lkml.org 
[lkml]   [2012]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 13/34] Add mount option to check uid of device being mounted = expect uid, CVE-2011-1833
    2.6.32-longterm review patch.  If anyone has any objections, please let me know.

    ------------------

    From: John Johansen <john.johansen@canonical.com>

    (backported from commit 764355487ea220fdc2faf128d577d7f679b91f97)

    Close a TOCTOU race for mounts done via ecryptfs-mount-private. The mount
    source (device) can be raced when the ownership test is done in userspace.
    Provide Ecryptfs a means to force the uid check at mount time.

    BugLink: http://bugs.launchpad.net/bugs/732628
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Tyler Hicks <tyler.hicks@canonical.com>
    Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ecryptfs/main.c | 30 +++++++++++++++++++++++++-----
    1 file changed, 25 insertions(+), 5 deletions(-)

    --- a/fs/ecryptfs/main.c
    +++ b/fs/ecryptfs/main.c
    @@ -212,7 +212,8 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ec
    ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,
    ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
    ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
    - ecryptfs_opt_unlink_sigs, ecryptfs_opt_err };
    + ecryptfs_opt_unlink_sigs, ecryptfs_opt_check_dev_ruid,
    + ecryptfs_opt_err };

    static const match_table_t tokens = {
    {ecryptfs_opt_sig, "sig=%s"},
    @@ -227,6 +228,7 @@ static const match_table_t tokens = {
    {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},
    {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
    {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
    + {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
    {ecryptfs_opt_err, NULL}
    };

    @@ -270,6 +272,7 @@ static void ecryptfs_init_mount_crypt_st
    * ecryptfs_parse_options
    * @sb: The ecryptfs super block
    * @options: The options pased to the kernel
    + * @check_ruid: set to 1 if device uid should be checked against the ruid
    *
    * Parse mount options:
    * debug=N - ecryptfs_verbosity level for debug output
    @@ -285,7 +288,8 @@ static void ecryptfs_init_mount_crypt_st
    *
    * Returns zero on success; non-zero on error
    */
    -static int ecryptfs_parse_options(struct super_block *sb, char *options)
    +static int ecryptfs_parse_options(struct super_block *sb, char *options,
    + uid_t *check_ruid)
    {
    char *p;
    int rc = 0;
    @@ -310,6 +314,8 @@ static int ecryptfs_parse_options(struct
    char *cipher_key_bytes_src;
    char *fn_cipher_key_bytes_src;

    + *check_ruid = 0;
    +
    if (!options) {
    rc = -EINVAL;
    goto out;
    @@ -410,6 +416,9 @@ static int ecryptfs_parse_options(struct
    case ecryptfs_opt_unlink_sigs:
    mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;
    break;
    + case ecryptfs_opt_check_dev_ruid:
    + *check_ruid = 1;
    + break;
    case ecryptfs_opt_err:
    default:
    printk(KERN_WARNING
    @@ -552,7 +561,8 @@ out:
    * ecryptfs_interpose to create our initial inode and super block
    * struct.
    */
    -static int ecryptfs_read_super(struct super_block *sb, const char *dev_name)
    +static int ecryptfs_read_super(struct super_block *sb, const char *dev_name,
    + uid_t check_ruid)
    {
    struct path path;
    int rc;
    @@ -569,6 +579,15 @@ static int ecryptfs_read_super(struct su
    "known incompatibilities\n");
    goto out_free;
    }
    +
    + if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
    + rc = -EPERM;
    + printk(KERN_ERR "Mount of device (uid: %d) not owned by "
    + "requested user (uid: %d)\n",
    + path.dentry->d_inode->i_uid, current_uid());
    + goto out_free;
    + }
    +
    ecryptfs_set_superblock_lower(sb, path.dentry->d_sb);
    sb->s_maxbytes = path.dentry->d_sb->s_maxbytes;
    sb->s_blocksize = path.dentry->d_sb->s_blocksize;
    @@ -607,6 +626,7 @@ static int ecryptfs_get_sb(struct file_s
    {
    int rc;
    struct super_block *sb;
    + uid_t check_ruid;

    rc = get_sb_nodev(fs_type, flags, raw_data, ecryptfs_fill_super, mnt);
    if (rc < 0) {
    @@ -614,12 +634,12 @@ static int ecryptfs_get_sb(struct file_s
    goto out;
    }
    sb = mnt->mnt_sb;
    - rc = ecryptfs_parse_options(sb, raw_data);
    + rc = ecryptfs_parse_options(sb, raw_data, &check_ruid);
    if (rc) {
    printk(KERN_ERR "Error parsing options; rc = [%d]\n", rc);
    goto out_abort;
    }
    - rc = ecryptfs_read_super(sb, dev_name);
    + rc = ecryptfs_read_super(sb, dev_name, check_ruid);
    if (rc) {
    printk(KERN_ERR "Reading sb failed; rc = [%d]\n", rc);
    goto out_abort;



    \
     
     \ /
      Last update: 2012-03-01 22:53    [W:4.156 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site