[PATCH] virt: vbox: Do not report user namespace root as root to the host

[Hungyu Lin]

vbg_misc_device_requestor() decides whether the opener of the vboxguest
or vboxuser device is reported to the host as root:

	if (from_kuid(current_user_ns(), current_uid()) == 0)
		requestor |= VMMDEV_REQUESTOR_USR_ROOT;

from_kuid() translates the uid into the user namespace of the caller.
An unprivileged user who creates a user namespace and maps their uid to
0 in it is therefore reported as VMMDEV_REQUESTOR_USR_ROOT for every
request of that session, although the uid has no privileges outside of
that namespace. The host uses the user class to account the HGCM
requests of a session, so such a user is charged to the budget of root
instead of the one for ordinary users.

Compare the uid against GLOBAL_ROOT_UID so that only root in the initial
user namespace is reported as root.

Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 drivers/virt/vboxguest/vboxguest_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
index 7474bae2cd9a..ff66c00c27da 100644
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -35,7 +35,7 @@ static u32 vbg_misc_device_requestor(struct inode *inode)
 			VMMDEV_REQUESTOR_CON_DONT_KNOW |
 			VMMDEV_REQUESTOR_TRUST_NOT_GIVEN;

-	if (from_kuid(current_user_ns(), current_uid()) == 0)
+	if (uid_eq(current_uid(), GLOBAL_ROOT_UID))
 		requestor |= VMMDEV_REQUESTOR_USR_ROOT;
 	else
 		requestor |= VMMDEV_REQUESTOR_USR_USER;
--
2.43.0