sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

vsock: prevent child netns mode switch from local to global 

A "local" namespace can change its `child_ns_mode` sysctl to "global",
allowing nested namespaces to access global CIDs. This can be exploited
by an unprivileged user who gained CAP_NET_ADMIN through a user
namespace.

Prevent this by rejecting writes that attempt to set `child_ns_mode` to
"global" when the current namespace's mode is "local".

Fixes: eafb64f40c ("vsock: add netns to vsock core")
Cc: bobbyeshleman@meta.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260212205916.97533-3-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Stefano Garzarella 2026-02-12 21:59:16 +01:00 committed by Jakub Kicinski
parent 9dd391493a
commit 6a997f38bd
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/vmw_vsock/af_vsock.c
View File

@ -95,8 +95,9 @@
* the namespace's own ns_mode.
*
* Changing child_ns_mode only affects newly created namespaces, not the
* current namespace or existing children. At namespace creation, ns_mode
* is inherited from the parent's child_ns_mode.
* current namespace or existing children. A "local" namespace cannot set
* child_ns_mode to "global". At namespace creation, ns_mode is inherited
* from the parent's child_ns_mode.
*
* The init_net mode is "global" and cannot be modified.
*
@ -2844,8 +2845,16 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write,
if (ret)
return ret;
if (write)
if (write) {
/* Prevent a "local" namespace from escalating to "global",
* which would give nested namespaces access to global CIDs.
*/
if (vsock_net_mode(net) == VSOCK_NET_MODE_LOCAL &&
new_mode == VSOCK_NET_MODE_GLOBAL)
return -EPERM;
vsock_net_set_child_mode(net, new_mode);
}
return 0;
}