On 2024-05-07, stsp <stsp2@xxxxxxxxx> wrote:
07.05.2024 10:50, Aleksa Sarai пишет:It is possible to configure MOUNT_ATTR_IDMAP in a user namespace but
If you are a privileged process which plans to change users,Not privileged at all. But I think what you say is still possible with
userns?
there are some restrictions that I suspect will make this complicated.
If you try to do something with a regular filesystem you'll probably run
into issues because you won't have CAP_SYS_ADMIN in the super block's
userns. But you could probably do it with tmpfs.
No, bind-mounts don't require write permission.A new attack I just thought of while writing this mail is that becauseDoesn't this need a write perm to a
there is no RESOLVE_NO_XDEV requirement, it should be possible for the
process to get an arbitrary write primitive by creating a new
userns+mountns and then bind-mounting / underneath the directory.
directory? In his case this is not a threat,
because you are not supposed to have a
write perm to that dir. OA2_CRED_INHERIT
is the only way to write.