[lxc-devel] [lxc/lxc] 16af23: CVE-2017-5985: Ensure target netns is caller-owned

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 16af238036a5464ae8f2420ed3af214f0de875f9
      https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9
  Author: Christian Brauner <christian.brauner at ubuntu.com>
  Date:   2017-03-09 (Thu, 09 Mar 2017)

  Changed paths:
    M src/lxc/lxc_user_nic.c

  Log Message:
  -----------
  CVE-2017-5985: Ensure target netns is caller-owned

Before this commit, lxc-user-nic could potentially have been tricked into
operating on a network namespace over which the caller did not hold privilege.

This commit ensures that the caller is privileged over the network namespace by
temporarily dropping privilege.

Launchpad: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676
Reported-by: Jann Horn <jannh at google.com>
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>