ioctl CAP_LINUX_IMMUTABLE is checked in the wrong namespace

[Eric W. Biederman]

Theodore Ts'o <tytso at mit.edu> writes:

> On Wed, Apr 30, 2014 at 12:16:41AM +0000, Serge Hallyn wrote:
>> I forget the details, but there was another case where I wanted to
>> have the userns which 'owns' the whole fs available.  I guess we'd
>> have to check against that instead of using inode_capable.
>
> Yes, that sounds right.
>
> And *please* tell me that that under no circumstances can anyone other
> than root at init_user_ns is allowed to use mknod....

Nope.  mknod not allowed.  capable(CAP_MKNOD) is required is required
and I can't see any reason to change that.

As a rule of thumb, the only additional actions allowed in a user
namespace above and beyond what an ordinary unpriviliged user would be
allowed to do are those things which we only don't allow because they
could confuse a setuid root executable.


If we ever allow the creation of immutable files by unprivileged users
those files would at least have to be kept completely separate from the
files the global root encounters (aka a disjoint mount namespace).

I do not currently see a path to safely using immutable files with just
user namespace root permission.

Eric