Eric W. Biederman fc9b65e3d7 userns: Don't allow setgroups until a gid mapping has been setablished ... commit 273d2c67c3 upstream. setgroups is unique in not needing a valid mapping before it can be called, in the case of setgroups(0, NULL) which drops all supplemental groups. The design of the user namespace assumes that CAP_SETGID can not actually be used until a gid mapping is established. Therefore add a helper function to see if the user namespace gid mapping has been established and call that function in the setgroups permission check. This is part of the fix for CVE-2014-8989, being able to drop groups without privilege using user namespaces. Reviewed-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-01-08 09:58:16 -08:00
..
acpi	ACPI / hotplug: Fix conflicted PCI bridge notify handlers	2013-12-04 10:57:04 -08:00
asm-generic	mm: use paravirt friendly ops for NUMA hinting ptes	2014-05-30 21:52:12 -07:00
clocksource	clocksource: arch_timer: use virtual counters	2014-01-09 12:24:26 -08:00
crypto	crypto: scatterwalk - Use sg_chain_ptr on chain entries	2013-12-11 22:36:29 -08:00
drm	drm/radeon: remove invalid pci id	2014-11-14 08:48:00 -08:00
dt-bindings
keys
linux	userns: Don't allow setgroups until a gid mapping has been setablished	2015-01-08 09:58:16 -08:00
math-emu
media	media: vb2: fix VBI/poll regression	2014-10-09 12:18:42 -07:00
memory
misc
net	net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks	2014-11-21 09:22:55 -08:00
pcmcia
ras
rdma
rxrpc
scsi	scsi: fix our current target reap infrastructure	2014-05-30 21:52:11 -07:00
sound	ALSA: control: Protect user controls against concurrent access	2014-06-26 15:12:43 -04:00
target	target: Report correct response length for some commands	2014-06-30 20:09:45 -07:00
trace	tracing: Fix syscall_*regfunc() vs copy_process() race	2014-07-06 18:54:16 -07:00
uapi	netfilter: xt_bpf: add mising opaque struct sk_filter definition	2014-11-21 09:22:54 -08:00
video	Merge branch 'fbdev-3.10-fixes' of git://gitorious.org/linux-omap-dss2/linux into linux-fbdev/for-3.10-fixes	2013-05-29 17:00:34 +08:00
xen	xenbus: delay xenbus frontend resume if xenstored is not running	2013-05-29 09:04:19 -04:00
Kbuild