Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Miklos Szeredi <> | Subject | [PATCH v2 03/10] ovl: check privs before decoding file handle | Date | Mon, 7 Dec 2020 17:32:48 +0100 |
| |
CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in ovl_decode_real_fh() as well to prevent privilege escalation for unprivileged overlay mounts.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> --- fs/overlayfs/namei.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c index a6162c4076db..82a55fdb1e7a 100644 --- a/fs/overlayfs/namei.c +++ b/fs/overlayfs/namei.c @@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fh *fh, struct vfsmount *mnt, struct dentry *real; int bytes; + if (!capable(CAP_DAC_READ_SEARCH)) + return NULL; + /* * Make sure that the stored uuid matches the uuid of the lower * layer where file handle will be decoded. -- 2.26.2
| ![\](/images/icornerr.gif) |