ioctl CAP_LINUX_IMMUTABLE is checked in the wrong namespace

[Theodore Ts'o]

On Tue, Apr 29, 2014 at 03:45:24PM -0700, Andy Lutomirski wrote:
> 
> Wait, what?
> 
> Inodes aren't owned by user namespaces; they're owned by users.  And any
> user can arrange to have a user namespace in which they pass an
> inode_capable check on any inode that they own.
> 
> Presumably there's a reason that CAP_SYS_IMMUTABLE is needed.  If this
> gets merged, then it would be better to just drop CAP_SYS_IMMUTABLE
> entirely.
> 
> Nacked-by: Andy Lutomirski <luto at amacapital.net>

Right, but you can't set a mapping in a child namespace unless you
have CAP_SETUID in the parent namespace, right?  Otherwise user
namespaces are completely broken from a security perspective, since
inode_capable() could never do the right thing.

Personally, reading how user namespaces work, it makes the hair rise
on the back of my neck.  I'm not sure the concept works at all from a
security perspective, but hey, I'm not using user namespaces, and some
fool thought it was worth merging.  :-)

						- Ted