Messages in this thread | | | Date | Wed, 21 Jul 2010 09:01:24 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH v2] Yama: verify inode is symlink to avoid bind mounts |
| |
On Tue, 13 Jul 2010, Kees Cook wrote:
> The inode_follow_link LSM hook is called in bind mount situations as > well as for symlink situations, so we must explicitly check for the > inode being a symlink to not reject bind mounts in 1777 directories, > which seems to be a common NFSv4 configuration. > > Signed-off-by: Kees Cook <kees.cook@canonical.com> > --- > v2: > - actually set inode in time to use it. *face palm*
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
-- James Morris <jmorris@namei.org>
| |