clone; ++ + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); + +-- +2.15.1 + @@ -3,7 +3,7 @@ pkgbase=linux-max98090 _srcname=linux-4.14 -pkgver=4.14.5 +pkgver=4.14.6 pkgrel=1 arch=('x86_64') url="https://www.kernel.org/" @@ -19,20 +19,21 @@ source=( '60-linux.hook' # pacman hook for depmod '90-linux.hook' # pacman hook for initramfs regeneration 'linux.preset' # standard config files for mkinitcpio ramdisk + '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch' ) - validpgpkeys=( 'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman ) sha256sums=('f81d59477e90a130857ce18dc02f4fbe5725854911db1e7ba770c7cd350f96a7' 'SKIP' - 'd86eb2fd1c424fec9fbb12afacf7b783756651f5d7d0cf7ac71c3fbbbedddc9c' + 'c75b40f450f147014a08987949aafb71d9fcd3e91e443f5c8e4edbf1bbc386c6' 'SKIP' - 'aff960f717679d3fc6d6a197d31160f700bbf861b5060679b33065aff768b187' + '663d414be1974c371d7430c469ba5b1142bcbfa11bbe55b6066b0af8c06c0e30' 'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21' '75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919' - 'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65') + 'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65' + '37b86ca3de148a34258e3176dbf41488d9dbd19e93adbd22a062b3c41332ce85') _kernelname=${pkgbase#linux} @@ -47,7 +48,8 @@ prepare() { # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git - # https://bugs.archlinux.org/task/56207 + # disable USER_NS for non-root users by default + patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch cp -Tf ../config .config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.5-1 Kernel Configuration +# Linux/x86 4.14.6-1 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y |