1 From fb28c99b8a66ff2605c5cb96abc0a4d975f92de0 Mon Sep 17 00:00:00 2001
2 From: Aleksa Sarai <asarai@suse.de>
3 Date: Thu, 15 Feb 2018 23:49:40 +1100
4 Subject: [PATCH] newgidmap: enforce setgroups=deny if self-mapping a group
6 This is necessary to match the kernel-side policy of "self-mapping in a
7 user namespace is fine, but you cannot drop groups" -- a policy that was
8 created in order to stop user namespaces from allowing trivial privilege
9 escalation by dropping supplementary groups that were "blacklisted" from
12 This is the simplest fix for the underlying issue, and effectively makes
13 it so that unless a user has a valid mapping set in /etc/subgid (which
14 only administrators can modify) -- and they are currently trying to use
15 that mapping -- then /proc/$pid/setgroups will be set to deny. This
16 workaround is only partial, because ideally it should be possible to set
17 an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
18 administrators to further restrict newgidmap(1).
20 We also don't write anything in the "allow" case because "allow" is the
21 default, and users may have already written "deny" even if they
22 technically are allowed to use setgroups. And we don't write anything if
23 the setgroups policy is already "deny".
25 Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
27 Reported-by: Craig Furman <craig.furman89@gmail.com>
28 Signed-off-by: Aleksa Sarai <asarai@suse.de>
30 src/newgidmap.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------
31 1 file changed, 80 insertions(+), 9 deletions(-)
33 diff --git a/src/newgidmap.c b/src/newgidmap.c
34 index b1e33513..59a2e75c 100644
41 -static bool verify_range(struct passwd *pw, struct map_range *range)
43 +static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow_setgroups)
45 /* An empty range is invalid */
46 if (range->count == 0)
49 - /* Test /etc/subgid */
50 - if (have_sub_gids(pw->pw_name, range->lower, range->count))
51 + /* Test /etc/subgid. If the mapping is valid then we allow setgroups. */
52 + if (have_sub_gids(pw->pw_name, range->lower, range->count)) {
53 + *allow_setgroups = true;
57 - /* Allow a process to map its own gid */
58 - if ((range->count == 1) && (pw->pw_gid == range->lower))
59 + /* Allow a process to map its own gid. */
60 + if ((range->count == 1) && (pw->pw_gid == range->lower)) {
61 + /* noop -- if setgroups is enabled already we won't disable it. */
68 static void verify_ranges(struct passwd *pw, int ranges,
69 - struct map_range *mappings)
70 + struct map_range *mappings, bool *allow_setgroups)
72 struct map_range *mapping;
76 for (idx = 0; idx < ranges; idx++, mapping++) {
77 - if (!verify_range(pw, mapping)) {
78 + if (!verify_range(pw, mapping, allow_setgroups)) {
79 fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"),
82 @@ -89,6 +94,70 @@ static void usage(void)
86 +void write_setgroups(int proc_dir_fd, bool allow_setgroups)
89 + char *policy, policy_buffer[4096];
92 + * Default is "deny", and any "allow" will out-rank a "deny". We don't
93 + * forcefully write an "allow" here because the process we are writing
94 + * mappings for may have already set themselves to "deny" (and "allow"
95 + * is the default anyway). So allow_setgroups == true is a noop.
98 + if (allow_setgroups)
101 + setgroups_fd = openat(proc_dir_fd, "setgroups", O_RDWR|O_CLOEXEC);
102 + if (setgroups_fd < 0) {
104 + * If it's an ENOENT then we are on too old a kernel for the setgroups
105 + * code to exist. Emit a warning and bail on this.
107 + if (ENOENT == errno) {
108 + fprintf(stderr, _("%s: kernel doesn't support setgroups restrictions\n"), Prog);
111 + fprintf(stderr, _("%s: couldn't open process setgroups: %s\n"),
114 + exit(EXIT_FAILURE);
118 + * Check whether the policy is already what we want. /proc/self/setgroups
119 + * is write-once, so attempting to write after it's already written to will
122 + if (read(setgroups_fd, policy_buffer, sizeof(policy_buffer)) < 0) {
123 + fprintf(stderr, _("%s: failed to read setgroups: %s\n"),
126 + exit(EXIT_FAILURE);
128 + if (!strncmp(policy_buffer, policy, strlen(policy)))
131 + /* Write the policy. */
132 + if (lseek(setgroups_fd, 0, SEEK_SET) < 0) {
133 + fprintf(stderr, _("%s: failed to seek setgroups: %s\n"),
136 + exit(EXIT_FAILURE);
138 + if (dprintf(setgroups_fd, "%s", policy) < 0) {
139 + fprintf(stderr, _("%s: failed to setgroups %s policy: %s\n"),
143 + exit(EXIT_FAILURE);
147 + close(setgroups_fd);
151 * newgidmap - Set the gid_map for the specified process
153 @@ -103,6 +172,7 @@ int main(int argc, char **argv)
157 + bool allow_setgroups = false;
159 Prog = Basename (argv[0]);
161 @@ -145,7 +215,7 @@ int main(int argc, char **argv)
162 (unsigned long) getuid ()));
167 /* Get the effective uid and effective gid of the target process */
168 if (fstat(proc_dir_fd, &st) < 0) {
169 fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
170 @@ -177,8 +247,9 @@ int main(int argc, char **argv)
174 - verify_ranges(pw, ranges, mappings);
175 + verify_ranges(pw, ranges, mappings, &allow_setgroups);
177 + write_setgroups(proc_dir_fd, allow_setgroups);
178 write_mapping(proc_dir_fd, ranges, mappings, "gid_map");