[lxc-devel] [lxc/lxc] d512bd: CVE-2017-5985: Ensure target netns is caller-owned

[GitHub]

  Branch: refs/heads/stable-2.0
  Home:   https://github.com/lxc/lxc
  Commit: d512bd5efb0e407eba350c4e649c464a65b712a3
      https://github.com/lxc/lxc/commit/d512bd5efb0e407eba350c4e649c464a65b712a3
  Author: Christian Brauner <christian.brauner at ubuntu.com>
  Date:   2017-03-07 (Tue, 07 Mar 2017)

  Changed paths:
    M src/lxc/lxc_user_nic.c

  Log Message:
  -----------
  CVE-2017-5985: Ensure target netns is caller-owned

Before this commit, lxc-user-nic could potentially have been tricked into
operating on a network namespace over which the caller did not hold privilege.

This commit ensures that the caller is privileged over the network namespace by
temporarily dropping privilege.

Launchpad: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676
Reported-by: Jann Horn <jannh at google.com>
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>