[PATCH RFC v3 05/90] user_namespace: refuse setns() into a cell

[Josef Bacik]

A task that enters a user namespace with setns() gets a full set of
capabilities over everything that the namespace owns.

A task is born in a cell, and no existing task can enter one. Refuse
setns() into the user namespace of a cell. This also applies while the
cell is still being built.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 kernel/user_namespace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 9301d0d41cb9..45699a0a0bfd 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -1437,6 +1437,10 @@ static int userns_install(struct nsset *nsset, struct ns_common *ns)
 	if (user_ns == current_user_ns())
 		return -EINVAL;
 
+	/* Nobody enters a cell, not even while it is being built. */
+	if (userns_is_cell(user_ns))
+		return -EPERM;
+
 	/* Tasks that share a thread group must share a user namespace */
 	if (!thread_group_empty(current))
 		return -EINVAL;

-- 
2.55.0