Merge tag 'audit-pr-20200226' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoor...

[linux.git] / kernel / fork.c

diff --git a/kernel/fork.c b/kernel/fork.c
index 080809560072550279595ae05567b4a64cced9d7..60a1295f4384363ae9b35e589c02e52fbf914a26 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -692,7 +692,7 @@ void __mmdrop(struct mm_struct *mm)
        WARN_ON_ONCE(mm == current->active_mm);
        mm_free_pgd(mm);
        destroy_context(mm);
-       mmu_notifier_mm_destroy(mm);
+       mmu_notifier_subscriptions_destroy(mm);
        check_mm(mm);
        put_user_ns(mm->user_ns);
        free_mm(mm);
@@ -1025,7 +1025,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
        mm_init_aio(mm);
        mm_init_owner(mm, p);
        RCU_INIT_POINTER(mm->exe_file, NULL);
-       mmu_notifier_mm_init(mm);
+       mmu_notifier_subscriptions_init(mm);
        init_tlb_flush_pending(mm);
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
        mm->pmd_huge_pte = NULL;
@@ -1832,6 +1832,7 @@ static __latent_entropy struct task_struct *copy_process(
        struct multiprocess_signals delayed;
        struct file *pidfile = NULL;
        u64 clone_flags = args->flags;
+       struct nsproxy *nsp = current->nsproxy;
 
        /*
         * Don't allow sharing the root directory with processes in a different
@@ -1874,8 +1875,16 @@ static __latent_entropy struct task_struct *copy_process(
         */
        if (clone_flags & CLONE_THREAD) {
                if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
-                   (task_active_pid_ns(current) !=
-                               current->nsproxy->pid_ns_for_children))
+                   (task_active_pid_ns(current) != nsp->pid_ns_for_children))
+                       return ERR_PTR(-EINVAL);
+       }
+
+       /*
+        * If the new process will be in a different time namespace
+        * do not allow it to share VM or a thread group with the forking task.
+        */
+       if (clone_flags & (CLONE_THREAD | CLONE_VM)) {
+               if (nsp->time_ns != nsp->time_ns_for_children)
                        return ERR_PTR(-EINVAL);
        }
 
@@ -2821,7 +2830,8 @@ static int check_unshare_flags(unsigned long unshare_flags)
        if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET|
-                               CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP))
+                               CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP|
+                               CLONE_NEWTIME))
                return -EINVAL;
        /*
         * Not implemented, but pretend it works if there is nothing