diff options
| -rw-r--r-- | 0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch | 57 | ||||
| -rw-r--r-- | PKGBUILD | 9 | ||||
| -rw-r--r-- | config.x86_64 | 4 |
3 files changed, 66 insertions, 4 deletions
diff --git a/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch b/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch new file mode 100644 index 0000000..dfa89cc --- /dev/null +++ b/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch @@ -0,0 +1,57 @@ +From b30ec6648774140adcbfc9b0e813ecfd0785f79d Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com> +Date: Thu, 7 Dec 2017 13:50:48 +0100 +Subject: [PATCH 2/3] ZEN: Add CONFIG for unprivileged_userns_clone + +This way our default behavior continues to match the vanilla kernel. +--- + init/Kconfig | 16 ++++++++++++++++ + kernel/user_namespace.c | 4 ++++ + 2 files changed, 20 insertions(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 4592bf7997c0..f3df02990aff 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1004,6 +1004,22 @@ config USER_NS + + If unsure, say N. + ++config USER_NS_UNPRIVILEGED ++ bool "Allow unprivileged users to create namespaces" ++ default y ++ depends on USER_NS ++ help ++ When disabled, unprivileged users will not be able to create ++ new namespaces. Allowing users to create their own namespaces ++ has been part of several recent local privilege escalation ++ exploits, so if you need user namespaces but are ++ paranoid^Wsecurity-conscious you want to disable this. ++ ++ This setting can be overridden at runtime via the ++ kernel.unprivileged_userns_clone sysctl. ++ ++ If unsure, say Y. ++ + config PID_NS + bool "PID Namespaces" + default y +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 6b9dbc257e34..107b17f0d528 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -27,7 +27,11 @@ + #include <linux/sort.h> + + /* sysctl */ ++#ifdef CONFIG_USER_NS_UNPRIVILEGED ++int unprivileged_userns_clone = 1; ++#else + int unprivileged_userns_clone; ++#endif + + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); +-- +2.22.0 + @@ -18,7 +18,7 @@ pkgbase=linux-ck _majver=5.1 -_minver=9 +_minver=10 if [ "$_minver" == "0" ]; then pkgver=${_majver} else @@ -39,6 +39,7 @@ options=('!strip') source=( https://www.kernel.org/pub/linux/kernel/v5.x/linux-$pkgver.tar.{xz,sign} 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch + 0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch ck_remove-excess-extraversion.patch http://ck.kolivas.org/patches/5.0/${_majver}/${_majver}-ck${_ckpatchversion}/${_ckpatch}.xz graysky_bdver2-hotfix.patch @@ -50,16 +51,17 @@ source=( 90-linux.hook # pacman hook for initramfs regeneration linux.preset # standard config files for mkinitcpio ramdisk ) -sha256sums=('58c9eca99c3dd2fff5b559302996c985c3f3f2aad0b99b2172a61c4df7122a79' +sha256sums=('39063041532579cb7e9fab5837313a8e6639c1c583cd39c72b313b3abfa9fbcf' 'SKIP' '91fafa76bf9cb32159ac7f22191b3589278b91e65bc4505cf2fc6013b8037bf3' + '63e4378e69e2f23ed87af32a4951477a6d82d4ac0de2295db46502c8120da9d9' 'a2db6672b2d35f3006c7151e8fa90f5187dcdac9fcc46e88e78d45c7d8226d1f' 'f8d18a34f6b17ec8e5f2a7354383ca627e0fd00b5578c1ee7d9808a34f33c724' '229e063a578db0a278108f37b24da20c2a2a18d825e98a67e426cb0f4b492e4a' '226e30068ea0fecdb22f337391385701996bfbdba37cdcf0f1dbf55f1080542d' 'e7ebf050c22bcec0028c0b3c79fd6d3913b0370ecc6a23dfe78ce475630cf503' '0f81d6e4158b7beeb0eb514f1b9401f7e23699cb0f7b0d513e25dae1815daaeb' - '2d647fab9f5355e1c55c9fc280812314917298cf59881fb6e80a51e7e39dd0c2' + 'e7facc4e05b3e5c0bbd5671c398835338368d30481b8c3c8b19559efccba01c9' 'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21' '75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919' 'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65') @@ -82,6 +84,7 @@ prepare() { # Hotfixes msg2 "Applying hotfixes" patch -p1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch + patch -p1 -i ../0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch # ck hotfixes diff --git a/config.x86_64 b/config.x86_64 index 35aab7e..f1c099e 100644 --- a/config.x86_64 +++ b/config.x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 5.1.8 Kernel Configuration +# Linux/x86 5.1.9 Kernel Configuration # # @@ -163,6 +163,7 @@ CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_IPC_NS=y CONFIG_USER_NS=y +CONFIG_USER_NS_UNPRIVILEGED=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_CHECKPOINT_RESTORE=y @@ -6060,6 +6061,7 @@ CONFIG_CHASH=m # CONFIG_CHASH_STATS is not set # CONFIG_CHASH_SELFTEST is not set CONFIG_DRM_NOUVEAU=m +CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT=y CONFIG_NOUVEAU_DEBUG=5 CONFIG_NOUVEAU_DEBUG_DEFAULT=3 # CONFIG_NOUVEAU_DEBUG_MMU is not set |